Blog

Axum Server

Mon, 01 Jan 0001 00:00:00 +0000

Axum Server

Install required dependencies

cargo add axum
cargo add hyper --features=full
cargo add tokio --features=full
cargo add toker

Lets create a new function that will return the axum::routing::Router. This will be the core of our server.

// src/main.rs
fn app() -> Router {
    Router::new().route("/", get(|| async { "Hello, World!" }))
}

Creating a function that returns the Router will help us later to test our application.

Add the tokio config to the main function.

Axum sqlx database

Mon, 01 Jan 0001 00:00:00 +0000

Axum sqlx database

Install the dependencies: cargo add sqlx --features=runtime-tokio-native-tls,sqlite,macros,offline
- use tokio since axum is based on it
- native TLS openssl but is the same as rust-ls
- sqlite as the database engine
- macros for type safe queries
- offline mode for CI and test
- chrono (optional) for dates and times
Install sqlx-cli for migrations, through nix or cargo install
Sqlite connection option:
- see the series fly.io - sqlite internals wall
- journal_mode=wall

let options = SqliteConnectOptions::from_str(db_url)?
    .journal_mode(SqliteJournalMode::Wal);
let pool = SqlitePool::connect_with(options).await?;

add it to the state of the application, pool is a value wrapped in an Arc so it’s safe to clone if needed and pass between threads.

let app = app().with_state(State(pool));

CORS Laravel

Mon, 01 Jan 0001 00:00:00 +0000

CORS Laravel

I want to talk about the problems that I have encountered setting up CORS between a Laravel backend server and a simple Html frontend hosted on a different domain, using the fetch API.

What is CORS

Cross-Origin Resource Sharing (CORS) is a mechanism that uses HTTP headers to tell browsers to give a web application running at one origin, access to selected resources from a different origin. A web application executes a cross-origin HTTP request when it requests a resource that has a different origin (domain, protocol, or port) from its own.

CyberChallengeIT CTF - Group Challenge

Mon, 01 Jan 0001 00:00:00 +0000

CyberChallengeIT CTF - Group Challenge

During the last week of preparation for che Cyber Challenge IT CTF, we were asked to do a CTF challenge our self. We were divided in groups and given a month to come up with a challenge.

Our group create an easy and guided challenge, since we were required to solve it in one hour. It will cover some basic aspect of all the kind of challenges types like Web Security, Reversing, Forensics, Cryptography.

GoatCounter Analytics for NextJS

Mon, 01 Jan 0001 00:00:00 +0000

GoatCounter Analytics for NextJS

GoatCounter Analytics is a privacy-friendly web analytics tool perfect for small websites like blogs. It is free and open source, and it also has a self hosted option.

I started using it in this blog, to see how a better understanding the traffic, while still being privacy-friendly. Before, I was using the panel provided by Cloudflare, which is also a good option. But it didn’t provide me with enough information like the number of page views per page or article or the Referrer information.

GPG Key Rotation

Mon, 01 Jan 0001 00:00:00 +0000

GPG Key Rotation

GPG, or Gnu Privacy Guard, is a widely-used cryptography tool for secure communication, digital signatures, and file encryption. GPG key rotation is the process of changing your primary GPG key, either for security reasons or for changing the encryption algorithm used in your key.

In this article, we will go through the steps of GPG key rotation, from generating a new key to updating your configuration files and services.

Reply Challenge 2020 - That's what server says

Mon, 01 Jan 0001 00:00:00 +0000

Reply Challenge 2020 - That’s what server says

This is the Writeup for the 300 points Web challenge for Reply Challenge CTF. During the CTF I and my team achieved first blood on this challenge. The challenge consists of finding a service endpoint on a web page, with a login API. Then you have to exploit an XXE (XML External Entities) Injection to get an LFI (Local File Inclusion) to get the sysadmin credentials to login on the service and get the flag.

