Base de Datos de Máquinas
Explora, filtra y encuentra máquinas para practicar técnicas específicas de hacking.
Mostrando 305 máquinas
HackTheBoxInsane
APT
10.10.10.213
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
RPC EnumerationAbusing RPC - IOXIDResolver.py (Obtaining the IPV6 machine address)Port scanning with nmap via ipv6
HackTheBoxFácil
Active
10.10.10.100
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMB EnumerationAbusing GPP PasswordsDecrypting GPP Passwords - gpp-decrypt
HackTheBoxDifícil
Acute
10.10.11.145
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Virtual HostingInformation LeakageAbusing Windows PowerShell Web Access
HackTheBoxMedia
Administrator
10.10.11.42
OSCP OSEP eCPPTv3 eCPTXv3 Active Directory
Técnicas destacadas:
SMB Enumeration (Netexec, Smbmap)Listing Existing Users at Domain Level (rpcclient)LDAP Enumeration (ldapdomaindump)
HackTheBoxFácil
Admirer
10.10.10.187
eWPT OSWE OSCP
Técnicas destacadas:
Information LeakageAdmirer Exploitation (Abusing LOAD DATA LOCAL Query)Abusing Sudoers Privilege [Library Hijacking - Python] (Privilege Escalation)
HackTheBoxDifícil
AdmirerToo
10.10.11.137
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Subdomain EnumerationAdminer EnumerationSSRF (Server Side Request Forgery) in Adminer [CVE-2021-21311]
HackTheBoxFácil
Alert
10.10.11.44
eJPT eWPT
Técnicas destacadas:
XSS - Injection Via MarkdownDiscovering LFI accessible from XSSCracking Hashes
HackTheBoxDifícil
Altered
10.10.11.159
OSCP eWPT eWPTXv2 OSWE
Técnicas destacadas:
Brute Force Pin / Rate-Limit Bypass [Headers]Type Juggling BypassingSQL Injection (Error Based)
HackTheBoxMedia
Ambassador
10.10.11.183
eWPT OSCP
Técnicas destacadas:
Web EnumerationGrafana v8.2.0 Exploitation [CVE-2021-43798] (Unauthorized Arbitrary File Read Vulnerability)Enumerating a sqlite3 file [Extracting mysql login credentials]
HackTheBoxDifícil
Analysis
10.10.11.250
OSCP OSEP eCPPTv3 eWPT eWPTXv2 OSWE Active Directory
Técnicas destacadas:
SMB EnumerationVirtual HostingSubdomain Enumeration
HackTheBoxFácil
Analytics
10.10.11.233
eWPT
Técnicas destacadas:
Subdomain EnumerationMetabase Exploitation (CVE-2023-38646)Docker Container Information Leakage
HackTheBoxFácil
Antique
10.10.11.107
eJPT
Técnicas destacadas:
SNMP EnumerationNetwork Printer AbuseCUPS Administration Exploitation (ErrorLog)
HackTheBoxInsane
Anubis
10.10.11.102
OSCP (Escalada) OSEP (Escalada) eWPT eWPTXv2 OSWE eCPTXv2 Active Directory
Técnicas destacadas:
SSL Certificate Inspection - OpenSSLXSS (Cross-Site Scripting)ASP SSTI (Server Side Template Injection) (HackingDream ASP Resource) [RCE]
HackTheBoxMedia
Apocalyst
10.10.10.46
eJPT eWPT OSCP (Escalada)
Técnicas destacadas:
Wordpress EnumerationImage Stego Challenge - SteghideInformation Leakage - User Enumeration
HackTheBoxMedia
Aragog
10.10.10.78
eWPT OSWE (Intrusión)
Técnicas destacadas:
XXE (XML External Entity Injection) ExploitationModifying a wordpress login to steal credentials (Privilege Escalation)
HackTheBoxFácil
Arctic
10.10.10.11
OSCP eWPT
Técnicas destacadas:
Adobe ColdFusion 8 ExploitationDirectory Traversal VulnerabilityCracking Hashes
HackTheBoxInsane
Ariekei
10.10.10.65
eCPPTv3 eCPTXv2 eWPT OSWE
Técnicas destacadas:
ImageTragick Exploitation (Specially designed '.mvg' file)ShellShock Attack (WAF Bypassing)Abusing Docker privilege
HackTheBoxMedia
Atom
10.10.10.237
OSCP
Técnicas destacadas:
SMB EnumerationEXE Binary AnalysisAbusing electron-updater - Signature Validation Bypass [RCE]
HackTheBoxMedia
Awkward
10.10.11.85
OSWE eWPT eWPTXv2
Técnicas destacadas:
Web EnumerationWebpack Application EnumerationAPI Endpoints - Information Leakage
HackTheBoxDifícil
Axlle
10.10.11.3
OSCP OSEP eCPPTv3 eCPTXv3 Active Directory
Técnicas destacadas:
SMB EnumerationCreating malicious XLL File (Achieving Command Execution without Using Macros)DLL Execution via Excel.Application RegisterXLL() Method
HackTheBoxMedia
BabyTwo
10.129.194.134
OSCP OSEP eCPPTv3 eCPTXv3 Active Directory
Técnicas destacadas:
SMB EnumerationNetExec spider_plus ModuleUser Enumeration (NetExec RID Cycling Brute Force Attack)
HackTheBoxFácil
Backdoor
10.10.11.125
OSCP eWPT OSWE eWPTXv2
Técnicas destacadas:
WordPress Local File Inclusion Vulnerability (LFI)LFI to RCE (Abusing /proc/PID/cmdline)Gdbserver RCE Vulnerability
HackTheBoxMedia
Backend
10.10.11.161
eWPT OSWE OSCP
Técnicas destacadas:
API EnumerationAbusing API - Registering a new userAbusing API - Logging in as the created user
HackTheBoxMedia
BackendTwo
10.10.11.162
eWPT eWPTXv2 OSWE
Técnicas destacadas:
API EnumerationAbusing API - Registering a userAccessing the Docs path of FastAPI
HackTheBoxFácil
Bank
10.10.10.29
eWPT
Técnicas destacadas:
Domain Zone Transfer Attack - AXFR (dig)Information LeakageAbusing File Upload [RCE]
HackTheBoxInsane
Bankrobber
10.10.10.154
eWPT eWPTXv2 OSWE OSCP (Intrusión)
Técnicas destacadas:
Blind XSS InjectionStealing the session cookie by XSS injectionSQLI - Error Based
HackTheBoxMedia
Bart
10.10.10.81
OSCP eWPT eWPTXv2 OSWE
Técnicas destacadas:
Subdomain Enumeration - GobusterInformation LeakageUsername enumeration - Abusing the Forget Password Option
HackTheBoxFácil
Bashed
10.10.10.68
eJPT
Técnicas destacadas:
Web EnumerationAbusing WebShell Utility (RCE)Abusing Sudoers Privilege (User Pivoting)
HackTheBoxMedia
Bastard
10.10.10.9
OSCP eWPT
Técnicas destacadas:
Drupal EnumerationDrupal 7.X Module Services - Remote Code Execution [SQL Injection]Drupal Admin Cookie Hijacking
HackTheBoxFácil
Beep
10.10.10.7
eWPT
Técnicas destacadas:
Elastix 2.2.0 Exploitation - Local File Inclusion (LFI)Information LeakageVtiger CRM Exploitation - Abusing File Upload (1st way) [RCE]
HackTheBoxFácil
Bizness
10.10.11.252
eWPT
Técnicas destacadas:
Apache OFBiz Exploitation (Authentication Bypass)Analysis of OFBiz code to understand the hashed storage mechanismAdapting found hashes to a crackable format
HackTheBoxDifícil
Blackfield
10.10.10.192
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMB EnumerationKerberos User Enumeration (Kerbrute)ASRepRoast Attack (GetNPUsers)
HackTheBoxDifícil
Blazorized
10.10.11.22
OSCP OSEP eCPPTv3 eCPTXv3 Active Directory
Técnicas destacadas:
Subdomain EnumerationBlazor Traffic Processor - BurpSuite ExtensionDLL Inspection - AvalonialLSpy
HackTheBoxFácil
Blocky
10.10.10.37
eJPT
Técnicas destacadas:
WordPress EnumerationInformation LeakageAnalyzing a jar file - JD-Gui + SSH Access
HackTheBoxFácil
Blue
10.10.10.40
OSCP
Técnicas destacadas:
SMB EnumerationEternalblue Exploitation (MS17-010) [Triple Z Exploit]Obtaining credentials stored in memory [MIMIKATZ + Windows Defender Evasion] (EXTRA)
HackTheBoxFácil
Blunder
10.10.10.191
eWPT OSWE eWPTXv2
Técnicas destacadas:
Bludit CMS ExploitationBypassing IP Blocking (X-Forwarded-For Header)Directory Traversal Image File Upload (Playing with .htaccess)
HackTheBoxMedia
Blurry
10.10.11.19
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Rocket.Chat EnumerationSubdomain Enumeration - CAIDOClearML Enumeration
