Dynamic Programming, A topic that scares a lot of people working hard for the interview preparation.
But even after getting intuition the above quote, the topic doesn’t seem an easy task! Even after a lot of struggle, sometimes it is too counter-intuitive.

An Approach

Let us build a roadmap and work according to it, building intuition step by step for every barrier and getting step by step one level up in it.

Let us divide Dynamic Programming into the parts:

After studying all of the above fundamental problems in the given sequence there is rarely a chance that you will not be able to crack a DP Problem during an interview.

All of the problems have sub-problems completely based on them but are somewhat tricky.

We will do every problem in the following sequence:

We will discuss every single problem, with one problem in each blog, from top-down to memoized dynamic programming.

Till that, Be Curious.

References

• Aditya Verma
• basecs

A script kiddie is a term used for people who just know how to run scripts, they never understand the core logic behind the same. For example, Usually, many kids, even some adults these days, Install and run Kali Linux, Metasploit and wifi hacking tools and feels like they know everything. This is nothing but a clear example of a Script Kiddie.

On other hand, a Security Researcher tries to understand the problem from its core, make their own ideas to break the system, if needed create their own scripts. This was never a thing that we shouldn’t use third-party Automations for something, but you have to be responsible while using them and understand them completely before jumping.

How to shift?

A good thing is that 90% of Security Researchers today were script kiddies someday.

Curiosity Never Kills The Cat.

They got curious to understand what happens inside, and got involved in different projects regarding security and got to understand the core.
There is no exact pathway for the same, someone prefers doing a degree, and others just find CTF challenges enough to learn everything.

But you have to always ask Why and How, and suddenly your path doesn’t matter, you will be learning every day.

That’s where we today end, Be Curious And Keep Learning.

Wait a sec, a very important video link is added in reference, this is something that changed my life(thank me later).

References

Hey there, I previously explained how I could fetch test cases from an ongoing live coding assessment. Please read Part 1 before moving forward if you haven't already.

Now as I was able to fetch test cases, I started thinking if I could escalate it further to some severe vulnerability.
Started a TCP Server with Netcat. Instead of HTTP Server, This time I created a TCP domain name using Ngrok.

Here now comes knowledge of Reverse Shell. Reverse Shell is a piece of code, which can help to get a C&C (Command & Control), bypassing firewall rules, because the connection is created from the server side to the attacker.

A basic python reverse shell I made passed in system command as parameter is shown below. It will be required to have knowledge about file descriptors and how Linux use them to access stdout, stdin and sockets.

As I ran this script with the TCP domain I got from Ngrok, I got a reverse shell on REDACTED.com’s code execution docker on my terminal running Netcat.
I was in this docker container, running bash shell.

I tried searching all the directories to find some juicy information, but just was able to find a file called .sentry. It contained some public tokens the error tracking related to sentry, but as said, it was a public token, so no use case.

Then I thought of getting environmental variables, simply ran env command and curiosity killed the cat.

I wasn’t able to believe, their code execution environment has all credentials including AWS_S3_TOKENS, FIRESTORE_TOKENS and HOST=root, I never realised everything was happening on the Root docker container.

There is a final part pending, where I will how I moved forward and the way to report vulnerability perfectly.

References:

• What is OS command injection, and how to prevent it? | Web Security Academy
• netcat - Wikipedia

Hi there, Today I am going to explain how I found a vulnerability in a very famous coding platform let’s say REDACTED.com, and how I escalated the same to Remote Code Execution.

After solving 2 problems for my Online Assessment test, I was completely stuck and was unable to pass 2 test cases for the third problem, tried for 30 minutes and still, no progress had 40 minutes still left, not able to figure out what can be done. I was sure, have screwed up in it so I started thinking in terms of test cases, instead of my code.

This lead me to think about what are these test cases, let’s try finding out.
I was coding in C-Plus-Plus in the same platform IDE and to see if a command runs I tried to run a simple system("ls") instruction, which runs a command to list files and give the output on standard output.

Executing the above code returned me output, listing all the files, but it only contained input source code and its executable no input test cases file was there.

which further made me think, what if instead of ls I could see the input I am getting while running the test. but it couldn’t happen as I/O were hidden for these test cases, hmmmmm.
And after thinking for a minute, came up with an idea.

What if I could send the input variable data as a payload to some server while executing code which will be hosted by me?

I immediately started a TCP server (using netcat) on some random port and exposed the same using ngrok (temporary global domain name utility for a local port). Tried changing the system command from ls toping https://<random>.ngrok.io and executed it.

