CND
  • CND
    • WHOAMI
    • PROJECTS
      • DEV
        • PERSONAL WEBSITE
        • GITHUB
        • ARDUINO
        • CTFD
      • CYBER
        • PERSONAL CYBER RANGE
    • SELF DEVELOPMENT
      • TRAINING PLATFORMS
      • PREP MATERIALS
        • OPERATOR DEVELOPMENT & INTEGRATION EFFORT (ODIE) ASSESSMENT
        • COMPUTER NETWORK ASSESSMENT BATTERY (CNAB)
        • COMPUTER NETWORK OPERATIONS QUALIFICATION COURSE (CNOQC)
        • COMPUTER NETWORK OPERATIONS DEVELOPMENT PROGRAM (CNODP)
        • DATA ENGINEER
        • CYBER COMMON TECHNICAL CORE (CCTC)
      • WRITEUPS/WALKTHROUGHS
        • HTB ACADEMY
          • 01.BUG BOUNTY HUNTER
          • 02.PENETRATION TESTER
        • HTB LABS
          • STARTING POINT
            • TIER 0
              • 01.MEOW (TELNET)
              • 02.FAWN (FTP)
              • 03.DANCING (SMB)
              • 04.REDEEMER (REDIS DB)
              • 05.EXPLOSION (RDP)
              • 06.PREIGNITION (WEB FORM LOGIN)
              • 07.MONGOD (MONGODB)
              • 08.SYNCED (RSYNC)
            • TIER 1
              • 01.APPOINTMENT (SQL INJECTION)
              • 02.SEQUEL (MYSQL)
              • 03.CROCODILE (FTP & WEB FORM LOGIN)
              • 04.RESPONDER (RFI, NTLM CAPTURE, PW CRACKING & WINRM)
              • 05.THREE (AWS S3 BUCKET)
              • 06.IGNITION (DIRECTORY ENUMERATION & BRUTE FORCE)
              • 07.BIKE (SSTI)
              • 08.FUNNEL (PASSWORD SPRAYING & LOCAL PORT FORWARDING)
              • 09.PENNYWORTH (GROOVY SCRIPTING & REVERSE SHELL)
              • 10.TACTICS (SMB)
            • TIER 2
              • 01.ARCHETYPE (PRIVESC & MSSQL SERVER)
              • 02.OOPSIE
              • 03.VACCINE
              • 04.UNIFIED
              • 04.INCLUDED
        • THM
          • ADVENT OF CYBER
            • 2024
            • 2023
            • 2022
          • SOC LEVEL 1
            • PRACTICAL EXERCISES
              • NETWORK SECURITY & TRAFFIC ANALYSIS
                • SNORT
                • NETWORK MINER
                • ZEEK
                • BRIM
                • WIRESHARK: BASICS
                • WIRESHARK: PACKET OPERATIONS
                • WIRESHARK: TRAFFIC ANALYSIS
                • TSHARK: THE BASICS
                • TSHARK: CLI WIRESHARK FEATURES
              • ENDPOINT SECURITY MONITORING
                • INTRO TO ENDPOINT SECURITY
            • SKILLS ASSESSMENT
              • NETWORK SECURITY & TRAFFIC ANALYSIS
                • SNORT CHALLENGE (BASICS)
                • SNORT CHALLENGE (LIVE ATTACKS)
                • ZEEK EXERCISES
                • TSHARK CHALLENGE I: TEAMWORK
                • TSHARK CHALLENGE II: DIRECTORY
              • ENDPOINT SECURITY MONITORING
        • HOLIDAY HACK CHALLENGE (SANS)
          • 2024:SNOW-MAGGEDON
      • PROVING GROUNDS
        • ADVENT OF CYBER: SIDE QUEST (THM)
          • 2024
        • CMU
        • CYBER FLAG
        • PRESIDENT'S CUP
        • MEC-T
      • COLLEGE
        • 03.DAKOTA STATE UNIVERSITY (DSU)
          • 2025
            • 01.CSC428: REVERSE ENGINEERING
          • 2024
            • 01.CSC314: ASSEMBLY LANGUAGE
            • 02.CSC300: DATA STRUCTURES
              • 01.C++ OVERVIEW: CLASSES & DATA ABSTRACTION
              • 02.OBJECT ORIENTED DESIGN & C++
              • 03.POINTERS
              • 04.ARRAY-BASED LIST
              • 05.LINKED LISTS
              • 06.DOUBLY LINKED LIST
              • 07.STACKS
              • 08.QUEUES
              • 09.BINARY TREES
          • 2023
            • 01.CSC250: COMPUTER SCIENCE II