HackTheBoxFácil
BoardLight
10.10.11.11
eWPT eJPT
Técnicas destacadas:
Subdomain EnumerationDolibarr 17.0.0 Exploitation - CVE-2023-30253Information Leakage (User Pivoting)
HackTheBoxMedia
Bolt
10.10.11.114
eJPT eWPT eWPTXv2 OSWE
Técnicas destacadas:
Information LeakageSubdomain EnumerationSSTI (Server Side Template Injection)
HackTheBoxMedia
Book
10.10.10.176
eWPT OSWE OSCP
Técnicas destacadas:
SQL Truncation AttackLocal File Read via XSS in Dynamically Generated PDF - HackTricksAbusing Cron Job - Logrotate Exploit (Logrotten) [Privilege Escalation]
HackTheBoxInsane
Bookworm
10.10.11.215
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
XSS Injection + CSP BypassAbusing File Upload + Indirect XSS InjectionIDOR Exploitation
HackTheBoxFácil
Bounty
10.10.10.93
eWPT OSWE OSCP
Técnicas destacadas:
IIS EnumerationCreating our own extension fuzzer in Python [Python Scripting] [EXTRA]IIS Exploitation - Executing code via web.config file upload
HackTheBoxFácil
BountyHunter
10.10.11.100
eWPT OSWE OSCP
Técnicas destacadas:
XXE (XML External Entity Injection) ExploitationXXE PHP File Read - Base64 WrapperAbusing Sudoers Privilege [Privilege Escalation]
HackTheBoxInsane
Brainfuck
10.10.10.17
eWPT OSCP (Escalada)
Técnicas destacadas:
TLS Certificate InspectionWordPress EnumerationWordPress WP Support Plus Responsive Ticket System Exploitation - Gaining access as admin user
HackTheBoxDifícil
Breadcrumbs
10.10.10.228
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Local File Inclusion (LFI) [Abusing file_get_contents]Abusing No RedirectForge PHPSESSID and getting valid Cookies
HackTheBoxMedia
BroScience
10.10.11.195
eWPT eWPTXv2 OSWE
Técnicas destacadas:
(LFI) Local File Inclusion Vulnerability + Filter Bypass RestrictionSource Code Analysis (PHP)Manually Generating Invitation Codes Based on Server Time During Registration
HackTheBoxFácil
Broker
10.10.11.243
eWPT
Técnicas destacadas:
Credential guessingActiveMQ Exploitation - Deserialization Attack (CVE-2023-46604) [RCE]Abusing sudoers privilege (nginx) [Privilege Escalation]
HackTheBoxFácil
Buff
10.10.10.198
OSCP eCPPTv3 Buffer Overflow
Técnicas destacadas:
Gym Management System Exploitation (RCE)CloudMe Exploitation [Buffer Overflow] [OSCP Like] (Manual procedure) [Python Scripting]
HackTheBoxMedia
Builder
10.10.11.10
eWPT
Técnicas destacadas:
Jenkins Exploitation - CVE-2024-23897 in order to read arbitrary files (RCE)Cracking HashesAbusing the Jenkins cipher to crack the password [Privilege Escalation]
HackTheBoxInsane
CTF
10.10.10.122
eWPT eWPTXv2 OSWE
Técnicas destacadas:
LDAP InjectionLDAP Injection - Discovering valid usernamesLDAP Injection - Attribute Brute Force [Discovering valid LDAP fields]
HackTheBoxMedia
Cache
10.10.10.188
eWPT OSWE OSCP (Escalada)
Técnicas destacadas:
Information Leakage (Code Inspection)Abusing OpenEMRBroken Access Control
HackTheBoxFácil
Cap
10.10.10.245
eJPT
Técnicas destacadas:
Insecure Directory Object Reference (IDOR)Information LeakageAbusing Capabilities (Python3.8) [Privilege Escalation]
HackTheBoxDifícil
Carpediem
10.10.11.167
eWPT eWPTXv2 OSWE eCPPTv3 eCPTXv2 OSCP
Técnicas destacadas:
Web EnumerationParameter Fuzzing with WfuzzMass Assignment Attack - Giving admin privileges to our user
HackTheBoxMedia
Cascade
10.10.10.182
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
RPC EnumerationUser Enumeration via Kerberos - KerbruteASREPRoast Attack - GetNPUsers.py (Failed)
HackTheBoxMedia
Cat
10.10.11.42
eWPT eWPTX OSWE
Técnicas destacadas:
Web EnumerationInformation Disclosure (.git) - GitHackPHP Code Analysis
HackTheBoxMedia
Catch
10.10.11.150
eWPT eWPTXv2 OSWE Mobile
Técnicas destacadas:
APK Analysis (apktool, d2j-dex2jar)JD-GUI - Code InspectionInformation Leakage - Visible Token values
HackTheBoxMedia
Celestial
10.10.10.85
OSWE eWPT eWPTXv2 OSCP
Técnicas destacadas:
NodeJS Deserialization Attack [RCE]IIFE Serialization/Deserialization Attack - ExplainedNode Reverse Shell
HackTheBoxMedia
Certified
10.10.11.41
OSCP OSEP eCPPTv3 eCPTXv3 Active Directory
Técnicas destacadas:
SMB EnumerationBloodhound EnumerationAbusing WriteOwner Rights
HackTheBoxMedia
Chaos
10.10.10.120
eWPT eJPT
Técnicas destacadas:
Password GuessingAbusing e-mail service (claws-mail)Crypto Challenge (Decrypt Secret Message - AES Encrypted)
HackTheBoxDifícil
Charon
10.10.10.31
eWPT OSWE OSCP
Técnicas destacadas:
SQLI (SQL Injection) - Union InjectionSQLI - WAF BypassCracking Hashes
HackTheBoxMedia
Chatterbox
10.10.10.74
OSCP Buffer Overflow
Técnicas destacadas:
Achat 0.150 beta7 - Buffer Overflow (Windows 7 32 bits)Generating a Shellcode based on our needs + TIPSIcacls Abuse (Privilege Escalation)
HackTheBoxFácil
Chemistry
10.10.11.38
eWPT eJPT
Técnicas destacadas:
Malicious CIF File (RCE)SQLite Database File EnumerationCracking Hashes
HackTheBoxFácil
Cicada
10.10.11.26
OSCP Active Directory
Técnicas destacadas:
SMB EnumerationInformation LeakageRID Brute with Netexec for Potential User Discovery
HackTheBoxMedia
Clicker
10.10.11.232
eWPT OSWE OSED
Técnicas destacadas:
Abusing a game via the browser consoleAbusing NFS + Information LeakageCode Analysis
HackTheBoxFácil
Code
10.10.11.62
eWPT eJPT
Técnicas destacadas:
Web EnumerationPython Reverse Shell Restriction BypassDatabase SQLite File Enumeration
HackTheBoxFácil
Codify
10.10.11.239
eWPT
Técnicas destacadas:
Abusing vm2 NodeJS Package (RCE) [CVE-2023-30547]SQLite Database File EnumerationCracking Hashes
HackTheBoxMedia
Compiled
10.10.11.26
OSCP
Técnicas destacadas:
Gitea EnumerationInformation LeakageGit Exploitation [CVE-2024-32002] (RCE)
HackTheBoxDifícil
Conceal
10.10.10.116
OSCP eWPT
Técnicas destacadas:
UDP ScanSNMP EnumerationEnumerating Ike Hosts - ike-scan
HackTheBoxDifícil
Control
10.10.10.167
OSCP OSWE eWPT
Técnicas destacadas:
SQL Injection [SQLI] - Error BasedAdvanced Bash Scripting (EXTRA)SQLI to RCE (Into Outfile - PHP File Creation)
HackTheBoxFácil
CozyHosting
10.10.11.230
eWPT eJPT
Técnicas destacadas:
Spring Boote Web Page EnumerationInformation LeakageCookie Hijacking
HackTheBoxFácil
Crafty
10.10.11.249
eJPT OSCP
Técnicas destacadas:
Minecraft Exploitation - Log4Shell (RCE)JAR Plugin Analysis with JD-GUI + Information LeakageUsing RunasCs to execute commands as administrator [Privilege Escalation]
HackTheBoxDifícil
CrimeStoppers
10.10.10.80
eWPT OSWE
Técnicas destacadas:
Local File Inclusion (LFI)LFI - Base64 Wrapper [Reading PHP files]LFI to RCE - ZIP Wrapper
HackTheBoxMedia
Cronos
10.10.10.13
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Domain Zone Transfer (AXFR)SQLI (Blind Time Based) - Creating a custom Python scriptCommand Injection
HackTheBoxInsane
Crossfit
10.10.10.208
eWPTXv2 OSWE
Técnicas destacadas:
FTP SSL Certificate EnumerationXSS InjectionSubdomain Enumeration through the Origin Header [Access-Control-Allow-Origin]
HackTheBoxFácil
Curling
10.10.10.150
eWPT
Técnicas destacadas:
Information Leakage wtf xdJoomla EnumerationJoomla Exploitation [Abusing Templates] [RCE]
HackTheBoxDifícil
