Identify and exploit Linux cron job misconfigurations to escalate privileges from a low-privilege user to root. Covers writable cron scripts, world-writable PATH entries, wildcard injection, and cron-based reverse shells in isolated lab environments.
Identify and exploit OS command injection vulnerabilities in web applications where user-supplied input is passed unsanitized to a shell command. Covers in-band, blind, and out-of-band command injection techniques against deliberately vulnerable targets in isolated lab environments.
Perform ARP spoofing and man-in-the-middle (MITM) attacks within isolated LAN environments using arpspoof and ettercap to intercept traffic between two hosts. Covers ARP cache poisoning, traffic forwarding, and credential sniffing in a controlled Docker lab network.
Enumerate DNS infrastructure by requesting full zone transfers (AXFR) from misconfigured authoritative DNS servers using dig, nslookup, and fierce. Covers zone transfer mechanics, subdomain harvesting, and identifying exposed internal hostnames in isolated lab environments.
Enumerate SMB shares, users, and sessions on Windows and Linux targets using smbclient and enum4linux within isolated lab environments. Covers null session attacks, share listing, file retrieval, and user enumeration against misconfigured Samba and Windows SMB services.
Analyze JSON Web Tokens (JWTs) for common security vulnerabilities including algorithm confusion attacks (RS256 to HS256), none algorithm bypass, weak secret brute-forcing, and claim manipulation. Practice in isolated lab environments to understand authentication bypass and privilege escalation via token forgery.
Analyze PCAP files and live network captures using Wireshark and tshark to extract credentials, reconstruct HTTP sessions, identify malicious traffic patterns, and detect protocol anomalies in isolated lab environments. Core network forensics and traffic analysis skill for security professionals.
Enumerate and exploit sudo misconfigurations on Linux systems to escalate privileges. Covers NOPASSWD entries, wildcard abuse, sudo -l enumeration, LD_PRELOAD injection, and GTFOBins lookup for allowed commands in isolated lab environments. Core skill for Linux privilege escalation phases.