# Touhid's Blog > Think Before Clicking !! ## Posts - [Suid Binary – .so Injection(Weak File Permissions)(Privilege Escalation)](https://touhidshaikh.com/blog/2024/10/suid-binary-so-injectionweak-file-permissionsprivilege-escalation/): Introduction SUID (Set User ID) binaries are executables that run with the privileges of the file owner rather than the user who executed the file. This capability can be advantageous in certain scenarios but can also pose significant security risks, particularly when weak file permissions or improper configurations are present. One of the most notable risks associated with SUID binaries is the potential for .so (shared object) injection, which can lead to privilege escalation. This article delves into the mechanics of SUID binaries, the exploitation of .so injection through weak file permissions, and how to mitigate these vulnerabilities. Understanding SUID […] - [Port Forwarding Explained](https://touhidshaikh.com/blog/2023/02/port-forwarding-explained/): Port forwarding allows remote computers (for example, computers on the Internet) to connect to a specific computer or service within a private local-area network (LAN). SSH (Secure Shell) is a network protocol used to securely connect to a remote computer. It is commonly used to remotely access and manage servers, as well as to securely transfer files between systems. One of the useful features of SSH is the ability to create secure tunnels, also known as port forwarding, which allows traffic to be securely transmitted between two systems through an encrypted connection. This can be useful for a variety of […] - [PSV-2018-0182: NetGear WNR614 WiFi Home Router Unauthenticated Remote Admin Forcibly Logout](https://touhidshaikh.com/blog/2023/02/psv-2018-0182-netgear-wnr614-wifi-home-router-unauthenticated-remote-admin-forcibly-logout/): . Introduction NetGear is a well-known name in the networking industry, providing a range of WiFi routers for homes and small businesses. One of the famous models from NetGear is the WNR614 WiFi Home Router. In this article, we’ll look at a vulnerability discovered in the WNR614 router, which allows an attacker to forcibly log out an authenticated user on the router’s administration panel. This vulnerability is known as the “Admin Kick-Out Exploit”. Vulnerability Description The vulnerability lies in the way the router handles user authentication. If any user logs in to the router’s administration panel, an attacker can forcibly […] - [(De | Un)serialization Detailed with Demo](https://touhidshaikh.com/blog/2023/01/de-unserialization-detailed-with-demo/): Hello Friends, In this post. I am going to cover Deserialization or Unserialization Vulnerability detailed with a Practical Example. Before going in depth of this post. be clear Desirialize and Unserialize is a same this in two different computer programming language. that is Unserialize in PHP and Deserialize in JAVA. Notes for Reader Are you Excited?? Okay… let’s take a look at what you’ll going to learn from this post. 😉 Index Introduction A deserialization attack occurs when an attacker is able to manipulate data that is being deserialized by a target application. This can allow the attacker to execute […] - [Local File Inclusion(LFI) Explained](https://touhidshaikh.com/blog/2023/01/local-file-inclusionlfi-explained/): Hello Guys! Today I’m gonna explain you some Local File Inclusion Tricks. If you are really interested in Web Application Pentesting and want to learn in-depth about LFI soo, you are in the right place. Blah BLah 😛 .. let’s continue our post. 😉 Index What is File Inclusion Attack? A File Inclusion Attack, also known as a Local File Inclusion (LFI) or a Remote File Inclusion (RFI) attack, is a type of web application vulnerability that allows an attacker to include a file from a remote server or a local file system into a web page on a vulnerable […] - [Server Side Request Forgery(SSRF) Explained with Examples](https://touhidshaikh.com/blog/2023/01/server-side-request-forgeryssrf-explained-with-examples/): Hello All Finally, I managed my time to write something about SSRF (Server Side Request Forgery) Vulnerability which is going wild nowadays in Bug Bounty Programs. Server Side Request Forgery (SSRF) is a type of web application vulnerability that allows an attacker to manipulate the server into making unintended requests on the attacker’s behalf. This can include accessing internal resources that are generally not accessible from the internet or even executing arbitrary code on the server. SSRF attacks are often used to bypass firewall or security group restrictions and can also be used to perform reconnaissance on the internal network. […] - [PHP Type Juggling Explained with Demo](https://touhidshaikh.com/blog/2023/01/php-type-juggling-explained-with-demo/): Hello All, PHP type juggling is a feature of the PHP programming language that allows variables to automatically change their data type based on the context in which they are used. This can lead to unexpected results and can potentially create security vulnerabilities if not handled properly. In PHP, there are eight basic data types: boolean, integer, float, string, array, object, resource, and NULL. The data type of a variable is determined by the value it contains. For example, if a variable contains a string of characters, it is considered a string. If it contains a number, it is considered […] - [Subdomain Takeover Explained with