Dab
10.10.10.86
eWPT OSWE OSCP
Técnicas destacadas:
Applying brute force to an authentication panel - Wfuzz (Discovering valid password)Applying cookie discovery with Wfuzz (Brute Force)SSRF - Server Side Request Forgery (Internal Port Discovery) - Wfuzz
HackTheBoxFácil
Delivery
10.10.10.222
eJPT eWPT
Técnicas destacadas:
Virtual Hosting EnumerationAbusing Support Ticket SystemAccess to MatterMost
HackTheBoxMedia
DevOops
10.10.10.91
eWPT OSWE
Técnicas destacadas:
XXE (XML External Entity Injection) ExploitationReading internal files through XXE - Private SSH KeyAbusing a Github project - Information Leakage in Project Commits [Privilege Escalation]
HackTheBoxFácil
Devel
10.10.10.5
OSCP eJPT
Técnicas destacadas:
Abusing FTP + IIS ServicesCreating an AutoPwn Script [Python Scripting]Microsoft Windows (x86) – ‘afd.sys’ (MS11-046) [Privilege Escalation]
HackTheBoxFácil
Devvortex
10.10.11.242
eWPT
Técnicas destacadas:
Subdomain EnumerationAbusing JoomlaJoomla Exploitation (CVE-2023-23752)
HackTheBoxMedia
Devzat
10.10.11.118
eWPT eJPT
Técnicas destacadas:
Fuzzing Directory .git (GIT Project Recomposition)Web Injection (RCE)Abusing InfluxDB (CVE-2019-20933)
HackTheBoxFácil
Doctor
10.10.10.209
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Server Side Template Injection (SSTI)Exploiting the SSTI by calling Popen without guessing the offset (1st way) [RCE]Command Injection (2nd way) [RCE]
HackTheBoxFácil
Dog
10.10.11.42
eWPT
Técnicas destacadas:
Information Disclosure (.git) - GitHackInformation Leakage (Hardcoded passwords in code)Creating a new malicious module for Backdrop (RCE)
HackTheBoxDifícil
Drive
10.10.11.235
eWPT OSWE OSED
Técnicas destacadas:
IDOR Exploitation + OOP Python ScriptingInformation LeakageSqlite3 file enumeration
HackTheBoxFácil
Driver
10.10.11.106
OSCP (Escalada) eJPT
Técnicas destacadas:
Password GuessingSCF Malicious FilePrint Spooler Local Privilege Escalation (PrintNightmare) [CVE-2021-1675]
HackTheBoxDifícil
EarlyAccess
10.10.11.110
eCPPTv3 eCPTXv2 OSCP eWPT eWPTXv2 OSWE
Técnicas destacadas:
XSS InjectionXSS Cookie StealingCookie Hijacking
HackTheBoxFácil
Editorial
10.10.11.20
eWPT eJPT
Técnicas destacadas:
Virtual HostingAbusing File UploadServer Side Request Forgery (SSRF) Exploitation + Internal Port Discovery
HackTheBoxDifícil
Ellingson
10.10.10.139
Buffer Overflow eWPT (Intrusión)
Técnicas destacadas:
Abusing Werkzeug Debugger (RCE)Binary ExploitationAdvanced Buffer Overflow x64 - ROP / ASLR Bypass (Leaking Libc Address + Ret2libc + Setuid)
HackTheBoxMedia
Encoding
10.10.11.198
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Web EnumerationAPI EnumerationSubdomain Brute Force (gobuster)
HackTheBoxMedia
Enterprise
10.10.10.61
eWPT eCPPTv3 eCPTXv2 Buffer Overflow
Técnicas destacadas:
WordPress Lcars Plugin SQLI VulnerabilitySQL Injection (boolean-based blind, error-based, time-based blind)WordPress Exploitation [www-data] (Theme Edition - 404.php Template)
HackTheBoxMedia
Epsilon
10.10.11.134
eWPT eWPTXv2 OSCP OSWE
Técnicas destacadas:
Git Source Leak Exploit (GitHack)AWS EnumerationLambda Function Enumeration
HackTheBoxMedia
Europa
10.10.10.22
OSCP eWPT eWPTXv2 OSWE
Técnicas destacadas:
SSL Certificate InspectionLogin Bypass - SQLISQLI (Blind Time Based) [Python Scripting]
HackTheBoxMedia
Faculty
10.10.11.169
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Web EnumerationSQL Injection (SQLI) - Manual Blind Time Based [Python Scripting]Information Leakage - Error Messages
HackTheBoxDifícil
Falafel
10.10.10.73
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Information LeakageSQL Injection (SQLI) - Abusing substring functionObaining user passwords [Python Scripting]
HackTheBoxDifícil
Feline
10.10.10.205
eWPT eWPTXv2 eCPPTv3 eCPPTXv2 OSWE
Técnicas destacadas:
Information leakage in error messageRCE by deserialization in Apache Tomcat with PersistentManager - CVE-2020-9484 [RCE]Playing with Ysoserial - CommonsCollections2
HackTheBoxInsane
Fighter
10.10.10.72
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Advanced SQL Injection [SQLI] - MS SQL Server 2014 [Bypass Protection] [Python Scripting] [RCE]Abusing Cron JobsCapcom Rootkit Privilege Escalation
HackTheBoxDifícil
Flujab
10.10.10.124
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
SSL Cert EnumerationCookies Manipulation - Gaining access to restricted areas of the siteAbusing Mailer Configuration
HackTheBoxMedia
Flustered
10.10.11.131
OSCP eJPT eWPT eWPTXv2 eCPPTv3 OSWE
Técnicas destacadas:
Abusing Squid ProxyAbusing GlusterFSInformation Leakage
HackTheBoxMedia
FluxCapacitor
10.10.10.69
eWPT OSWE
Técnicas destacadas:
Fuzzing Parameters - WfuzzWAF BypassingCommand Injection
HackTheBoxFácil
Forest
10.10.10.161
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
AXFR - Domain Zone Transfer Attack (Failed)RPC Enumeration - Getting valid domain usersPerforming an AS-RepRoast attack with the obtained users
HackTheBoxMedia
Forge
10.10.11.111
eWPT OSWE OSCP
Técnicas destacadas:
Bypassing URL BlacklistServer Side Request Forgery (SSRF)Abusing Sudoers Privilege (Abusing Python Script)
HackTheBoxMedia
Format
10.10.11.213
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Subdomain EnumerationGitea EnumerationPHP Code Analysis
HackTheBoxInsane
Fortune
10.10.10.127
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Command InjectionOpenSSL - Creating a new keyOpenSSL - Creating a CSR file (Certificate Signing Request)
HackTheBoxDifícil
Freelancer
10.10.11.5
OSCP OSEP eCPPTv3 eCPTXv3 eWPT eWPTXv2 OSWE Active Directory
Técnicas destacadas:
SMB EnumerationWeb EnumerationKerberos User Enumeration (kerbrute)
HackTheBoxFácil
Frolic
10.10.10.111
eWPT Buffer Overflow
Técnicas destacadas:
Web EnumerationInformation LeakagePlaying with esoteric languages - Ook! and Brainfuck
HackTheBoxInsane
Fulcrum
10.10.10.62
eWPT eWPTXv2 eCPPTv3 eCPTXv2 OSWE OSCP OSEP Active Directory
Técnicas destacadas:
API Enumeration - Endpoint Brute ForceAdvanced XXE Exploitation (XML External Entity Injection)XXE - Custom Entities
HackTheBoxMedia
Fuse
10.10.11.26
OSCP Active Directory
Técnicas destacadas:
Information LeakageCreating a Custom Dictionary with CewlBrute Force with Netexec to SMB to Obtain Valid Credentials
HackTheBoxMedia
Giddy
10.10.10.104
eWPT OSCP OSWE
Técnicas destacadas:
SQL Injection (XP_DIRTREE) [SQLI] - Get Net-NTLMv2 HashWindows Defender Evasion (Ebowla)Windows Defender Evasion (Building our own C program)
HackTheBoxFácil
GoodGames
10.10.11.130
eJPT eWPT eCPPTv3 OSCP (Escalada)
Técnicas destacadas:
SQLI (Error Based)Hash Cracking Weak AlgorithmsPassword Reuse
HackTheBoxFácil
Grandpa
10.10.10.14
OSCP eWPT eJPT
Técnicas destacadas:
Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow [RCE]Token Kidnapping - Churrasco [Privilege Escalation]
HackTheBoxFácil
Granny
10.10.10.15
OSCP eWPT eJPT
Técnicas destacadas:
Abusing PUT & MOVE Methods - Uploading Aspx WebShellMicrosoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow [RCE]Token Kidnapping - Churrasco [Privilege Escalation]