Systemd Units

Mon, 01 Jan 0001 00:00:00 +0000

Systemd Units

Systemd is a system and service manager for Linux. It is the default init system for a lot of distros and is awesome to manage services, sockets, timers, (and much more but we don’t talk about that).

What is a unit?

A unit is a configuration file that describes a process or a group of processes. It configures how the process should be started, stopped, restarted, and so on. It declares the dependencies between units and the order in which they should be started. It can also configure the resources that the process requires, such as the amount of memory or the number of open files.

TryHackMe - Blue

Mon, 01 Jan 0001 00:00:00 +0000

TryHackMe - Blue

The room link can be found at TryHackMe - Blue

For this room, I will be using the Metasploit framework.

Recon

We begin with a Nmap of the box to see the services and get their version.

msf5 > db_nmap -sC -sV 10.10.47.219

Now we can see all the running services with the services command.

msf5 > services
Services
========

host           port   proto  name               state  info
----           ----   -----  ----               -----  ----
10.10.47.219   135    tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   139    tcp    netbios-ssn        open   Microsoft Windows netbios-ssn
10.10.47.219   445    tcp    microsoft-ds       open   Windows 7 Professional 7601 Service Pack 1 microsoft-ds workgroup: WORKGROUP
10.10.47.219   3389   tcp    ssl/ms-wbt-server  open
10.10.47.219   49152  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49153  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49154  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49158  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49160  tcp    msrpc              open   Microsoft Windows RPC

On this machine, we will focus on the SMB service which is on port 445.

We can gather more information using the module auxiliary/scanner/smb/smb_version. Running it the services page will lock more like this.

10.10.47.219  445    tcp    smb                open   Windows 7 Professional SP1 (build:7601) (name:JON-PC) (workgroup:WORKGROUP ) (signatures:optional)

Also we run auxiliary/scanner/smb/smb1 to check if the box has support for SMBv1.

msf5 auxiliary(scanner/smb/smb1) > run

[+] 10.10.47.219:445      - 10.10.47.219 supports SMBv1 dialect.
[*] 10.10.47.219:445      - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

As the machine name implies the box could be exploitable via EternalBlue. Since the machine has Windows 7 installed and SMBv1 enabled, it is most likely vulnerable. You can read more here Microsoft - EternalBlue.

We can check if the machine is vulnerable by running the module auxiliary/scanner/smb/smb_ms17_010.

msf5 auxiliary(scanner/smb/smb_ms17_010) > run

[+] 10.10.47.219:445      - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.47.219:445      - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

TryHackMe - Easy Peasy

Mon, 01 Jan 0001 00:00:00 +0000

TryHackMe - Easy Peasy

The room link can be found at TryHackMe - Easy Peasy

Enumeration

First we scan for open ports and services

Nmap

We use nmap with some default arguments.

sudo nmap -sV -sC -oA nmap/first $IP

It will return.

PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.16.1
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: nginx/1.16.1
|_http-title: Welcome to nginx!

From the first scan we can see that port 80 is open with nginx version 1.16.1

TryHackMe - Vulnversity

Mon, 01 Jan 0001 00:00:00 +0000

TryHackMe - Vulnversity

The room link can be found at TryHackMe - Vulnversity

Reconnaissance

Nmap

First, we do a simple Nmap scan

nmap $IP
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3128/tcp open  squid-http
3333/tcp open  dec-notes

We find six ports open, we can now make a more in-depth scan with nmap -sC -sV $IP. It will found the service type and version.

ZSH configuration

Mon, 01 Jan 0001 00:00:00 +0000

ZSH configuration

I wanted to reconfigure the my zsh setup.

Before, I was using Oh My ZSH. Which is a wonderful configuration framework for zsh.

The problem I had was not using the feature that it provided. I was only using the base configuration and two plugins: git and sudo. Also, I didn’t use any theme since I prefer the starship prompt.

I wanted to strip down the configuration and remove this dependency. So I looked at the omz configurations and man zsh(1) to came up with the following configuration. Another source was the prezto framework, that you could look at for an alternative to omz.