tutorials · 1 min
OSCP Preparation: Windows Buffer Overflow - Writeup by Brainpain (Vulnhub)
Video write-up by Brainpan (Vulnhub) focused on practising buffer overflow in Windows for OSCP using Mona.
· Manuel López Pérez
Blog
Explore our articles on cybersecurity, ethical hacking, tutorials, CTF writeups, and information security news
tutorials · 6 min
WordPress 5.1 CSRF + XSS + RCE - PoC
Step-by-step explanation and PoC of the chain of vulnerabilities in WordPress 5.1 (patched in 5.1.1): CSRF in comments → Stored XSS via wp_kses bypass → RCE by editing plugin as administrator. Requires victim interaction (visiting malicious page).
· Pablo Plaza Martínez
tutorials · 5 min
Bypassing WiFi Network Login Pages
Two real techniques for bypassing captive portals on WiFi networks: MAC cloning (weak authentication) and DNS tunnelling with iodine (for more secure portals). Updated with modern tools, best practices, and security recommendations.
· Pablo Plaza Martínez
cheatsheet · 6 min
Port Forwarding - CheatSheet
Practical summary of port forwarding/tunnelling techniques in Linux and Windows (SSH, socat, netcat, meterpreter, plink, and netsh) for accessing internal services behind firewalls.
· Pablo Plaza Martínez
tutorials · 3 min
Remote Code Execution WinRAR (CVE-2018-20250) POC
Proof of Concept (PoC) for the WinRAR CVE-2018-20250 vulnerability, allowing remote code execution by extracting malicious files to arbitrary directories. Step-by-step guide to create a malicious ACE file that executes a payload on system startup.
· Manuel López Pérez
tutorials · 4 min
Introduction to Exploitation, Part 4: ret2libc, Stack 6 (Protostar)
Protostar Stack6: when you can't jump to the stack, it's time for ret2libc. Offset calculation and use of system(), exit() and '/bin/sh' from libc to execute a shell.
· Manuel López Pérez
tutorials · 5 min
Introduction to Exploiting Part 3 – My First Buffer Overflow – Stack 5 (Protostar)
Protostar Stack5: first "classic" buffer overflow with shellcode injection, offset calculation, EIP control, and use of NOP sled to stabilise addresses.
· Manuel López Pérez
tutorials · 3 min
Introduction to mining, part 2: stack 3-4 (Protostar)
Continuation of Protostar (Stack 3–4): overwriting function pointers and EIP using classic overflows with gets(), offsets, and little-endian.
· Manuel López Pérez
tutorials · 6 min
Introduction to Exploiting Part 1 - Stack 0-2 (Protostar)
Practical introduction to stack buffer overflow with Protostar's Stack 0–2 challenges: offsets, little-endian, and using arguments/environment variables to modify memory.
· Manuel López Pérez
writeups · 4 min
PwnLab: Init - WriteUp (Vulnhub)
PwnLab write-up: Init (Vulnhub): LFI with wrappers, file upload for RCE and escalation via SUID/PATH and injection in echo.
· Manuel López Pérez
hackthebox · 3 min
WriteUp – Bounty (HackTheBox)
Bounty write-up (HackTheBox). Easy Windows machine that exploits a vulnerability in IIS, allowing a malicious web.config to be uploaded to execute ASP code and obtain RCE. We then escalate privileges with Metasploit (MS10-092).
· Manuel López Pérez
cheatsheet · 6 min
Transferring files (Post-exploitation) - CheatSheet
Practical compilation of methods for transferring files during post-exploitation on Linux and Windows. Includes HTTP, Netcat, SCP, FTP, SMB, Certutil, PowerShell, and Powercat. Ideal for uploading tools or downloading data from the victim without Meterpreter or Empire.
· Pablo Plaza Martínez