HackTheBoxFácil
GreenHorn
10.10.11.25
eWPT
Técnicas destacadas:
Pluck EnumerationGitea EnumerationCode Analysis + Information Leakage
HackTheBoxInsane
Hackback
10.10.10.128
eWPT eWPTXv2 OSWE OSCP (Escalada) eCPTXv2
Técnicas destacadas:
Subdomain EnumerationInformation LeakagePassword Fuzzing
HackTheBoxMedia
Haircut
10.10.10.24
OSCP eWPT
Técnicas destacadas:
SSRF Attack (Server Side Request Forgery)Abusing a Curl implementation - Upload malicious PHP fileCommand Injection - Alternative Exploitation
HackTheBoxDifícil
Hancliffe
10.10.11.115
Buffer Overflow OSED OSCP (Intrusión) eWPT eWPTXv2 OSWE
Técnicas destacadas:
Abusing URI NormalizationServer Side Template Injection (SSTI) [NUXEO Vulnerability]Unified Remote 3 Exploitation (RCE)
HackTheBoxMedia
Hawk
10.10.10.102
eJPT eWPT
Técnicas destacadas:
OpenSSL Cipher Brute Force and DecryptionDrupal Enumeration/ExploitationH2 Database Exploitation
HackTheBoxFácil
Haystack
10.10.10.115
eWPT OSCP (Escalada) OSWE
Técnicas destacadas:
ElasticSearch EnumerationInformation LeakageKibana Enumeration
HackTheBoxFácil
Headless
10.10.11.8
eWPT OSWE OSCP
Técnicas destacadas:
XSS injection via custom headerStealing administrator user session cookie via XSSCommand injection in web panel
HackTheBoxMedia
Health
10.10.11.176
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Web EnumerationAbusing WebHook SetupCreating a PHP file to apply a Redirect and point to internal machine services [Restriction Bypassing]
HackTheBoxFácil
Heist
10.10.10.149
OSCP
Técnicas destacadas:
Information LeakageCisco Password Cracker (password7)SMB Enumeration - CrackMapExec
HackTheBoxDifícil
Helpline
10.10.10.132
eWPT OSCP
Técnicas destacadas:
ManageEngine ServiceDesk Plus User EnumerationManageEngine ServiceDesk Plus Authentication BypassingManageEngine ServiceDesk Plus Remote Code Execution
HackTheBoxDifícil
Holiday
10.10.10.25
eWPT eWPTXv2 OSWE OSCP (Escalada)
Técnicas destacadas:
SQL Injection [SQLI] - SqliteXSS Injection - Bypassing Techniques (fromCharCode) + Own Javascript Code + Session Cookie TheftAbusing existing parameters - RCE
HackTheBoxFácil
Horizontall
10.10.11.105
eWPT eJPT
Técnicas destacadas:
Information LeakagePort ForwardingStrapi CMS Exploitation
HackTheBoxMedia
Hospital
10.10.11.241
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMB EnumerationAbusing File Upload (.phar extension + Python Scripting)Abusing PHP Disable Functions in order to RCE
HackTheBoxMedia
IClean
10.10.11.12
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Web EnumerationHTML InjectionXSS Exploitation
HackTheBoxMedia
Inception
10.10.10.67
eWPT OSWE eCPPTv3
Técnicas destacadas:
DomPDF Exploitation - Local File Inclusion (LFI) [CVE-2014-2383]Bash ScriptingAbusing Squid Proxy
HackTheBoxFácil
Inject
10.10.11.204
eWPT OSCP (Escalada)
Técnicas destacadas:
Web EnumerationLocal File Inclusion + Directory ListingInformation Leakage
HackTheBoxMedia
Instant
10.10.11.37
eJPT
Técnicas destacadas:
APK Analysis (apktool)Information LeakageAPI Enumeration (Swagger)
HackTheBoxMedia
Intelligence
10.10.10.248
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Information LeakageKerberos Enumeration (Kerbrute)Creating a DNS Record (dnstool.py) [Abusing ADIDNS]
HackTheBoxMedia
Interface
10.10.11.195
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Web EnumerationAPI Endpoints EnumerationFuzzing POST API Parameters
HackTheBoxFácil
Irked
10.10.10.117
eJPT
Técnicas destacadas:
UnrealIRCd 3.2.8.1 Exploitation (RCE)Steganography ChallengeAbusing SUID Binary
HackTheBoxMedia
Jab
10.10.11.4
OSCP OSEP eCPPTv3 eCPTXv2 Active Directory
Técnicas destacadas:
SMB EnumerationXMPP/Jabber Enumeration via PidginInformation Leakage
HackTheBoxInsane
Jail
10.10.10.34
Buffer Overflow OSCP (Escalada)
Técnicas destacadas:
Code AnalysisBinary ExploitationBuffer Overflow x32 - Socket Re-Use Shellcode Technique
HackTheBoxMedia
Jeeves
10.10.10.63
OSCP eJPT eWPT eCPPTv3
Técnicas destacadas:
Jenkins Exploitation (Groovy Script Console)RottenPotato (SeImpersonatePrivilege)PassTheHash (Psexec)
HackTheBoxFácil
Jerry
10.10.10.95
eJPT
Técnicas destacadas:
Information LeakageAbusing Tomcat [Intrusion & Privilege Escalation]
HackTheBoxMedia
Jewel
10.10.10.211
eWPT OSWE OSCP
Técnicas destacadas:
Gitweb EnumerationInformation LeakageCracking Hashes
HackTheBoxDifícil
Joker
10.10.10.21
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
SQUID Proxy EnumerationUDP EnumerationAbusing TFTP - Getting Squid Proxy Credentials
HackTheBoxMedia
Json
10.10.10.158
OSCP eWPT
Técnicas destacadas:
Abusing No RedirectJson Deserialization Exploitation - ysoserial.net [RCE]AppLocker Bypass
HackTheBoxMedia
Jupiter
10.10.11.216
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Subdomain EnumerationEnumerating Grafana RequestsExecuting system commands through PostgreSQL by exploiting an API (RCE)
HackTheBoxFácil
Keeper
10.10.11.227
eJPT
Técnicas destacadas:
Abusing Request TrackerInformation LeakageObtaining KeePass password through memory dump [Privilege Escalation]
HackTheBoxFácil
Knife
10.10.10.242
eJPT
Técnicas destacadas:
PHP 8.1.0-dev - 'User-Agent' Remote Code Execution [RCE]Abusing Sudoers Privilege (Knife Binary) [Privilege Escalation]
HackTheBoxDifícil
Kotarak
10.10.10.55
eWPT eWPTXv2 OSWE eCPPTv3 eCPTXv2
Técnicas destacadas:
Server Side Request Forgery (SSRF) [Internal Port Discovery]Information Leakage [Backup]Tomcat Exploitation [Malicious WAR]
HackTheBoxFácil
Laboratory
10.10.10.216
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
SSL Certificate EnumerationGitlab EnumerationGitlab Exploitation - Arbitrary file read via the UploadsRewriter when moving an issue
HackTheBoxFácil
Lame
10.10.10.3
eJPT
Técnicas destacadas:
Samba 3.0.20 < 3.0.25rc3 - Username Map Script [Command Execution]
HackTheBoxFácil
Late
10.10.11.156
eWPT OSWE OSCP
Técnicas destacadas:
Virtual Hosting EnumerationAbusing Upload File - Image to Text Flask UtilitySSTI - Server Side Template Injection
HackTheBoxMedia
Lazy
10.10.10.18
eWPT OSWE OSCP
Técnicas destacadas:
Padding Oracle Attack (Padbuster)Bit Fliper Attack (BurpSuite) - Obtaining the admin user's CookieAbusing SUID binary
HackTheBoxFácil
Legacy
10.10.10.4
OSCP eJPT
Técnicas destacadas:
SMB EnumerationEternalblue Exploitation (MS17-010) [Triple Z Exploit]
HackTheBoxFácil
LinkVortex
10.10.11.47
eWPT
Técnicas destacadas:
Subdomain Enumeration.git Exposure (GitHack)Information Leakage
HackTheBoxFácil
Love
10.10.10.239
eJPT eWPT OSCP (Escalada)
Técnicas destacadas:
Server Side Request Forgery (SSRF)Exploiting Voting SystemAbusing AlwaysInstallElevated (msiexec/msi file)
HackTheBoxFácil
Luanne
10.10.10.146
eWPT
Técnicas destacadas:
Web EnumerationDefault Credentials (Supervisord Default Password)Fuzzing (Gobuster/Wfuzz)
HackTheBoxMedia
Luke
10.10.10.137
eWPT
Técnicas destacadas:
FTP EnumerationInformation LeakageAbusing NodeJS Application
HackTheBoxInsane
MagicGardens
10.10.11.9
eWPT eWPTXv2 OSWE OSED Buffer Overflow
