j-info / ctf Goto Github PK

Nice job, Jason!

Lot's o' good step-by-step detail. Here are a few suggestions since I went through most of it. Not sure how deep you wanted me to get, so take what you want out of this!

1. I always like seeing Objectives, but I'd like to know what's in your brain on how you'll Approach too. "I'll start with a simple page source inspection, then peruse a plethora of ports, and ..."
2. Many of the commands show a static IP address, but you may want to state that TryHackMe uses dynamic IP addresses, so something like sudo nmap -sC -sV -A -oN rick.nmap <ipaddress>.
3. For a new viewer, you may want to explain some of the commands. "Next I'll use gobuster to attempt a brute-force attack using the username found in the page source."
4. Show the <username> substitution in the gobuster command since these may vary.
5. Might want to explain how to concatenate the URL with the PHP file, like http://<ipaddress>/login.php.
6. Maybe show the netcat instruction first since the check for Python is to inject a Python-specific IO stream.

Great stuff!

Just remind me to keep my computers locked the next time you're over.