Offsec Proving Grounds Walkthrough – Interface

This was a good one! This is a walkthrough of OffSec Proving Grounds machine "Interface". I haven't seen any walkthroughs of this machine out there. In this video we use hydra to brute force a node.js web application after using the browser's developer tools to discover API endpoints (user list).…

Offsec Proving Grounds Walkthrough – Filebrowser

Walkthrough of the machine called "Filebrowser" in the OffSec Proving Grounds...don't watch unless you want help getting through the machine. In this video we take advantage of weak credentials for an online file browsing application, take advantage of SSH keys, then escalate using incorrectly set SUID on a binary. https://youtu.be/DHX2XFdpG5g

Offsec Proving Grounds Walkthrough – Cobbles

Walkthrough of the machine called "Cobbles" in the OffSec Proving Grounds...don't watch unless you want help getting through the machine. We take advantage of Zoneminder using a python exploit, then use enumeration to figure out the proxy situation. We end up privilege escalating using the exact same exploit by taking…

Offsec Proving Grounds Walkthrough – Jordak

This is a walkthrough of "Jordak" in the OffSec Proving Grounds. In this video we take advantage of the Jorani leave management software and use tools like GTFOBins to privesc. ***SPOILER***Walkthrough of the machine called "Jordak" in the Offsec Proving Grounds...don't watch unless you want help getting through the machine.…

Offsec Proving Grounds Walkthrough – Pathway

This is a walkthrough of OffSec Proving Grounds machine "Pathway". If you have taken TCM Security's Practical Ethical Hacking/PrivEsc training you will know what to do, I used my notes from that training to exploit the machine. We take advantage of S3 bucket information to grab credentials using tools like…