And Boom! I was able to see a request from the REDACTED.com’s server on my very basic TCP server.

I simply changed the code to the below, as each test case had 4 inputs:

Thanks to this StackOverflow answer for helping me pass variables data in the system command.
Finally, I was able to get those two input test cases on my local server with a POST request upon execution 😄.

But

As this blog is getting long let’s end it here, but the story doesn’t end here, this is still pending how I escalated this to gaining a root shell in the server and getting complete access to AWS & Firebase tokens.

Stay Curious!

References:

• What is OS command injection, and how to prevent it? | Web Security Academy
• netcat - Wikipedia

This is one of OWASP's Top 10 vulnerabilities, that are found in systems today. Sometimes allows users to pass URLs intentionally. For example, uploading a file using the URL feature, makes the application vulnerable.

How does it work?

Many times, you try to upload something by URL, and the site sends a request from the server, not from the client side, because of common reasons like CORS Protection In Browser.

These features are too much risky for their servers if URLs aren’t properly sanitized because the Server requests to the third-party website which is completely in control of the User, user can change it to attack.com or localhost 😈.

An attacker can simply use localhost:5432 to access your database or localhost:6789 to access your Redis server, Any service running internally can be accessed by the same.

This vulnerability can cause data theft and exposure of Public IP.

References:

Portswigger:https://portswigger.net/web-security/ssrf

Java is one of the most used languages for server-side applications. Everyone loves using java for backend tasks.
On one peaceful night, a CVE got reported with a score of 10/10, for a library called Log4J which was used by Enterprise Java, which is powering around 3 Billion devices on earth and a rampage started.

This vulnerability simply enabled devices to have complete root access remotely to any system in the world.

How does it work?

A central JNDI Server is used to access variables instead of having separate copies of them in.
For example, getting Connection String for SQL Server or some credentials.

JNDI (Java Naming and Directory Interface) is an interface defined by java, used to get code from remote servers using different protocols like LDAP.

So, Log4J provided us with functionality to log variables from remote systems.
But More is the features, More are the Bugs, We can get variables by these features, but the issue no one noticed is instead of variables, we can deserialize java objects too from LDAP Servers, and execute them on our systems.

This is where Remote Code Execution comes into play.

Anyone with a simple JNDI LDAP Server setup can remotely access any server.
he just needs to create a Java class that simply creates a reverse TCP Connection to any Public IP, basically providing a C&C Shell.

How did it all start?

Log4J is a simple library used to log info in any stream. Most of the people who worked with Java know Logger.

• In 2013, a request for JNDI Server Plugin in the Log4J library came, basically, the person wants to fetch variables from a remote server, find it here.
  This is when a vulnerability is introduced.
• Then in 2014, an issue is raised requesting:

Ability to disable (date) lookup completely, compatibility issues with other libraries like Camel.

Basically, the person was unable to log curly brackets, it tries to get the same environment variable.

log.info("${date:now:buhu}");

The above code returns some value. instead of logging the same.

Someone fixed and added a code to disable lookups completely.

%msg{nolookups}

This disables NSlookups completely.

But by default, it was still vulnerable.

So no one noticed this till 2021 when a researcher exposed this CVE openly, anyone was able to target any server with just a simple JNDI LDAP Server configured with Public IP.

This loss was not due to developers, they tried and created features, but this was the responsibility and failure of Security Researchers who were never able to check this issue, even after a talk about it in Blackhat before CVE was released.

This vulnerability is now patched in new versions, but it caused a lot of loss to many governments as well as private organizations.

References:
LiveOverflow: https://www.youtube.com/watch?v=w2F67LbEtnk

Great Things Never Come From Comfort Zone.

According to Wikipedia, In the usage of operating systems, Windows(75.1%) is the most used Operating System, followed by OS X(15.52%) and at last Linux(2.75%).

OS X seems most optimized for its Hardware, but affordability is a issue here. Most people are using windows so let’s talk about these 75.1% of people, most of them have slow hardware, less than 8 GB RAM, and slow processors.

We pay around 100$ more for getting systems with windows while we can simply install a User-Friendly Linux distribution, easy-to-use, optimized

The open source community is working too hard, to create different types of OS, that can support lower-end hardware to bulky machines.

I want to share two Linux Distributions that I feel are irreplaceable for personal systems.

• Pop OS: Easy, Fast, and Stable

Why Pop OS on top? Because a good product can never sustain completely until it is somehow backed by private organizations.