Técnicas destacadas:
Web EnumerationTesting the Payment SystemTricking the Payment System so that the Information Passes through our Server
HackTheBoxFácil
Mailing
10.10.11.14
eWPT OSCP
Técnicas destacadas:
Web EnumerationInformation Leakage through LFI (hMailServer)Cracking Hashes
HackTheBoxMedia
Manager
10.10.11.236
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMB EnumerationUser Enumeration [1st way] - RID Cycling Attack (rpcclient)User Enumeration [2nd way] - RID Cycling Attack (CrackMapExec)
HackTheBoxMedia
Mango
10.10.10.162
eWPT OSWE
Técnicas destacadas:
Virtual HostingNoSQL Injection Login BypassNoSQL Injection - Dumping Users and Passwords [Python Scripting]
HackTheBoxDifícil
Mantis
10.10.10.52
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Database Enumeration (DBeaver)Bloodhound Enumeration (bloodhound-python)Exploiting MS14-068 (goldenPac.py) [Microsoft Kerberos Checksum Validation Vulnerability]
HackTheBoxMedia
Mentor
10.10.11.193
eWPT OSWE eCPPTv3
Técnicas destacadas:
Virtual HostingSubdomain EnumerationAPI Enumeration
HackTheBoxMedia
Meta
10.10.11.140
eWPT OSWE OSCP
Técnicas destacadas:
Subdomain EnumerationAbusing File UploadExiftool Exploitation [RCE]
HackTheBoxFácil
MetaTwo
10.10.11.86
eWPT
Técnicas destacadas:
WordPress EnumerationWordPress Plugins EnumerationBookingPress < 1.0.11 - Unauthenticated SQL Injection [CVE-2022-0739]
HackTheBoxInsane
Minion
10.10.10.57
eWPTXv2 OSWE
Técnicas destacadas:
Server Side Request Forgery (SSRF) [Internal Port Discovery]ICMP Reverse Shell (PowerShell) [Firewall Bypassing]Alternate Data Streams (ADS)
HackTheBoxFácil
Mirai
10.10.10.48
eJPT
Técnicas destacadas:
Gaining SSH Access Using Default Raspberry CredentialsAbusing Sudo Group [Privilege Escalation]Recovering Deleted root.txt File through a Connected External Device
HackTheBoxInsane
Mischief
10.10.10.92
OSCP eWPT eWPTXv2 eCPPTv3 eCPTXv2 OSWE
Técnicas destacadas:
SNMP EnumerationInformation LeakageIPv6
HackTheBoxDifícil
Moderators
10.10.11.173
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Web EnumerationInformation LeakageInsecure Direct Object Reference (IDOR) in order to discover valid reports
HackTheBoxMedia
Monitored
10.10.11.248
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Nagios EnumerationAPI EnumerationSNMP Enumeration
HackTheBoxDifícil
Monitors
10.10.10.238
eCPPTv3 eWPT eWPTXv2 OSCP OSWE
Técnicas destacadas:
Information LeakageWordPress Plugin Exploitation (Spritz)Local File Inclusion (LFI)
HackTheBoxMedia
MonitorsThree
10.10.11.30
eWPT OSWE eWPTXv2
Técnicas destacadas:
Subdomain EnumerationSQLI - Manual Time Based Blind Injection (Python Scripting)Cracking Hashes
HackTheBoxFácil
MonitorsTwo
10.10.11.211
eWPT OSWE
Técnicas destacadas:
Cacti 1.2.22 Exploitation - Command InjectionCracking HashesDocker Exploitation (CVE-2021-41091) [Privilege Escalation]
HackTheBoxMedia
Monteverde
10.10.10.172
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
RPC EnumerationCredential Brute Force - CrackMapExecShell Over WinRM
HackTheBoxInsane
MultiMaster
10.10.10.179
OSCP OSEP eCPPTv3 eWPT eWPTXv2 OSWE Active Directory
Técnicas destacadas:
SQLI (SQL Injection) - Unicode InjectionWAF BypassingAdvanced Python Scripting - Creation of an automation tool to handle Unicode in SQL injection
HackTheBoxDifícil
Napper
10.10.11.240
OSED
Técnicas destacadas:
IIS EnumerationSubdomain EnumerationInformation Leakage
HackTheBoxFácil
Netmon
10.10.10.152
eJPT eWPT OSCP
Técnicas destacadas:
FTP EnumerationInformation LeakageAbusing PRTG Network Monitor - Command Injection [RCE]
HackTheBoxFácil
Networked
10.10.10.146
eWPT eJPT
Técnicas destacadas:
Information LeakagePHP Source Code AnalysisAbusing File Upload (AddHandler Exploitation) [RCE]
HackTheBoxFácil
Nibbles
10.10.10.75
eJPT
Técnicas destacadas:
Abusing Nibbleblog - Remote Code Execution via File UploadAbusing Sudoers Privilege [Privilege Escalation]
HackTheBoxInsane
Nightmare
10.10.10.66
eWPT OSWE
Técnicas destacadas:
HTML InjectionXSS InjectionSQL Injection (SQLI) - Error Based
HackTheBoxMedia
Nineveh
10.10.10.43
eWPT OSWE OSCP
Técnicas destacadas:
Abusing http forms with Hydra - Login Brute ForceLocal File Inclusion (LFI)Steganography - id_rsa hidden in image
HackTheBoxFácil
Nocturnal
10.10.11.64
eWPT eWPTXv2
Técnicas destacadas:
Web EnumerationUser Enumeration VulnerabilityInformation Leakage
HackTheBoxMedia
Node
10.10.10.58
eJPT (Intrusión) Buffer Overflow
Técnicas destacadas:
Information LeakageAPI EnumerationCracking Hashes
HackTheBoxFácil
NodeBlog
10.10.11.139
eJPT eWPT
Técnicas destacadas:
NoSQL Injection (Authentication Bypass)XXE File ReadNodeJS Deserialization Attack (IIFE Abusing)
HackTheBoxMedia
Noter
10.10.11.160
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Information Leakage - User Enumeration [Brute-Force Wfuzz]Finding valid users - WfuzzSSTI (Server Side Template Injection) [Failed]
HackTheBoxFácil
NunChucks
10.10.11.122
eJPT eWPT
Técnicas destacadas:
NodeJS SSTI (Server Side Template Injection)AppArmor Profile Bypass (Privilege Escalation)
HackTheBoxDifícil
Object
10.10.11.132
OSCP OSEP eCPPTv3 OSWE Active Directory
Técnicas destacadas:
Jenkins Exploitation (New Job + Abusing Build Periodically)Jenkins Exploitation (Abusing Trigger builds remotely using TOKEN)Firewall Enumeration Techniques
HackTheBoxMedia
Obscurity
10.10.10.168
OSWE eWPT OSCP (Intrusión)
Técnicas destacadas:
Information LeakagePython Source Code AnalysisURL Command Injection
HackTheBoxMedia
October
10.10.10.16
eWPT (Intrusión) Buffer Overflow
Técnicas destacadas:
Abusing October CMS (Upload File Vulnerability)Buffer Overflow - Bypassing ASLR + Ret2libc (x32 bits)Buffer Overflow - Ret2libc without ASLR (x32 bits EXTRA)
HackTheBoxDifícil
Office
10.10.11.3
OSCP OSEP eCPPTv3 eCPTXv3 Active Directory
Técnicas destacadas:
SMB EnumerationWeb EnumerationJoomla 4.2.7 Exploitation - Leak Password [CVE-2023-23752]
HackTheBoxMedia
Olympus
10.10.10.83
eWPT
Técnicas destacadas:
Creating a Python Script with Scapy to Detect if a Host is Active [EXTRA]Creating a Port Scanner with Scapy [EXTRA]Xdebug Exploitation (RCE)
HackTheBoxMedia
OnlyForYou
10.10.11.210
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Web EnumerationSubdomain EnumerationInformation Leakage
HackTheBoxDifícil
Oouch
10.10.10.177
eWPT eWPTXv2 eCPPTv3 OSWE
Técnicas destacadas:
FTP EnumerationAbusing OAuth EndpointVirtual Hosting Enumeration
HackTheBoxFácil
OpenSource
10.10.11.164
eWPT eWPTXv2 OSWE eCPPTv3 OSCP
Técnicas destacadas:
Web EnumerationGithub Project EnumerationInformation Leakage
HackTheBoxFácil
Optimum
10.10.10.8
OSCP eWPT
Técnicas destacadas:
HttpFileServer 2.3 Exploitation [RCE]System Recognition - Windows Exploit SuggesterMicrosoft Windows 8.1 (x64) - 'RGNOBJ' Integer Overflow (MS16-098) [Privilege Escalation]
HackTheBoxMedia
Outdated
10.10.11.175
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMB EnumerationFollina Exploitation (CVE-2022-30190) + Nishang PowerShell TCP Shell [Remote Code Execution]SharpHound + BloodHound DC Enumeration
