Writing · 30 posts
Blog
Lab writeups and technical deep dives.What I learned, written down so I'll remember it.
Post-Exploitation with Metasploit and Meterpreter: psexec, Process Migration, and hashdump
A SEC504 Metasploit walkthrough using psexec (authenticated code execution where valid credentials are the exploit) to open a SYSTEM Meterpreter session, migrating into lsass.exe for stability and x64 context, and dumping local NTLM hashes to pivot to the next host.
Offline Password Cracking with Hashcat: Shadow Files, Active Directory NTDS, and the Attack-Mode Ladder
A SEC504 Hashcat walkthrough against Linux shadow hashes and an Active Directory NTDS.dit dumped with secretsdump.py, working the dictionary, mask, and rule-based attack modes and showing why a best64 rule attack cracks more hashes in four seconds than a six-minute mask run.
Stored XSS to Session Hijacking: Per-Field Probing and Cookie Theft
A SEC504 web walkthrough finding a stored cross-site scripting flaw in a support-ticket form through per-field probing (one field escaped, another not), weaponizing it into a cookie stealer that captures an analyst's session, and replaying the stolen token to reach an admin panel.