[ Pen Testing ] :: Step by Step :: Exploiting SETUID

This entry is part 1 of 1 in the series [ Penetration Testing ]

Setting the user ID on an executable means it runs under that user’s permissions, not the perms of the user that runs the executable. It’s highly useful in system admin, but it’s wildly dangerous too, because every SETUID file is a vector for hacking. John Hammond (on YouTube) give an excellent example in the context …

[ Hacker Night School ] :: Kali Linux Metapackages (All Tools or Subsets)

This entry is part 20 of 25 in the series [ Hacker Night School ]

There are actually four subsets of tools you can install with Kali, depending on your needs, disk resources and download speeds. These packages have names like kali-linux-full and kali-linux-all (those sound the same, don’t they?). Fortunately the good people at Offensive Security have a guide to the various metapackages. For instance: kali-linux is the barebones, …

[ Hacker Night School ] :: Adding the Kali Tools to Ubuntu

This entry is part 19 of 25 in the series [ Hacker Night School ]

Kali is cool as hell, but taking it to work could get you fired, or at some of the places I support, get me arrested. It’s not really intended to be a daily-driver OS, though the 2020 update has moved it a long way in that direction. The biggest problem with carrying Kali around is …

[ Hacker Night School ] :: A Memory Forensics with Volatility Writeup

This entry is part 18 of 25 in the series [ Hacker Night School ]

I’ve spoken in many classes about the process of dumping memory with DumpIt, then analysis with Volatility (preinstalled on the SIFT Workstation, a VM distro you should definitely explore). Meet LeetDev.net and their CTF Archives. Here’s a link to the CTF list page; click the Volatility graphic to go to the article, fortunately in English. …