            • 02.CSC334: WEB DEVELOPMENT
            • 03.MATH201: INTRODUCTION TO DISCRETE MATHEMATICS
        • 02.UNIVERSITY OF ARIZONA (UA)
        • 01.TECHNICAL COLLEGE OF THE LOWCOUNTRY
      • NOTES
  • PLAYBOOK
    • DCO
      • 01.PRE-ENGAGEMENT
        • 01.PDSS
      • 02.ENGAGEMENT
        • PLAN
          • 01.ROE
        • PREPARE
          • 01.CTI
          • 02.DETECTION ENGINEERING
        • EXECUTE
          • THREAT HUNTING
            • 01.TRAFFIC ANALYSIS
              • LOW-HANGING FRUIT
                • HOST IDENTIFICATION
                  • WIRESHARK
                  • TSHARK
                • CLEARTEXT CREDENTIALS
                  • WIRESHARK
                • CLEARTEXT PROTOCOLS
                  • WIRESHARK
                    • FTP ANALYSIS
                    • HTTP ANALYSIS
                    • LOG4J ANALYSIS
                • DNS QUERIES
                  • TSHARK
                • USER-AGENTS
                  • TSHARK
              • PORT SCANS
                • WIRESHARK
                • KIBANA
                • SPLUNK
              • ARP POISONING
                • WIRESHARK
              • TUNNELING (DNS/ICP)
                • WIRESHARK
                  • ICMP TUNNELING
                  • DNS TUNNELING
              • ENCRYPTED PROTOCOLS
                • WIRESHARK
                  • HTTPS ANALYSIS
                    • SNI INSPECTION
                    • ENCRYPTION KEY LOG FILE
            • 02.LOG ANALYSIS
          • INCIDENT RESPONSE
            • 01.PREPARATION
            • 02.IDENTIFICATION
            • 03.CONTAINMENT
            • 04.ERADICATION
            • 05.RECOVERY
            • 06.LESSONS LEARNED
          • FORENSICS
            • MALWARE ANALYSIS
            • REVERSE ENGINEERING
        • ASSESS
      • 03.POST ENGAGEMENT
        • DEBRIEF
        • DOCUMENTATION
          • MISSION DEFENSE PLAN/RISK MITIGATION PLAN
    • OCO
      • 01.PRE-ENGAGEMENT
        • 01.PDSS
        • 02.ROE
        • 03.RESOURCE DEVELOPMENT
          • 01.INFRASTRUCTURE DEVELOPMENT
          • 02.MALWARE DEVELOPMENT
          • 03.EXPLOIT DEVELOPMENT
      • 02.ENGAGEMENT
        • 01.IN
          • 01.PRE-ACCESS
            • 01.VPN CONNECTION
            • 02.ANALYST LOGGING
            • 03.OPNOTES
          • 02.ACCESS
            • RECONNAISSANCE (EXTERNAL)
              • RECONNAISSANCE (PASSIVE)
                • OSINT
              • RECONNAISSANCE (ACTIVE)
                • WEB
                  • SUBDOMAIN ENUMERATION
                    • CURL
                  • SUBDOMAIN BRUTE-FORCING
                    • DNSENUM
                  • DNS ZONE TRANSFER
                    • DIG
                  • DIRECTORY ENUMERATION
                    • CURL
                  • PROFILING/FINGERPRINTING
                    • WAFWOOF
                    • WHATWEB
                    • WAPPALYZER
                  • FUZZING
                    • 01.SUBDOMAIN FUZZING
                      • FFUF
                    • 02.VIRTUAL HOSTS FUZZING
                      • GOBUSTER
                      • FFUF
                    • 03.DIRECTORY FUZZING
                      • FFUF
                    • 04.PAGE FUZZING
                      • FFUF
                      • GOBUSTER
                    • 05.PARAMETER FUZZING
                      • FFUF
                    • 06.VALUE FUZZING
                      • FFUF
                  • USER ENUMERATION
                    • WEB LOGIN FORM
                  • SPIDERING/WEB CRAWLING
            • VULNERABILITY SCANNING
              • WEB
