All ProjectsAK
Penetration TestingVulnerability Exploitation

Penetration Testing Challenge – Web App Exploitation

Ethical Hacker·Sept – Oct 2024

Overview

A structured web application penetration test against a deliberately vulnerable environment. The goal was to trace the full compromise chain — from unauthenticated external access through FTP credential discovery, SSH login, and privilege escalation to root.

The Challenge

The challenge was to find the initial foothold without prior knowledge of the environment — no credentials, no source code. The attack surface included a web application, an FTP service, and SSH, each with different misconfiguration patterns to discover.

The Solution

Ran Nmap to enumerate all open services and identify FTP with anonymous access hints. Captured cleartext FTP credentials via Wireshark during a passive traffic capture phase. Used Gobuster to brute-force directory listings and expose an admin panel. Analyzed .bash_history on the compromised account for previously run commands revealing credential reuse. Completed privilege escalation to root via Hydra brute-force on a sudo-enabled account.

Tech Stack

NmapInitial service and port enumeration
WiresharkPlaintext credential capture from FTP traffic
GobusterDirectory brute-force for hidden endpoints
HydraPassword brute-force for privilege escalation
Burp SuiteWeb application interception and parameter analysis

Outcomes

  • ▸Full compromise chain documented: anonymous FTP → SSH → root
  • ▸Plaintext credentials discovered via Wireshark passive capture
  • ▸Privilege escalation achieved through .bash_history analysis and Hydra brute-force
  • ▸Attack narrative and remediation steps delivered in structured report
← Back to all projectsView Artifact ↗