On March 15, 2021, we launched our fifteenth Test lab, codenamed Who is the n0v1ch0k?

On the 12th day, in non-stop mode, the BadBlackHat participant was the first to compromise all the nodes of the laboratory. For everyone else who tried, is trying and will try to pro-test Test lab 15, we decided to publish its walkthrough.

Test lab emulate an IT infrastructure of real companies and are created for a legal pen testing and improving penetration testing skills. Laboratories are always unique and contain the most recent and known vulnerabilities.

So, it’s time to disassemble all the tasks of…


On March 15, 2021, Pentestit launches Test lab 15, where IT specialists can test their skills in finding and exploiting vulnerabilities in the corporate network and web applications for free.

About Test lab

Test lab is a cyber training ground where participants gain experience in analyzing the security of information systems. Each such laboratory has an integral infrastructure, history and many hidden vulnerabilities that must be discovered, localized and exploited, and as a result — a full-fledged scenario for compromising the company’s network. An important feature of the Test lab is maximum realism. Participants acting as attackers, as they pass, gain access to…


A couple of weeks ago, the Vulners team posted a comparison of several popular WAFs. Catching myself thinking — “how to evaluate the quality of its work?”, I decided to analyze in more detail the topic of security tests and criteria for evaluating the Web Application Firewall. The article will be useful, first of all, for those who are interested in the topic of web security, as well as for the happy owners of WAF.

Criteria for evaluation

When comparing various solutions, we are used to focusing on performance indicators, performance stability, ease of setup, management, updating and scaling. …


Img source: https://portswigger.net/web-security/cross-site-scripting

XSS (Cross Site Scripting) — one of the most popular types of web vulnerabilities, which allows you to embed malicious code in the page given by a web application. Attacks using the XSS vector allow you to embed arbitrary content on the page, intercept cookies and sessions of other users, gain access to closed sections of the site and even administrator privileges of a web resource.

There are several types of XSS:

  • Stored. Malicious code is stored on the server and downloaded from it every time users request the display of a particular page. Most often they appear where user…


When developing or supporting web applications, at some point in time you have to deal with the need to use WAF (Web Application Firewall). If you have no experience working with such a class solution or you are tired of constant false positives, I will tell you how to simplify the task, as well as share tips and tricks. As a tool, we will use Nemesida WAF Free — the free version of Nemesida WAF.

Visualization, or let’s start from the end

You can monitor the work of Nemesida WAF Free through a browser, so after a short setup of the system, we will get access to…


Today, let’s look at the way how to test the security of a company’s wireless network relatively invisibly. The Raspberry Pi, which supports installing Kali Linux, will be used as the basis. Installing the distribution is quite simple:

  • Download the official image from the site kali.org;
  • Write it to an SD disk using Win32image for Windows and Gparted for Linux;
  • Launch the Raspberry Pi with the installed SD card.

After installation, you can optionally update packages if they are available. But you don’t need to do anything else to work properly. The required memory card size is 8Gb or higher…


Web application vulnerabilities appear when developers add unsafe code to a web application. It can happens both in the development stage, and in the stage of finalizing or fixing previously found vulnerabilities. Disadvantages are often classified according to their severity and prevalence. The OWASP Top 10 is considered to be the most popular and objective vulnerability classification. This rating is compiled by OWASP Project specialists and updated every 3–4 years. The current release is in 2017, and the next one is expected in 2020–2021.

Popular vulnerabilities

First of all, let’s look at typical vulnerabilities that affect many web applications.

Injections

As expected, “Injection”…


Securing web applications (websites, online stores, personal accounts) and APIs is not as easy as it might seem at first glance. There are several reasons for this:

  • web applications are available 24/7, and an attacker can launch an attack at any time;
  • web applications are a stack of different technologies, the interaction of which is sometimes difficult to implement;
  • web applications are often self-written and, unfortunately, this does not make them more secure;
  • web applications are initially developed to improve the company’s image and obtain economic benefits, and their security is not the first thing to think about;
  • thanks to…


In the previous article we talked about Nemesida WAF Free – a free web application firewall for protecting web sites and API against hacker attacks, and in this article we decided to review the popular web application vulnerability scanner – Wapiti.

Scanning a site for vulnerabilities is a necessary measure, which, together with an analysis of the source code, allows you to assess the level of its protection against threats of compromise. You can scan a web resource using specialized tools.

Nikto, W3af (written in Python 2.7, whose support has ended) or Arachni (no longer supported since Feb. 2020) are…


An external network perimeter is most often attacked, defining the task for technical specialists to make it as secure and inaccessible as possible. To do this, it is necessary to perform penetration testing, one of the stages of which is scanning the perimeter for vulnerabilities. If you can’t attract professional pentesters, at the basic level you can independently evaluate the security of network resources for free. As a distribution for security analysis, you can use Kali Linux with necessary tools.

Information provided for informational purposes only. Do not break the law!

Network Scanning

First, scan the IP address using Nmap (we assume…

Pentestit

From Information Security With Love

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store