HackTheBoxDifícil
Overflow
10.10.11.119
OSWE eWPT eWPTXv2 Buffer Overflow
Técnicas destacadas:
Padding Oracle Attack (Padbuster)Padding Oracle Attack (Bit Flipper Attack - BurpSuite) [EXTRA]Cookie Hijacking
HackTheBoxDifícil
Overgraph
10.10.11.157
eWPT eWPTXv2 OSWE OSCP (Escalada)
Técnicas destacadas:
Virtual HostingInformation LeakageOpen Redirect Exploitation
HackTheBoxDifícil
Oz
10.10.10.96
eWPT eWPTXv2 OSWE eCPPTv3 eCPTXv2
Técnicas destacadas:
SQL Injection (SQLI)Server Side Template Injection (SSTI) (RCE)Abusing Knockd
HackTheBoxFácil
PC
10.10.11.214
eWPT eWPTXv2 OSWE
Técnicas destacadas:
gRPC Enumeration with grpcurl and gRPC UIRegistering a User in the Application through grpcurlSQL Injection in SQLite through grpcurl (Enumerating Tables, Columns and Data)
HackTheBoxFácil
Pandora
10.10.11.136
OSCP eWPT
Técnicas destacadas:
SNMP Fast EnumerationInformation LeakageLocal Port Forwarding
HackTheBoxFácil
Paper
10.10.11.143
eWPT OSCP (Escalada)
Técnicas destacadas:
Information LeakageAbussing WordPress - Unauthenticated View Private/Draft PostsAbusing Rocket Chat Bot
HackTheBoxMedia
Passage
10.10.10.206
eWPT OSWE OSCP (Escalada)
Técnicas destacadas:
CuteNews ExploitationCode AnalysisUSBCreator D-Bus Privilege Escalation
HackTheBoxFácil
Perfection
10.10.11.253
eWPT OSWE
Técnicas destacadas:
Newline Injection + SSTI (ERB Injection) [RCE]Cracking Hashes - Creating your own rules with hashcatAbusing the 'sudo' group once the user's password is known
HackTheBoxFácil
PermX
10.10.11.23
eWPT eJPT
Técnicas destacadas:
Subdomain EnumerationChamilo LMS Exploitation - Unauthenticated Command Injection [CVE-2023-31803] (RCE)Information Leakage
HackTheBoxDifícil
Phoenix
10.10.11.149
eWPT OSWE OSCP
Técnicas destacadas:
Asgaros Forum Exploitation - Unauthenticated Blind Time Based SQL Injection (SQLI)Download From Files 1.48 - Arbitrary File Upload (WordPress Plugin Exploitation)Cracking Hashes
HackTheBoxFácil
Photobomb
10.10.11.182
OSCP eWPT
Técnicas destacadas:
Virtual HostingWeb EnumerationInformation Leakage - Credentials in Javascript File
HackTheBoxFácil
Pilgrimage
10.10.11.219
eWPT eJPT
Técnicas destacadas:
Web EnumerationFile Upload EnumerationAbusing .git - Git-Dumper (Information Leakage)
HackTheBoxMedia
Pit
10.10.10.241
OSCP eWPT
Técnicas destacadas:
Information LeakageSNMP Enumeration (Snmpwalk/Snmpbulkwalk)SeedDMS Exploitation
HackTheBoxDifícil
Player
10.10.10.145
eWPT OSWE OSCP (Escalada)
Técnicas destacadas:
Subdomain EnumerationJWT EnumerationInformation Leakage - Abusing No Redirect
HackTheBoxMedia
Poison
10.10.10.84
eWPT eJPT
Técnicas destacadas:
Local File Inclusion (LFI)LFI to RCE - Log PoisoningCracking ZIP file
HackTheBoxMedia
Popcorn
10.10.10.197
eWPT eJPT
Técnicas destacadas:
Web EnumerationFile Upload Vulnerability - Abusing Content-Type to Upload Malicious PHP File (RCE)Kernel Exploitation (2.6.31) - DirtyCow (/etc/passwd) [Privilege Escalation]
HackTheBoxFácil
Postman
10.10.10.160
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Redis EnumerationRedis Exploitation - Write SSH KeyWebmin Exploitation - Python Scripting
HackTheBoxMedia
Pov
10.10.11.251
eWPT OSWE OSCP
Técnicas destacadas:
Subdomain EnumerationLFI through CV DownloadAbusing ViewState IIS Parameter + web.config secrets in order to achieve RCE
HackTheBoxFácil
Precious
10.10.11.189
eWPT
Técnicas destacadas:
Pdfkit v0.8.6 Exploitation - Command Injection (CVE-2022-25765)Advanced Python Scripting - Autopwn Script [EXTRA]Information Leakage [User Pivoting]
HackTheBoxDifícil
Pressed
10.10.11.142
OSCP eWPT eWPTXv2 OSWE
Técnicas destacadas:
Password GuessingWordPress Abusing RPC CallsWordPress XML-RPC Create WebShell
HackTheBoxFácil
Previse
10.10.11.104
eWPT eJPT
Técnicas destacadas:
Web EnumerationExecution After Redirect (EAR) Vulnerability - Skipping RedirectsPHP Source Code Analysis
HackTheBoxMedia
Puppy
10.10.11.58
OSCP OSEP eCPPTv3 eCPTXv3 Active Directory
Técnicas destacadas:
Kerberos User Enumeration (Kerbrute)SMB EnumerationDomain Users Enumeration via RPCClient
HackTheBoxMedia
Querier
10.10.10.125
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Macro Inspection (Olevba2)MSSQL Hash Stealing [Net-NTLMv2] (xp_dirtree)Abusing MSSQL (xp_cmdshell)
HackTheBoxDifícil
Quick
10.10.10.186
eWPT eWPTXv2 OSWE
Técnicas destacadas:
HTTP/3 EnumerationRecompiling curl to accept HTTP/3 requestsInformation Leakage
HackTheBoxDifícil
RE
10.10.10.144
OSCP
Técnicas destacadas:
Creating a malicious office document (libreoffice) - Playing with MacrosMacros Obfuscation - Bypassing YARA RulesConPtyShell - Enhancing our console mobility
HackTheBoxMedia
Ransom
10.10.11.153
eWPT
Técnicas destacadas:
Login Bypass (Type Juggling Attack)Decrypting a ZIP file (PlainText Attack - Bkcrack) - CONTI RANSOMWARE
HackTheBoxMedia
RedCross
10.10.10.113
eWPT Buffer Overflow
Técnicas destacadas:
Subdomain EnumerationXSS Injection - Stealing the admin user cookieInjection RCE
HackTheBoxFácil
RedPanda
10.10.11.170
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Server Side Template Injection (SSTI)SSTI - Bypassing special character restrictionSSTI - Creation of a Python script to automate java injection (RCE)
HackTheBoxInsane
Reddish
10.10.10.94
eCPPTv3 eCPTXv2
Técnicas destacadas:
Abusing Node.RedChisel & Socat UsageRedis-Cli Exploitation
HackTheBoxDifícil
Reel
10.10.10.77
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Metadata InspectionSMTP Enumeration (VRFY Manual vs smtp-user-enum)Crafting a malicious RTF document [PHISHING] [CVE-2017-0199]
HackTheBoxDifícil
Reel2
10.10.10.210
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Information LeakageOWA Password Spray - SprayingToolkitCreating a user list - spindrift.py
HackTheBoxFácil
Remote
10.10.10.180
eWPT OSCP (Escalada)
Técnicas destacadas:
Web EnumerationNFS Enumeration - ShowmountInformation Leakage
HackTheBoxMedia
Resolute
10.10.10.169
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
RPC Enumeration - Abusing querydispinfoCrackMapExec SMB Authentication SpryingAbusing WinRM - EvilWinRM
HackTheBoxMedia
Retired
10.10.11.154
Buffer Overflow OSCP (Escalada)
Técnicas destacadas:
LFI (Local File Inclusion) - Filter Bypass [Abusing str_replace]Buffer Overflow x64 - Full RELRO, NX, PIE, ASLR Bypass [ROP - Abusing a writable section]Creating an Autopwn Script [Python Scripting]
HackTheBoxFácil
Return
10.10.11.108
eJPT OSCP (Escalada)
Técnicas destacadas:
Abusing PrinterAbusing Server Operators GroupService Configuration Manipulation
HackTheBoxFácil
RouterSpace
10.10.11.148
eWPT Mobile
Técnicas destacadas:
Mobile Application Penetration TestingAPK Analysis and DebuggingDecoding APK with APKTool
HackTheBoxMedia
Runner
10.10.11.13
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
Subdomain EnumerationJetBrains TeamCity 2023.05.3 Exploitation (RCE) [CVE-2023-42793]Information Leakage
HackTheBoxFácil
Safe
10.10.10.147
Buffer Overflow
Técnicas destacadas:
