Feroxbuster on Chief Dennis' Blog

Sorcerer Offsec Walkthrough

Thu, 11 Dec 2025 13:07:16 +0100

Sorcerer OffSec Walkthrough Link to heading

1. Introduction Link to heading

This walkthrough documents the compromise of the Sorcerer machine from CyberSecLabs (CFT).

We compromised the Sorcerer machine through classic multi-surface enumeration: multiple web servers, exposed ZIP archives leaking Tomcat credentials and SSH keys, restricted SSH bypass through editing authorized_keys, and final privilege escalation via a misconfigured SUID start-stop-daemon binary (GTFOBins).

Cockpit Offsec Walkthrough

Sun, 18 May 2025 13:07:16 +0100

Introduction Link to heading

SQL injection vulnerability Link to heading

A SQL Injection (SQLi) vulnerability is one of the most critical threatsin web applications that interact with databases. This vulnerability occurs when an application does not properly validate and sanitize user input before using it in SQL queries, allowing an attacker to manipulate these queries to access, modify, or delete data in the database.

DVR4 Offsec Walkthrough

Tue, 01 Apr 2025 13:07:16 +0100

DVR4 Offsec Walkthrough Link to heading

LFI Vulnerability Link to heading

Local File Inclusion (LFI) is a security vulnerability in web applications that allows an attacker to access files stored on the server. This failure occurs when an applicationconstructs file paths based on user input without properly validating its contents. As a result, an attacker can manipulate those paths to read sensitive system files and, in some cases, execute malicious code.

Snookum Offsec Walkthrough

Sun, 16 Mar 2025 13:07:16 +0100

Snookum OffSec Walkthrough Link to heading

RFI Vulnerability Link to heading

Remote File Inclusion (RFI) is a vulnerability in web applications that allows an attacker to upload and execute files hosted on external servers. This flaw occurs when an applicationdynamically includes files without properly validating user input, which can lead to the execution of malicious code. If proper security measures are not taken, RFI can completely compromise a system, facilitating data theft, malware execution, or even full control of the server.