notes and writeups

Linux, security and GIS

  • Making your local workstation a proxy between two remotes

    Short background: recently I had to access an Oracle database and make a dump of it. The database was on a remote server that was accessible only via a VPN I had access to from my laptop. I didn’t have Oracle tools (like expdp or impdp) installed locally though. Instalation of those things on my local Ubuntu could be troublesome and I couldn’t find a suitable Docker image to use of out the box.

    Read more…
  • Jarvis

    This is a write-up of a HackTheBox machine named Jarvis. Enumeration One of the ports exposed on the server was HTTP port that served some hotel website. After a quick glance at the URLs I noticed, that subpage http://supersecurehotel.htb/room.php?cod=2 is vulnerable to SQL injection - Passing cod parameter as 2*2 returned site for room no 4. The sqlmap tool automates looking for the right payload and with default options for wizard mode, it returned all of the database content along with hashed, but simple, password for db user.

    Read more…
  • Craft

    This is a write-up of a HackTheBox machine named Craft. Disclaimer: the machine went available on 13.06.2019 and retired around January 5th 2020. Enumeration First thing was to discover open ports on the server: root@kali:~# nmap -p 0-49999 Starting Nmap 7.70 ( ) at 2019-07-13 15:10 EDT Nmap scan report for craft.htb ( Host is up (0.056s latency). Not shown: 49997 closed ports PORT STATE SERVICE 22/tcp open ssh 443/tcp open https 6022/tcp open x11 Nmap done: 1 IP address (1 host up) scanned in 63.

    Read more…