Prajwal's Blog

I was busy making some mini hells for challenges for ISSessions CTF 2025, when I stumbled upon the idea of incorporating shellcode into it while learning about how to create malware (nothing illegal, promise). 

My first challenge as a part of the PMAT course, I have been provided a binary and been asked to analyse it, employing basic static and dynamic analysis methodologies I've learnt.

Very similar to the last lab, however this one focuses on analysis of the reverse shell malware.

The lab instructions are precise and we've got the hashes for the malware this time.

  I start by opening the lab and am made aware that the hashes for the malware weren't provided.

Some application try to prevent SSRF attacks by blacklisting requests containing certain keywords. This could be a good defense if done correctly however if done loosely it could still easily be bypassed.

Login authentication is often plagued with SQL Injection vulnerabilities and thus sanitisation of input from a webpage is all the more important. Such attacks can often lead to compromise of privileged accounts. I load the lab website and navigate to the login page and input the username 'administrator' with a random password:

This lab explores the lack of sanitisation of inputs while retrieving data from a database. This can lead to disclosure of sensitive information to unauthorised individuals and pose serious risk to organisations. I begin by visiting the site and find there are categories filters: