PenTest.WS demonstration hacking the Falafel machine from HackTheBox.eu. This video includes using the Shells Library for quick reverse shells. It also demonstrates using the Credentials Database to track usernames and passwords.
2:00 – Global Service Notes
2:43 – SQLMap
6:37 – PHP Magic Hashes
9:40 – WGet Vulnerability
14:30 – Reverse Shell
16:42 – Privilege Escalation
PenTest.WS demonstration hacking the Chatterbox machine from HackTheBox.eu. This video includes using the in-app Exploit-DB utility to search for exploits against a vulnerable aChat service.
00:48 – Multi-Host Scan & Import
03:10 – Additive Scans
04:48 – Engagement Maintenance
06:31 – Nmap Script Library
07:20 – Stored Nmap Scans
07:58 – GSN Export IP & Port
PenTest Workshop demonstration video hacking the Blue machine at HackTheBox.
Note: sorry about the sound quality. A new microphone is on its way.
After nearly a year of development, PenTest.WS is proud to announce the launch of it’s private beta program. This program is currently invitation only. If you would like to join the private beta, please use this form to send an Invitation Code Request.
PenTest.WS has been developed specifically for the penetration tester. This web application has helped at least one pentester achieve the Offensive Security Certified Professional (OSCP) certification. More recently PenTest.WS has been used when attacking machines on the HackTheBox.eu network. Several features have grown organically through this process.
The host discovery & service enumeration processes are now point and click, regardless of where the scan is being conducted from. PenTest.WS uses copy-and-paste to get its commands into the terminal. This means if you can paste it, you can use PenTest.WS’s library of customizable commands to automate these processes.
Importing Nmap’s XML data has been refined and enhanced since initial development began. This process is now more robust and handles a wider array of Nmap versions. The stored XML data is now displayed in an easy to navigate live view rather than a static data dump displayed to the pentester.
While importing Nmap’s data remains a key feature of PenTest.WS, other features have proven to be just as useful. One such feature is the Global Service Notes (GSN). The GSN system is quickly becoming a fan favorite and continues to provide reminders and hints for faster hacking. Additionally, the user defined shell command library now includes more netcat versions and an expanded shell upgrade section.
Perhaps the biggest development over the past twelve months is beginning of a report writing module. Reporting is the deliverable product after conducting a penetration test. It therefor makes sense to include a reporting module in the PenTest.WS web application. Screen captures, code snippets and exploitation instructions can all be included directly into a host’s reporting module.
Future plans for the reporting module include a one-click solution to export these reports into a fully deliverable document at the conclusion of a pentest engagement. This export feature will include a templating engine to provide consistency and branding for the pentester. This feature is being actively developed.
Please drop us a line and let us know if you’re interested in a receiving an Invitation Code.
PenTest Workshop News 