Practical](https://touhidshaikh.com/blog/2019/01/subdomain-takeover-explained/): After a long time. Finally, I manage my time to write detailed things about one very famous attack. which is "Subdomain Takeover" attack. Nowadays this vulnerability goes wild just because of bug hunters. I just try to write the "Subdomain Takeover" attack detailed with an in-depth explanation for my readers. - [Finger Service Users Enumeration](https://touhidshaikh.com/blog/2018/04/finger-service-users-enumeration/): Hello Guys, I am going to discuss a way to enumerate users of target system where Finger Protocol enables. but first, it’s better to understand what is finger protocol and how its work. In this post, ill Explain some theory behind Finger Service and protocol after that we’ll cover main enumeration part. Let’s Get Started, Index Finger Service Explain Finger Protocol Tools for Emunration Finger. finger command Metasploit Module finger-user-enum Finger Service The finger daemon runs on TCP port 79. The client will (in the case of remote hosts) open a connection to port 79. An RUIP (Remote User Information […] - [Metasploitable3 Installing and Building (Step by Step)](https://touhidshaikh.com/blog/2018/04/metasploitable3-building-step-by-step/): hello folks, In this post, I am going to explain how to download and install Metasploitable3 in Linux with Virtual box. Index Introduction of Metasploitable3 Setup RequiredTools. Build Metasploitable3 Automatically ( for Pen tester ) Build Metasploitable3 Manually ( For Developers ) Pro Tip. (Optional) Download Metasploit3 ( VirtualBox OVA ) (Noo Need to Build) Acknowledgements Introduction Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large number of security vulnerabilities. It is intended to be used as a target for testing exploits with Metasploit. Differences between Metasploitable 3 and the older versions Previous versions of Metasploitable were distributed […] - [Sudo (LD_PRELOAD) (Linux Privilege Escalation)](https://touhidshaikh.com/blog/2018/04/sudo-ld_preload-linux-privilege-escalation/): Privilege Escalation from an LD_PRELOAD environment variable. Before exploit let’s read something about LD_PRELOAD environment Variable. Index What is LD_PRELOAD? Detection. Exploit LD_PRELOAD. What is LD_PRELOAD? LD_PRELOAD is an optional environmental variable containing one or more paths to shared libraries, or shared objects, that the loader will load before any other shared library including the C runtime library (libc.so) This is called preloading a library. To avoid this mechanism being using as an attack vector for suid/sgid executable binaries, the loader ignores LD_PRELOAD if ruid != euid. For such binaries, only libraries in standard paths that are also suid/sgid will be preloaded. For More click here. Detection Fire […] - [NFS weak permissions(Linux Privilege Escalation)](https://touhidshaikh.com/blog/2018/04/nfs-weak-permissionslinux-privilege-escalation/): If you have a Low privilege Shell on any machine and you found that a machine has an NFS share you might be able to use that to escalate privileges. Depending on how it is configured. Let’s take a tour to understand Weak permission on NFS server. Index What is NFS? What is root_sqaush and no_root_sqaush? Required Tools and Program FIle. Exploit NFS Weak Permission. What is NFS? The Network File System (NFS) is a client/server application that lets a computer user view and optionally store and update files on a remote computer as though they were on the user’s own […] - [Abusing SUDO (Linux Privilege Escalation)](https://touhidshaikh.com/blog/2018/04/abusing-sudo-linux-privilege-escalation/): If you have a limited shell that has access to some programs using the commandsudo you might be able to escalate your privileges. here I show some of the binary which helps you to escalate privilege using the sudo command. But before Privilege Escalation let’s understand some sudoer file syntax and what is sudo command is? ;). Index What is SUDO? Sudoer FIle Syntax. Exploiting SUDO user /usr/bin/find /usr/bin/nano /usr/bin/vim /usr/bin/man /usr/bin/awk /usr/bin/less /usr/bin/nmap ( –interactive and –script method) /bin/more /usr/bin/wget /usr/sbin/apache2 What is SUDO ?? The SUDO(Substitute User and Do) command, allows users to delegate privileges resources proceeding activity […] - [Introduction & Networking (Pentestit Lab v11)](https://touhidshaikh.com/blog/2018/02/introduction-networking-pentestit-lab-v11/): Hello Guys, This is my FIrst post on PentestIT Lab v11. In this post, I am going to explain Network Diagram, How to Connect on Lab’s VPN. ABOUT “TEST LAB” Penetration testing laboratories “Test lab” emulate an IT infrastructure of real companies and are created for a legal pen testing and improving penetration testing skills. Laboratories are always unique and contain the most recent and known vulnerabilities.  Developing “Test lab” labs we try to cover almost all IT areas: network security, security of OSs and applications. Participants are supposed to exploit the variety of vulnerabilities in network components and cryptographic […] - [Dina 1.0.1 Walkthrough (VulnHub) by gr0mb1e](https://touhidshaikh.com/blog/2017/12/dina-walkthrough/): Dina 1.0.1 Walkthrough Original Author : gr0mb1e (https://gr0mb1e.wordpress.com/author/gr0mb1e/ ) A couple weeks back, dear ol’  VulnHub delivered unto us a buh-hut load of VMs after a bit of a dry spell.  