Information LeakageBuffer Overflow [x64] [ROP Attacks using PwnTools] [NX Bypass] [ASLR Bypass]Trying to hijack the argument to the system() function by loading our content in RDI [Way 1]
HackTheBoxFácil
Sau
10.10.11.224
eWPT
Técnicas destacadas:
requests-baskets 1.2.1 Exploitation (SSRF - Server Side Request Forgery)Maltrail 0.53 Exploitation (RCE - Username Injection)Abusing sudoers privilege (systemctl) [Privilege Escalation]
HackTheBoxFácil
Sauna
10.10.10.175
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Information LeakageLdap EnumerationKerberos User Enumeration - Kerbrute
HackTheBoxDifícil
Scavenger
10.10.10.155
eWPT
Técnicas destacadas:
Domain Zone Transfer (AXFR)SQLI (Error Based) [WHOIS]PCAP Analysis (Tshark && Wireshark)
HackTheBoxMedia
Schooled
10.10.10.234
eWPT eWPTXv2 OSWE
Técnicas destacadas:
VHost Brute ForceMoodle EnumerationMoodle - Stored XSS
HackTheBoxMedia
Scrambled
10.10.11.168
OSCP OSEP eCPPTv3 eWPTXv2 (Escalada) Active Directory
Técnicas destacadas:
Web EnumerationInformation LeakageLdap Enumeration
HackTheBoxFácil
ScriptKiddie
10.10.10.226
eJPT OSCP (Escalada)
Técnicas destacadas:
Msfvenom Exploitation [CVE-2020-7384] [RCE]Abusing Logs + Cron Job [Command Injection / User Pivoting]Abusing Sudoers Privilege [Msfconsole Privilege Escalation]
HackTheBoxFácil
Sea
10.10.11.28
eWPT OSWE
Técnicas destacadas:
Web FuzzingWonderCMS Exploitation (XSS + RCE)Cracking Hashes
HackTheBoxMedia
Seal
10.10.10.250
eWPT eWPTXv2 OSCP (Intrusión) OSWE
Técnicas destacadas:
Information Leakage (GitBucket)Breaking Parser Logic - Abusing Reverse Proxy / URI NormalizationExploiting Tomcat (RCE) [Creating malicious WAR]
HackTheBoxDifícil
Search
10.10.11.129
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
Information Leakage - Password in picture (wtf?)RPC Enumeration (rpcclient)Ldap Enumeration (ldapdomaindump)
HackTheBoxMedia
SecNotes
10.10.10.97
eWPT OSCP
Técnicas destacadas:
User Enumeration (Wfuzz)Reflected XSSStored XSS
HackTheBoxFácil
Secret
10.10.11.120
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Code AnalysisAbusing an APIJson Web Tokens (JWT)
HackTheBoxFácil
Sense
10.10.10.60
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Information LeakagePFsense - Abusing RRD Graphs (RCE) [Evasion Techniques]Python Exploit Development (AutoPwn) [EXTRA]
HackTheBoxFácil
Servmon
10.10.10.184
eWPT OSCP
Técnicas destacadas:
NVMS-1000 Exploitation - Directory TraversalLocal File Inclusion (LFI)Local Port Forwarding - SSH
HackTheBoxMedia
Shared
10.10.11.172
eWPT OSCP
Técnicas destacadas:
Web EnumerationSQL Injection (SQLI) in a CookieCracking Hashes
HackTheBoxMedia
Shibboleth
10.10.11.124
eWPT OSCP
Técnicas destacadas:
Abusing IPMI (Intelligent Platform Management Interface)Zabbix ExploitationMariaDB Remote Code Execution (CVE-2021-27928)
HackTheBoxFácil
Shocker
10.10.10.56
eWPT eJPT
Técnicas destacadas:
ShellShock Attack (User-Agent)Abusing Sudoers Privilege (Perl)EXTRA: Creamos nuestro propio CTF en Docker que contemple ShellShock
HackTheBoxFácil
Shoppy
10.10.11.180
eWPT OSWE OSCP
Técnicas destacadas:
Virtual HostingSubdomain EnumerationNoSQL Injection (Admin Auth Bypass)
HackTheBoxDifícil
Shrek
10.10.10.47
OSCP (Escalada)
Técnicas destacadas:
Information LeakageSteganography Challenge - Hidden message in the spectrogram of an audio file (Audacity)Cryptography Challenge - Elliptic Curve (py-seccure)
HackTheBoxFácil
Sightless
10.10.11.32
eWPT OSWE
Técnicas destacadas:
WEB EnumerationSQLPad Exploitation - Command Injection [CVE-2022-0944]Cracking Hashes
HackTheBoxMedia
Silo
10.10.10.82
OSCP
Técnicas destacadas:
Abusing Oracle DatabaseOracle Database Attacking Tool (ODAT) InstallationOracle DB Exploitation - Identifying valid SIDs (sidguesser)
HackTheBoxInsane
Sink
10.10.10.225
eWPT eWPTXv2 OSWE
Técnicas destacadas:
HTTP Request Smuggling Exploitation (Leak Admin Cookie)Cookie HijackingInformation Leakage
HackTheBoxInsane
Sizzle
10.10.10.103
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMBCacls EnumerationMalicious SCF File (Getting NetNTLMv2 Hash)Ldap Enumeration (LdapDomainDump)
HackTheBoxMedia
Sneaky
10.10.10.197
OSED Buffer Overflow
Técnicas destacadas:
Web EnumerationSQL Injection - Login BypassInformation Leakage
HackTheBoxMedia
SneakyMailer
10.10.10.197
OSCP
Técnicas destacadas:
Information LeakageMass Emailing Attack with SWAKSPassword Theft
HackTheBoxMedia
Sniper
10.10.10.151
OSCP eWPT
Técnicas destacadas:
Local File Inclusion (LFI)Remote File Inclusion (RFI) [Failed]Remote File Inclusion through SMB Server (net usershare technique) [Success]
HackTheBoxFácil
Soccer
10.10.11.194
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Web EnumerationAbusing Tiny File Manager (RCE by Uploading a Malicious PHP File)WebSocket SQL Boolean-Based/Time-Based Blind Injection
HackTheBoxMedia
SolidState
10.10.10.51
eJPT
Técnicas destacadas:
Abusing James Remote Administration ToolChanging a user's email passwordInformation Leakage
HackTheBoxFácil
Spectra
10.10.10.229
eWPT eJPT
Técnicas destacadas:
Web EnumerationVirtual HostingInformation Leakage (wp-config.php.save)
HackTheBoxFácil
Squashed
10.10.11.191
OSCP
Técnicas destacadas:
NFS EnumerationAbusing owners assigned to NFS shares by creating new users on the system (Get Access to Web Root)Creating a web shell to gain system access
HackTheBoxInsane
Stacked
10.10.11.112
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Virtual Hosting EnumerationReferer XSS InjectionXSS - Creating JS file (accessing unauthorized resources)
HackTheBoxDifícil
Static
10.10.10.246
eWPT eJPT (Rutas Estáticas) eCPPTv3 eCPTXv2 OSWE OSCP
Técnicas destacadas:
Compressed File Recomposition (Fixgz)Abusing TOTP (Python Scripting - NTP protocol)Playing with Static Routes
HackTheBoxFácil
SteamCloud
10.10.11.133
eWPTXv2 OSWE
Técnicas destacadas:
Kubernetes API Enumeration (kubectl)Kubelet API Enumeration (kubeletctl)Command Execution through kubeletctl on the containers
HackTheBoxFácil
Stocker
10.10.11.196
eWPT OSWE
Técnicas destacadas:
Subdomain EnumerationNoSQL Injection - Authentication BypassAbusing API + Information Leakage
HackTheBoxMedia
Stratosphere
10.10.10.64
eWPT eJPT
Técnicas destacadas:
Apache Struts Exploitation (CVE-2017-5638)Python Library Hijacking (Privilege Escalation)
HackTheBoxMedia
StreamIO
10.10.10.151
eWPT eWPTXv2 OSWE OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SSL Certificate EnumerationSMB EnumerationKerberos User Enumeration (Kerbrute)
HackTheBoxMedia
Strutted
10.10.11.59
eWPT OSWE eWPTXv2
Técnicas destacadas:
Information LeakageApache Struts Exploitation [CVE-2024-53677]Apache Struts, Interceptors and OGNL Expression Language Explained
HackTheBoxFácil
Support
10.10.11.174
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMB EnumerationEXE Binary AnalysisDebugging with DNSpy
HackTheBoxMedia
Surveillance
10.10.11.245
eWPT
Técnicas destacadas:
CraftCMS Exploitation (CVE-2023-41892) - RCEInformation LeakageCracking Hashes
HackTheBoxFácil
SwagShop
10.10.10.140
eWPT OSWE OSCP
Técnicas destacadas:
Magento CMS Exploitation (Creating an admin user)Magento - Froghopper Attack (RCE)Abusing sudoers (Privilege Escalation)
HackTheBoxFácil
Tabby
10.10.10.194
eWPT OSCP (Escalada) eJPT (Intrusión)
Técnicas destacadas:
Local File Inclusion (LFI)Abusing Tomcat Virtual Host ManagerAbusing Tomcat Text-Based Manager - Deploy Malicious War (Curl Method)
HackTheBoxDifícil
Talkative
10.10.11.155
eWPT OSWE eCPPTv3
Técnicas destacadas:
Jamovi EnumerationRj Editor Code Execution (Reverse Shell)Information Leakage
HackTheBoxDifícil
Tally
10.10.10.59
OSCP
Técnicas destacadas:
SharePoint EnumerationInformation LeakagePlaying with mounts (cifs, curlftpfs)
HackTheBoxMedia
TartarSauce
10.10.10.88
eWPT OSWE OSCP
Técnicas destacadas:
RFI (Remote File Inclusion) - Abusing Wordpress Plugin [Gwolle-gb]RFI to RCE (Creating our malicious PHP file)Abusing Sudoers Privilege (Tar Command)
HackTheBoxFácil
Teacher
10.10.10.153
eWPT OSWE eWPTXv2 OSCP
Técnicas destacadas:
Information LeakageAbusing Moodle - Login BruteForce (Wfuzz)Moodle Exploitation - Code Injection (Abusing Math formulas in Quiz component) [RCE]
HackTheBoxMedia
Tenet
10.10.10.223
eWPT
Técnicas destacadas:
PHP Deserialization AttackAbusing Race Condition
HackTheBoxDifícil
Tentacle
10.10.10.224
eCPPTv3 eCPTXv2 OSCP OSEP eWPT eWPTXv2 OSWE Active Directory
Técnicas destacadas:
DNS Enumeration (dnsenum)SQUID ProxyWPAD Enumeration
HackTheBoxMedia
Tenten
10.10.10.10
eWPT eJPT
Técnicas destacadas:
Wordpress EnumerationCV filename disclosure on Job-Manager Wordpress Plugin [CVE-2015-6668]Steganography Challenge (Steghide)
HackTheBoxMedia
TheNotebook
10.10.10.230
eWPT OSCP (Escalada) OSWE
Técnicas destacadas:
Abusing JWT (Gaining privileges)Abusing Upload FileDocker Breakout [CVE-2019-5736 - RUNC] (Privilege Escalation)
HackTheBoxMedia
Time
10.10.10.214
eWPT OSWE OSCP
Técnicas destacadas:
Jackson CVE-2019-12384 Exploitation - SSRF to RCEAbusing Cron Job [Privilege Escalation]
HackTheBoxFácil
TimeLapse
10.10.11.152
OSCP OSEP eCPPTv3 Active Directory
Técnicas destacadas:
SMB EnumerationCracking ZIp Password Protected File (fcrackzip)Cracking and reading .PFX File (crackpkcs12)
HackTheBoxMedia
Timing
10.10.11.135
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Local File Inclusion (LFI)Using Wrappers - Base64 WrapperCode Inspection
HackTheBoxInsane
Toby
10.10.11.121
eWPT OSWE eWPTXv2 eCPPTv3 eCPTXv2
Técnicas destacadas:
Abusing GOGS (Project Enumeration)Static Code Analysis (Finding a backdoor with php-malware-scanner)Code deofuscation
HackTheBoxFácil
Toolbox
10.10.10.236
eWPT OSCP (Intrusión) eJPT eCPPTv2
Técnicas destacadas:
PostgreSQL Injection (RCE)Abusing boot2docker [Docker-Toolbox]Pivoting
HackTheBoxFácil
Topology
10.10.11.217
eWPT
Técnicas destacadas:
Subdomain EnumerationLaTeX Injection + Blocklisted Function BypassFile Read through LaTeX Injection
HackTheBoxDifícil
Travel
10.10.10.189
eWPT eWPTXv2 OSWE OSCP (Escalada)
Técnicas destacadas:
Git Project Recomposition (.git) [Git-Dumper]Abusing WordPress (SimplePie + Memcache) [PHP Code Analysis]Memcache Object Poisoning (Gopherus + Deserialization Attack + RCE)
HackTheBoxFácil
Traverxec
10.10.10.165
eWPT OSCP (Escalada)
Técnicas destacadas:
Nostromo ExploitationAbusing Nostromo HomeDirs ConfigurationExploiting Journalctl (Privilege Escalation)
HackTheBoxFácil
Trick
10.10.11.166
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
DNS EnumerationDomain Zone Transfer Attack (AXFR)SQL Injection (SQLI) - Manual Blind SQLI with Conditional Responses [Python Scripting - AutoPwn]
HackTheBoxMedia
Trickster
10.10.11.34
eWPT eWPTXv2 OSWE eCPPTv3
Técnicas destacadas:
Subdomain EnumerationInformation Leakage - Github project rebuild with GitHackPrestaShop 8.1.5 Exploitation - [CVE-2024-34716]
HackTheBoxFácil
TwoMillion
10.10.10.11
eWPT OSWE
Técnicas destacadas:
Building a Python3 Stealth port scanner with ScapyAbusing declared Javascript functions from the browser consoleAbusing the API to generate a valid invite code
HackTheBoxDifícil
Unbalanced
10.10.10.200
eWPT eWPTXv2 OSWE eCPPTv3 eCPTXv2
Técnicas destacadas:
Rsync & EncFSEncfs2john to obtain a Hash we can crackCracking Hashes
HackTheBoxMedia
Undetected
10.10.11.146
eWPT OSWE
Técnicas destacadas:
Virtual Hosting EnumerationAbusing Directory ListingPHPUnit 5.6 Exploitation (CVE-2017-9841) [RCE]
HackTheBoxMedia
Unicode
10.10.11.126
eWPT eWPTXv2 OSWE
Técnicas destacadas:
JWT EnumerationJWT - Claim Misuse VulnerabilityJSON Web Key Generator (Playing with mkjwk)
HackTheBoxMedia
Union
10.10.11.128
eWPT eJPT
Técnicas destacadas:
SQLI (SQL Injection) - UNION InjectionSQLI - Read FilesHTTP Header Command Injection - X-FORWARDED-FOR [RCE]
HackTheBoxDifícil
Unobtainium
10.10.10.235
eWPT eWPTXv2 OSWE eCPPTv3 eCPTXv2
Técnicas destacadas:
Inspecting custom applicationCode AnalysisInformation Leakage
HackTheBoxMedia
UpDown
10.10.11.177
OSWE eWPT eWPTXv2 OSCP
Técnicas destacadas:
Web EnumerationSubdomain Discovery (gobuster)Finding .git directory with nmap (http-enum)
HackTheBoxFácil
Usage
10.10.11.18
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Subdomain EnumerationSQLI - Boolean-Based Blind Injection (MANUAL) + BurpSuite TipsPython Scripting in order to exploit SQLI
HackTheBoxFácil
Valentine
10.10.10.79
eWPT
Técnicas destacadas:
SSL Heartbleed ExploitationCracking HashesTmux Socket File Session [Privilege Escalation]
HackTheBoxFácil
Validation
10.10.11.116
eJPT eWPT
Técnicas destacadas:
SQL (Error Based)SQL > RCE (INTO OUTFILE)Information Leakage
HackTheBoxMedia
Waldo
10.10.10.87
eWPT eJPT OSCP
Técnicas destacadas:
LFI (Local File Inclusion) - Filter BypassObtaining a user's SSH private key through the LFIEscaping from a container
HackTheBoxMedia
Wall
10.10.10.157
eWPT OSWE
Técnicas destacadas:
Abusing Basic Auth PathAbusing Centreon API - User Brute Force (Wfuzz)Abusing Centreon Login Panel - Python Scripting
HackTheBoxFácil
Wifinetic
10.10.11.247
OSWP
Técnicas destacadas:
FTP EnumerationInformation LeakageSSH Brute Force with CrackMapExec
HackTheBoxMedia
Worker
10.10.10.203
OSCP eWPT eWPTXv2
Técnicas destacadas:
SVN - Subversion EnumerationInformation LeakageVHost Fuzzing - Gobuster
HackTheBoxMedia
Writer
10.10.11.101
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
RPC EnumSQLi Bypass Login + SQL Injection [Database Enumeration]SQLi - File System Enumeration (Abusing load_file)
HackTheBoxDifícil
Yummy
10.10.11.36
eWPT eWPTXv2 OSWE
Técnicas destacadas:
Web EnumerationJWT EnumerationDirectory Traversal + Local File Inclusion
HackTheBoxDifícil
Zetta
10.10.10.156
OSCP
Técnicas destacadas:
Information LeakageFTP RFC2428 EnumerationAbusing RFC-2428 via EPRT command
HackTheBoxMedia
Zipping
10.10.11.229
eWPT eWPTXv2 OSWE OSCP
Técnicas destacadas:
File uploading abuse (%00 Injection) [Failed]ZipSlip Exploitation Technique for internal reading of filesSQL Injection + Regular Expression Bypass (%0a) + RCE through into outfile instruction
TryHackMeEasy
BLUE
10.10.201.168
OSCP OSEP eCPPTv3
Técnicas destacadas:
Eternalblue Exploitation (MS17-010)