# crackcat @ studying

## crackcat @ studying

- [Home](https://ccat.gitbook.io/cyber-sec/home.md): I am an engineer who is passionate about high quality cyber security. I like to understand how things works - and how to break them. You will find write-ups and other cyber-stuff here.
- [Infographics](https://ccat.gitbook.io/cyber-sec/infographics.md): This page features a small collection of infographics that I created.
- [Buffer Overflow - Explained](https://ccat.gitbook.io/cyber-sec/how-stuff-works/buffer-overflow-explained.md): An in-depth guide on a basic buffer overflow and the details behind developing an exploit for it.
- [Embedded Firmware Extraction](https://ccat.gitbook.io/cyber-sec/how-stuff-works/embedded-firmware-extraction.md): A tale of practicing firmware extraction mixed with some file format reverse engineering.
- [CI/CD for a Pentest VM](https://ccat.gitbook.io/cyber-sec/how-stuff-works/ci-cd-for-a-pentest-vm.md): Automating the continuous deployment of a virtual pentest machine using Proxmox, Packer, Terraform, Ansible and GitLab.
- [CTF - BugBase - RaaS](https://ccat.gitbook.io/cyber-sec/write-ups/ctf-bugbase-raas.md): A beginner-friendly introduction to heap-related CTF challenges.
- [THM - Binex](https://ccat.gitbook.io/cyber-sec/write-ups/thm-binex.md): Exploiting the SUID bit and a buffer overflow for privesc after brute forcing the initial access.
- [THM - Brainpan](https://ccat.gitbook.io/cyber-sec/write-ups/brainpan.md): Exploiting a buffer overflow and abusing sudo privileges for escalation.
- [THM - CMesS](https://ccat.gitbook.io/cyber-sec/write-ups/cmess.md): Discovering a virtual host that leads to a compromised CMS with subsequent sudo privesc.
- [THM - Mr. Robot](https://ccat.gitbook.io/cyber-sec/write-ups/mr-robot.md): WordPress exploitation and password cracking on a Mr. Robot-themed target.
- [THM - Olympus](https://ccat.gitbook.io/cyber-sec/write-ups/olympus.md): A custom CMS and a puzzle-like exploit chain with some SUID fun for privesc.
- [THM - UltraTech](https://ccat.gitbook.io/cyber-sec/write-ups/ultratech.md): Exploiting an exposed API endpoint and weak password hashes before escalating via docker.
- [CVE-2019-17571 RCE PoC](https://ccat.gitbook.io/cyber-sec/cve/cve-2019-17571-rce-poc.md): This is not my CVE. It's a quick and dirty proof of concept tutorial on achieving RCE abusing CVE-2019-17571 that I put together for a friend.
- [CVE-2022-45962 Postauth SQLI](https://ccat.gitbook.io/cyber-sec/cve/cve-2022-45962-postauth-sqli.md): Authenticated SQL Injection in openSIS classic prior to 9.0.
- [Introduction](https://ccat.gitbook.io/cyber-sec/allendevent/introduction.md): Showcasing a beginner oriented pentesting challenge.
- [Chapter I](https://ccat.gitbook.io/cyber-sec/allendevent/chapter-i.md): First part of the walkthrough-series for the AllEndEvent pentest challenge.
- [Chapter II](https://ccat.gitbook.io/cyber-sec/allendevent/chapter-ii.md): Second part of the walkthrough-series for the AllEndEvent pentest challenge.
- [Chapter III](https://ccat.gitbook.io/cyber-sec/allendevent/chapter-iii.md): Third and final part of the walkthrough-series for the AllEndEvent pentest challenge.