Hackable - Secret Hacker | Vulnerable Web Application Server

Web List

• DVWA
• BodgeIt Store
• bWAPP
• Commix
• CryptOMG
• Mutillidae 2
• sqli-labs
• Magical
• WebGoat
• WordPress 5.0
• Git
• Phpmyadmin

Git Tools

• fsociety
• the hydra
• xbruteforcer
• WAScan
• wpscan
• sqlmap

Blog Post : https://secrethackersite.blogspot.com/2019/10/hackable-secret-hacker-vulnerable-web.html

Mordor-CTF

• Author: strider
• Testers: Kyubai
• Difficulty: Intermediate

Mordor CTF is a CTF-Machine with a nice story.

This VM has a small touch of lord of the rings. And tells a story during part 2 of the movies.

In this VM are 9 flags to get.

This I my first VM i've created, I hope you enjoy it.

The goal is to reach the root and readout the file /root/flag.txt

If you found other ways, to reach the goal, let me know :)

What include this VM?

• Information Gathering
• Enumerarion
• Cracking
• Webexploitation
• Reverse Engineering
• Binary Exploitation
• General Linux skills
• and more...

OS:

• Debian 10 Buster
• IPv4 / DHCP Autoassign

For any hints contact me here [strider007 at protonmail dot com]

If you found Bugs or you have problems with the VM, you can contact me also here [strider007 at protonmail dot com]

Disclaimer

This VM is completely licensed under Creative Commons v3. except the elements by LOTR.

I do not own the characters and the elements of LOTR. They was used for the fanfiction story during the CTF. I do not earn money with this machine and all the other elements of this machine.

If you use parts of this machine please ensure that you remove all LOTR elements.

Good Enumeration Skills

Difficulty: Easy to Intermediate

Flag: 2 Flag first user And the second root

Learning: Web Application | Enumeration | Privilege Escalation

Web-site: www.hacknos.com

Contact-us

Twitter: @rahul_gehlaut

Tempus Fugit is a Latin phrase that roughly translated as “time flies”.

This is an hard, real life box, created by @4nqr34z and @theart42.

As in the former Tempus Fugits, #4 the idea is still to create something “out of the ordinary”.

Need any hints? Feel free to contact us on Twitter: @4nqr34z or @theart42

DHCP-Client.

Tested and works both on Virtualbox and vmware

Story:

After being hacked multiple times, the company decides to do things differently this time. They left Linux and choose another operating system that claimed to be more secure. Realising they could have resources inside the company that are willing to help the relative small IT department (originally only web-designers) and the fact (according to Hugh Janus) there are safety in numbers, they start a internal crowdsourcing project. Allowing internal employees to request access to the new server.

This machine is designed by keeping in mind about all the beginners who wants to start their journey in CTF challenges.

This machine doesn't require any prior knowledge about different web vulnerabilities.

Privilege escalation is the Key!

This machine has 3 flags. Each flag is present in home directory.

You must know some basic linux commands to pawn this machine.

Technical Information

• Machine is based on Ubuntu 64bit
• Tested on virtualBox
• DHCP is enabled (set as bridged networking)

Installation

Unzip it and then import it into virtualBox

Contact

If you have solved this machine in an unintended way then please let us know,you may get a chance to publish your writeup on our website. website link : https://www.haclabs.org

This a beginner level machine , getting a shell is a little bit harder, just think out of the box to get the shell.privilege escalation is easy once you get the shell.

This machine has 3 flags. Each flag is present in the Home directory of particular user. Be ready to test your Linux skills.

Technical Information

• machine is based on Ubuntu 64bit
• Tested on virtualBox
• DHCP is enabled (set as bridged networking)

Installation

unzip it and then import it into virtualBox

Difficulty

Beginner/intermediate

Contact

If you have solved this machine in an unintended way then please let us know,you may get a chance to publish your writeup on our website. website link : https://www.haclabs.org

I have created this amazing CTF for pentester. However, This is not like other CTF which has been using common exploits and tools. Instead, you will learn about Real-world website testing methodology, advance injections and more.

This machine is the next part of Deception machine. This time try harder to get root!

To complete this challenge you need to find 3 flags.

flag 2 : Password to unzip the zip file.

flag 1 : Present in /home/yash/

flag 0 : Present in /root/

This is a beginner/intermediate level machine.

Technical Information :

• machine is based on Ubuntu 64bit
• Tested on virtualBox
• DHCP is enabled (set as bridged networking)

NOTE : you may face connection lost issue , no problem restart the virtual machine and everything will start to work again!

I found "646563657074696f6e312e31" this while creating the machine .

Contact

If you have solved this machine in an unintended way then please let us know, you may get a chance to publish your writeup on our website.

This VM is given as challenge 1 in InfoSecWarrior CTF 2020. Official website : https://www.infosecwarrior.com/

Box Designed by: MAALP & CyberKnight00

Difficulty: Easy

Feel free to contact MAALP for any Hints

Twitter handle of MAALP is @AFREET1225

This VM is given as challenge 2 in InfoSecWarrior CTF 2020.

Official website : https://www.infosecwarrior.com/

Enumerate Enumerate and Enumerate is the motto to solve this box.

Multiple way to get user flag and Multiple ways to get root flag.

Ping me on Twitter @CyberKnight00 if you face any error.

This VM is given as challenge 3 in InfoSecWarrior CTF 2020.

Official website : https://www.infosecwarrior.com/

This box is dedicated to my mentors (you will find there names in the box itself)

If you face any error or needed help ping me on Twitter CyberKnight00

Or ping them after finding their names.

During the CTF event, this box contains a Loot box (zip file) consist of download link of the next Challenge and super_flag.txt.

Goal : You have to gain highest privileges and collect only 2 flags (user flag and root flag). loot box is not available in this VM.

The WordPress developer configured the machine to work internally. But due to some miss-configuration wordpress is exposed to outside world. Use your skills and get the root flag.

BTW someone already hacked the box and placed his backdoor find it. It will help you.

Welcome to "Wordpress Host Server"

This VM consists of a "Wordpress Website" which is specially made for learning and sharpening Wordpress Enumeration and Exploitation skills. The Website contains 40+ vulnerabilities which can compromise the security of the website.

Goal: Try to find out as much as vulnerabilities you can exploit. This time our goal is not to get the root but to practice more.

Difficulty: Intermediate Level

Need hints? Twitter @akankshavermasv

DHCP is enabled

Note : If you are unable to browse the web page properly then add the hostname of web in /etc/hosts file.

Your feedback is really valuable for me! Twitter @akankshavermasv

Was there something that you didn’t like about this VM?

Please let me know so that I can make more interesting challenges in the future.

Good Luck..!!!