System76, the creator of Pop OS, customized Ubuntu, made it more stable and commercialized it. It includes many features including GUI Installer for drivers, Lutris, and Wine support for running window apps and games on Linux.

The best thing about it is that everything can be done from GUI so no problem for new Linux users.
It comes up bundled with GNOME 42 as of Aug 2022, and has separate drivers for Nvidia, Intel, and AMD Graphics, which makes it most stable.

Even for programmers, it's always been a good choice, a little bulky if you are a power user, and want to feel in control of the system, which moves me to my next choice, which I always prefer to use.

• Manjaro: Feel the control

Manjaro is an Arch-based Linux Operating System.
It provides you the choice to use any Desktop Environment from LXDE (Lightest Desktop Environment) to KDE (Most Bulky 😝).

Comes completely raw and open source. Meant for the power users, who are always ready to get their hands on the terminal.
You can change anything, from converting the feel of the system to feel like a Mac or removing Desktop Environment and installing window manager (Playing with the 🔥)

I personally feel that people fear a lot of breaking systems, but as said there is a new world beyond the fear.

For me, it's always like, try it, and if it breaks it starts again making improvements 😃, its just software, there is always a way to fix it :).

Mind is a canvas use it to paint it with creativity, don’t use it as a dustbin.

This is something that is always missing in beginner developers, that make them struggle a lot.

Instead of keep asking to experienced/seniors/peers, they need to understand how to google perfectly. So, In today’s article, I will share few tips and tricks (Google Dorks) to improve google searching and make it faster, effective and better.

1. Search the exact keywords by enclosing it in double quotes.

Using Double quotes improve search results in cases like if you want to see how to solve an error, but be smart while using this,put some very specific information in quotes and get ready to have a “No Search Results”.

2. Search data in specific website.

This have a very real life usecase, For example you want to get some code related to some work on github, you can simply use site:github.com

3. Exclude keywords from google search.

If we want to exclude something from our search results, just use — before that keyword and google will completely filter it off.

4. State timings of google search results

You can flexibly get article/websites for that specific year. using before and after search parameters.

5. Using Wildcards.

Using wildcards will be very helpful for finding a variety of topics related to the search and will be very powerful.

6. Defining file type.

To get data for a specific file type, for ex. as shown above trying to do search of pdf files related to google.

Hope it might help getting better in googling, these tricks are really helpful for getting search results accurate and easily.

References:

• Fireship — Google Fu

Google Colaboratory is designed to make the data science and machine learning Projects Easy as Everyone cannot afford costly GPUs For Training Of Machine Learning Models. Most Important Benefit it gives, is root access on the docker container which is Jupyter Notebook.

Let’s Now Come to Point, I tried using os.system() commands on it. I was able to do everything! Then I came to know that we can use any bash command in the jupyter notebook just by adding a ! sign in front of it.

I have made a script we will be regularly updated, will provide a VPS Instance with all loaded bug hunting tools. It will Provide two choices:

1. If You Use GPU Instance You will get 32 GB RAM and 70 GB Storage with combination of Nvidia Tesla K8 GPU (Hashcat will be Extremely Fast).
2. A Normal Instance will provide 16 GB RAM and 100 GB of Storage.

Choice Depends Upon Need Choose what you want.

https://github.com/hackingguy/Bug-Hunting-Colab

Installation Process

1. First of all, go to Ngrok Website And Sign Up For a Account.
2. After Sign Up, In Authentication Click On Your Auth Token.
3. You Can See Your Auth Token Here.
4. Now Open My Colab Repo And Click On Open With Colab Button In Readme (You must be logged in with any gmail Account to use google colab).
5. Simply Run JS Code Alive Script As Google Colab Gets Disconnected Sometimes being idle.
6. Now Just Input your Ngrok token in Bug Hunting VPS And Wait for it Complete.
7. Now Wait for 10 Minutes As It is gonna install all important tools from every epic infosec community member!
8. You can disable VNC if you don’t need GUI Mode.
9. Now You Can Enjoy Free VPS.

Benefits:

1. Free And No Need To Pay Anything
2. Mount Google Drive For Permanent Storage
3. On Update Notifications
4. Tools Regularly Updated As Launched
5. Fast 32 GB RAM

Cons:

1. Disconnects After 24 Hrs.
2. Epheremal Storage

FFUF Speed:

Internet Speed Test:

HashCat Response:

Video Tutorial:

Thanks Everyone!