Archive

These posts are from my old blog that I have migrated over to the new page.

Creating a Home Active Directory Lab

Good afternoon folks! I’ve recently been studying for my CRTP, but my lab access expired. Now, I could pay for more time in the labs, but the elegant misconfigurations demonstrated by Nikhil Mittal in the CRTP really fascinated me. How easy was it to end up with one of these settings that I’ve been working on breaking? Was it really that common and easy to end up with? So, I decided to create my own labs. This is just a starting point, and from here, you can add additional services, users and workstations. Active Directory is used by over 95% of businesses, so understanding how to build it, how the parts fit together and also how to attack it should be a tool within every pentesters repoirtoire. ...

Discovering Stored XSS in Wordpress Plugin YOP Polls v6.2.7 - CVE-2021-24454

Good afternoon security fanatics. Back again today with a brief walk-through of a stored XSS (Cross Site Scripting) that I recently discovered in another wordpress poll plugin. YOP Polls, active on over 20,000 sites, allows users to create interactive and aesthetic polls that are fully customizable and perfect for data collection. I started to play about, testing for different injection types and XSS payloads. To my surprise, the results page reflected the answer back to me as a heading when I stuck it in <h1>tags</h1>. I then opened a new browser without a session and voted to view the results page again. The heading was still there! Therefore, I concluded that I’d discovered some form of stored XSS. I checked if I could use <script> tags too, and sure enough, it worked. ...

WpDevArt Wordpress Polls Plugin < 1.5.2 - Blind SQL Injection

What’s up everyone! Today I’ll be quickly discussing my first CVE entry - CVE-2021-24442 - and my thought process when I decided to start looking for it. It’s been my goal for a while, not only for a little confidence boost among the consistent industry imposter syndrome, but primarily to ensure that I helped sites become more secure. Selecting Software When considering where I’d look for my first CVE, I had lots of things on my mind. It needed to be easy to spin up locally, had accessible source code for reviewing and have multiple features and parameters that could be tested. I decided to install a wordpress instance locally, just using the official Ubuntu setup guide [https://ubuntu.com/tutorials/install-and-configure-wordpress]. It only took about 5 minutes. ...