As someone who’s still cutting their teeth with pen testing, I was pretty anxious to fire up a bulk of those and get to work. Like many others, I’ve begun to document my steps for my own sake of retaining what I learn — and fail at — and also in preparation for when I eventually attempt the OSCP. I hope what I learn helps someone else learn along the way. One of […] - [Unquoted Service Path Privilege Escalation](https://touhidshaikh.com/blog/2017/06/unquoted-service-path-privilege-escalation/): What is Privilege Escalation? Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application with more privileges than intended by the application developer or system administrator can perform unauthorized actions. (by Wikipedia) NOTE: Privilege Escalation is a Post Exploit. What is Unquoted Service Path?  Unquoted Service Path is a vulnerability that occurs if a service executable or service binary file path contains space and not enclosed with quotation marks. […] - [PlaySMS 1.4 Code Execution in sendfromfile.php](https://touhidshaikh.com/blog/2017/05/playsms-v1-4-rce/): PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection. Unrestricted File Upload: Any registered user can upload any file because of not proper Validation of file in sendfromfile. Code Execution using $filename Now We know sendfromfile.php accept any file extension and just read content not stored in server. But there is bug when user upload example: mybackdoor.php server accept happily. but not store in any folder so our shell is useless. But if User change the file name to […] - [Ew_Skuzzy Walktrough (VulnHub)](https://touhidshaikh.com/blog/2017/04/ew_skuzzy-walktrough-vulnhub/): Hello guys, In this article.I am going to solve Very interesting Vulnerable Machine aka VM which teach me lots of things.  Download Link : https://download.vulnhub.com/ewskuzzy/Ew_Skuzzy.ova.tgz Target IP : 192.168.56.101 Goal : Flag Level: Intermediate.Now lets start   Information Gather Lets fire up Terminal and scan target using nmap nmap -p- -sV 192.168.56.101 Now, Here Port 80(http) is OPen means on port 80 any website running now i m crawling entire website using dirbuster. But Nothing Special found. Here one more interesting port  3260 which is used by iSCSI. What is iSCSI ? Internet Small Computer System Interface a.k.a ISCSI . iSCSI target […] - [RFI (Remote File inclusion) to Meterpreter](https://touhidshaikh.com/blog/2017/03/rfi-remote-file-inclusion-meterpreter/): Hello Hackers. In this post I’ll show you some basic concepts of Remote File inclusion attack, know as RFI and talks about some  RFI working  and How to prevent those attacks from hackers or bad guys. What is RFI ? Remote file inclusion a.k.a RFI attack is a type of Web vulnerability mostly found in PHP Web servers. This vulnerability to allow attacker to include remote file in Target(RFI vulnerable) webserver and execute The vulnerability occurs due to the use of user-supplied input without proper validation.   Vulnerable Coding!!! TYPE 1: <?php // The page we wish to display $file = $_GET[ 'page' ]; include $file; ?> TYPE 2: <?php […] - [Pluck Walkthrough (VulnHub)](https://touhidshaikh.com/blog/2017/03/pluck-walkthrough-vulnhub/): Hello Hackers. Welcome to my another walkthrough. at this  time we’ll look another VM, Pluck is a new VM in VulnHub and its very easy to hack. This Is very good for Newbie hackers for practice and explore their Hacking skills.   We know Target IP : 10.0.0.15 (in my case) Download Link : https://download.vulnhub.com/pluck/pluck.ova.zip   Now lets Start our Walkthrough. Scan VM using namp COMMAND nmap -p- -sV 10.0.0.15 now we know server’s port 80 open. that means server to host any website. Scan Vulnerability and Exploitin  Explore this website and search vulnerability. When i visited its About and […] - [PwnLab (VulnHub)](https://touhidshaikh.com/blog/2017/02/pwnlab-vulnhub/): Hello Hackers. Today we’ll walkthrough of PwnLAB. PwnLab is very interesting vulnerable vm for beginners hackers and pentester who refresh their skills. In this vm we face different types of web attacks and learn more as possible. Download Link : https://download.vulnhub.com/pwnlab/pwnlab_init.ova Goal : Flag: /root/flag.txt Difficulty: Low Now lets start   Information Gather Step 1 : Search the target vm (PwnLab’s) IP in your network. nmap 10.0.0.1/24 Now we have the target IP address now our next step is to scan entire ports and detect services name for future use. 😉 nmap -p- -sV 10.0.0.13 Now we know there is Apache server running on target system. […] ## Pages - [CLI](https://touhidshaikh.com/cli/) - [Privacy Policy](https://touhidshaikh.com/privacy-policy/): Privacy Policy for Touhid’s Blog At Touhid’s Blog, accessible from touhidshaikh.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collected and recorded by Touhid’s Blog and how we use it. If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us. This Privacy Policy applies only to our online activities and is valid for visitors to our website with regards to the information that they shared and/or collect in Touhid’s Blog. This policy is not applicable to any information […] - [Coutact Us](https://touhidshaikh.com/coutact-us/): Loading… - [About us](https://touhidshaikh.com/about/): Hello Friends. Touhid Shaikh aims to provide good hacking and cracking related content to their user for better understanding what is hacking and cracking. Note : All Content is only for Educational purpose.   ## Optional - [Agent (MCP protocol)](websites-agents.hostinger.com/touhidshaikh.com/mcp) [comment]: # (Generated by Hostinger Tools Plugin)