withcrux
- 20 skills
- 0 followers
- 12 hours ago last updated
- ▌ Analyzing Network Packet Captures · withcrux bundleAnalyze PCAP files and live network captures using Wireshark and tshark to extract credentials, reconstruct HTTP sessions, identify malicious traffic patterns, and detect protocol anomalies in isolated lab environments. Core network forensics and traffic analysis skill for security professionals.
- ▌ Performing Smb Enumeration In Lab · withcrux bundleEnumerate SMB shares, users, and sessions on Windows and Linux targets using smbclient and enum4linux within isolated lab environments. Covers null session attacks, share listing, file retrieval, and user enumeration against misconfigured Samba and Windows SMB services.
- ▌ Analyzing Cron Job Privesc Vectors · withcrux bundleIdentify and exploit Linux cron job misconfigurations to escalate privileges from a low-privilege user to root. Covers writable cron scripts, world-writable PATH entries, wildcard injection, and cron-based reverse shells in isolated lab environments.
- ▌ Performing Dns Zone Transfer Attacks · withcrux bundleEnumerate DNS infrastructure by requesting full zone transfers (AXFR) from misconfigured authoritative DNS servers using dig, nslookup, and fierce. Covers zone transfer mechanics, subdomain harvesting, and identifying exposed internal hostnames in isolated lab environments.
- ▌ Performing Port Scanning In Safe Lab · withcrux bundlePerform TCP and UDP port scanning against isolated lab targets using Nmap to discover open services, identify running software versions, and enumerate the attack surface. Covers SYN scans, version detection, and OS fingerprinting techniques exclusively in controlled Docker lab environments.
- ▌ Performing Web Directory Enumeration · withcrux bundleDiscover hidden directories, files, and endpoints on web servers using wordlist-based fuzzing with tools like ffuf, gobuster, and dirb inside isolated lab environments. Covers recursive enumeration, extension fuzzing, virtual host discovery, and filtering strategies for reducing noise in results.
- ▌ Analyzing Web Application HTTP Headers · withcrux bundleAnalyze HTTP response headers for security misconfigurations including missing Content Security Policy, HSTS, X-Frame-Options, and information disclosure via Server/X-Powered-By headers. Covers manual inspection and automated scanning to identify header-based vulnerabilities and recommend remediations.
- ▌ Cracking Weak Hashes In Lab Environment · withcrux bundleIdentify and crack weak password hashes (MD5, SHA1, NTLM, bcrypt) using dictionary attacks, rainbow tables, and rule-based mutations with Hashcat and John the Ripper inside an isolated lab environment. Covers hash identification, wordlist selection, and password policy auditing for security assessments.
- ▌ Detecting SQL Injection Vulnerabilities · withcrux bundleDetect and confirm SQL injection vulnerabilities in web application input fields using manual payloads and automated scanning inside isolated lab environments. Covers error-based, boolean-based, and time-based blind SQLi detection techniques.
- ▌ Analyzing Sudo Rules For Privesc Vectors · withcrux bundleEnumerate and exploit sudo misconfigurations on Linux systems to escalate privileges. Covers NOPASSWD entries, wildcard abuse, sudo -l enumeration, LD_PRELOAD injection, and GTFOBins lookup for allowed commands in isolated lab environments. Core skill for Linux privilege escalation phases.
- ▌ Detecting Xss Vulnerabilities In Web Apps · withcrux bundleDetect reflected, stored, and DOM-based Cross-Site Scripting (XSS) vulnerabilities in web applications using manual payloads and browser-based analysis inside isolated lab environments. Covers OWASP A03 injection and sanitization bypass.
- ▌ Performing Osint Recon On Simulated Target · withcrux bundleConduct Open Source Intelligence (OSINT) reconnaissance on a simulated target organization using public information sources, DNS enumeration, certificate transparency logs, and Google dorks. All reconnaissance is performed against a fully simulated, consent-given lab target with no real personal data involved.
- ▌ Detecting Lfi Path Traversal Vulnerabilities · withcrux bundleDetect Local File Inclusion (LFI) and path traversal vulnerabilities in web applications that allow reading arbitrary files from the server. Covers manual payload testing, encoding bypasses, log poisoning for RCE, and PHP wrapper techniques in isolated Docker lab environments.
- ▌ Detecting Suid Misconfigurations For Privesc · withcrux bundleIdentify SUID (Set User ID) binary misconfigurations on Linux systems that allow unprivileged users to escalate to root. Covers manual enumeration, GTFOBins technique lookup, and exploitation in isolated lab environments. Essential skill for Linux privilege escalation during penetration testing engagements.
- ▌ Exploiting Command Injection Vulnerabilities · withcrux bundleIdentify and exploit OS command injection vulnerabilities in web applications where user-supplied input is passed unsanitized to a shell command. Covers in-band, blind, and out-of-band command injection techniques against deliberately vulnerable targets in isolated lab environments.
- ▌ Detecting Insecure Deserialization Vulnerabilities · withcrux bundleDetect insecure deserialization vulnerabilities in Java, Python (pickle), and PHP applications that allow remote code execution through crafted serialized objects. Covers gadget chain identification, ysoserial tool usage, and detection techniques in isolated lab environments. OWASP A08:2021.
- ▌ Analyzing JWT Token Security · withcrux bundleAnalyze JSON Web Tokens (JWTs) for common security vulnerabilities including algorithm confusion attacks (RS256 to HS256), none algorithm bypass, weak secret brute-forcing, and claim manipulation. Practice in isolated lab environments to understand authentication bypass and privilege escalation via token forgery.
- ▌ Detecting Ssrf Vulnerabilities · withcrux bundleDetect Server-Side Request Forgery (SSRF) vulnerabilities that allow attackers to make the server issue HTTP requests to internal or external resources. Covers basic SSRF detection, cloud metadata endpoint access, blind SSRF via out-of-band channels, and filter bypass techniques in safe lab environments.
- ▌ Performing Arp Spoofing In Lab · withcrux bundlePerform ARP spoofing and man-in-the-middle (MITM) attacks within isolated LAN environments using arpspoof and ettercap to intercept traffic between two hosts. Covers ARP cache poisoning, traffic forwarding, and credential sniffing in a controlled Docker lab network.
- ▌ Performing Password Spray In Lab · withcrux bundleExecute controlled password spray attacks against simulated authentication services in isolated lab environments to understand how attackers test large numbers of accounts with a small set of common passwords. Covers SSH, web login, and API endpoint spraying with rate-limit awareness and detection evasion understanding for defensive security purposes.