Aleyna
Lab link. There is a weakness in the system related to 2FA authentication. To understand the structure of the vulnerability, we enter the system with the credentials given to us. If the MFA code is sent incorrectly twice, the system redirects us back to the login page. This makes our brute-force attack fail. For this …
Lab link. On the 2FA login pages, we send the MFA code, which is our last request. We leave only the verify component in the cookie value and make it carlos instead of wiener. When we send the request, we get the information that the MFA code is incorrect, which indicates that the system is …
Lab link. When we send the request, we see that it goes in JSON format and if we make a certain number of mistakes, we are blocked from IP. By sending more than one password in the JSON structure, we can achieve a successful login. We bring our passwords to JSON structure with Sublime text …
Lab link. Certain suspicious accounts can be locked by the system. In this lab, our goal is to find the username first and then the password. We don’t get any time block when we make a few wrong attempts. We move our request to the intruder. To get an account lockout error, we need to …
Lab link. We need to find the password for the user carlos. We know there is a logic flaw, so let’s make a few false entries and try to understand the system. After 3 login attempts, the system displays “You have made too many incorrect login attempts. Please try again in 1 minute(s).” error. We …
Lab link. Lab gave us the information “This lab is vulnerable to username enumeration using its response times.” At first, we log in with the wiener:peter credentials given to us on the login page We have successfully logged in and now we will log out and try to log in again, but this time with …
The Room: “Learn techniques for securing and protecting network devices from potential threats and attacks.” https://tryhackme.com/room/networkdevicehardening Task 2: Common Threat and Attack Vectors 2.1. The device that is used to control and manage network resource is called? Network device 2.2. A threat vector that includes disruption of critical devices and services to make them unavailable …
This blog post is the Tryhackme Active Directory Hardening room write-up. Solutions are explained in detail and with screenshots.
This blog post is the Tryhackme Vulnerability Management room writeup. Solutions are explained in detail and with screenshots.
This blog post is the Tryhackme Threat Modelling room writeup. Solutions are explained in detail and with screenshots.