MariaDB Remote Login

How To Run TOR as a Non-Root User

Hello Friends, Today I finally figured out something that had eluded for quite a while, and that is... the mysterious process of running TOR as a non-root user! Like many other novice hackers, I had tried to run TOR by adding a user in Kali Linux through the following CLI commands: $ useradd guest $ passwd guest $ runuser -l guest -c ./start-tor-browser.desktop Which gave me the lovely error message below: $ Tor Browser must be run within the X Window System This last output one gives us a clue: the X Window System is graphical interface, which means that we need to run this software outside the CLI (you can try downloading the xorg, but that proved to be much of a headache). To do this, go here: Log out as root and login as the user you created. The computer will load the GUI and you will now be able to run TOR as a non-root user! Please let me know if this tutorial helped you out! xoxo

Port Forwarding

Dear Diary, Today was a good day. I learned about a powerful new feature called Port Forwarding! Port Forwarding is a feature of SSH that allows you to redirect traffic from on a target machine to another using a specified IP and port. This is a powerful tool because it allows you to relay communication from a target machine to an external host (i.e. your computer!). All you need is: SSH Credentials The port of the resource you want to access Let's say the web server is hosted on 127.0.0.1:8443. You can use the command below to access that webserver: ssh -L 8443:127.0.0.1:8443 <username>@10.10.10.184 Where you can now execute curl commands to retrieve information on that website (without port forwarding, this would've resulted in an access denied error!) curl -k -i -u admin:<password> https://localhost:8443

The Infamous Log4J Exploit: How To

Hi Everyone! In this post, I'll explain the Log4j exploit, step-by-step! First, we'll start off by looking at these log files, gathered from a web application running Apache Solr: If you look carefully, there are calls made to a certain parameter in the URL of the web application. Can you spot it? If you look carefully, you'll see that it is /admin/cores. If you're experienced with pen testing, you can probably see where this exploit is going. After doing an nmap scan on the target, we find that port 8983 is open. If you navigate to http://10.10.231.181:8983/, you'll see a page for Apache Solr that indicates that the application is running Log4j. Now, we navigate to http://10.10.231.181:8983/solr/admin/cores. You'll notice that params seems to be included in the log file. The log4j package adds extra logic to logs by "parsing" entries, ultimately to enrich the data -- but may additionally take actions and even evaluate code based off the entry da...

My Security Diary

Search This Blog