                • NIKTO
            • WEAPONIZATION
              • OBFUSCATION
                • JAVASCRIPT
              • SHELLCODES
              • PASSWORDS/PINS
                • PINS
                • DICTIONARY
                • CUSTOM WORDLIST
                  • USERNAMES
                  • PASSWORDS
              • TROJANS
                • TROJAN BACKDOOR
              • MALICIOUS DOCUMENTS
                • MACRO EMBEDDING DOCX
              • SCRIPTS
                • WEB SHELLS
                  • PHP
                • REVERSE SHELLS
                  • BASH
                  • GROOVY (JENKINS)
                • ENUMERATION
                  • PYTHON
                    • PARAM-FUZZER.PY
                  • BASH
                • WSDL
                  • SQLI
                  • CMD INJECTION
            • DELIVERY
              • SOCIAL ENGINEERING
              • WATERING HOLE
              • SUPPLY CHAIN
            • EXPLOITATION
              • TYPE
                • INJECTIONS
                  • CLIENT-SIDE
                    • CROSS-SITE SCRIPTING (XSS)
                      • XSS DISCOVERY
                        • XSS TESTING (MANUAL)
                        • XSS TESTING (HYBRID)
                      • WEBPAGE DEFACEMENT
                      • XSS PHISHING
                      • XSS SESSION HIJACKING (AKA COOKIE STEALING)
                        • BASIC XSS TESTS
                        • OBTAINING SESSION COOKIES (PHP SERVER)
                        • OBTAINING SESSION COOKIES (NETCAT SERVER)
                    • SQL INJECTION (SQLI)
                      • 01.SQLI DISCOVERY
                        • 01.SQLI TESTING (MANUAL)
                          • URL PARAMETER METHOD
                          • LOGIN FORMS
                        • 01.SQLI TESTING (HYBRID)
                          • SQLMAP
                        • 02.SQLI LOCATION IDENTIFICATION
                      • 02.SQLI DB ENUMERATION
                      • AUTHENTICATION BYPASS
                      • CREDENTIAL DUMPING
                      • SQLI READING FILES
                      • SQLI WRITING WEB SHELL FILES
                    • COMMAND INJECTION
                      • 01.DISCOVERY
                      • FILTER EVASION/BYPASS
                        • FRONT-END VALIDATION: CUSTOMIZED HTTP REQUEST
                        • SPACE & NEW LINE CHARACTERS
                        • SLASH & BACKSLASH
                        • BLACKLISTED CHARACTERS
                        • BLACKLISTED CMDS
                        • ADVANCED CMD OBFUSCATION
                      • EVASION TOOLS
                    • HTML INJECTION
                    • XML EXTERNAL EXTITY (XXE)
                      • DISCOVERY
                      • INFORMATION DISCLOSURE
                      • INFORMATION TAMPERING
                        • RCE
                      • EXFILTRATION
                        • OOB BLIND DATA EXFIL
                          • XXEINJECTOR (AUTOMATED)
                      • IMPACT
                        • DOS
                    • CROSS-SITE REQUEST FORGERY (CSRF/XSRF)
                      • DISCOVERY
                      • CSRF BYPASS
                      • TRIGGERS
                        • W/O ANTI-CSRF TOKEN
                        • WITH ANTI-CSRF TOKEN (GET METHOD)
                        • WITH ANTI-CSRF TOKEN (POST METHOD)
                        • CHAINING (XSS & CSRF)
                          • MAKING PROFILE PUBLIC
                          • ADDING A FUNCTION TO THE PROFILE PAGE
                        • WEAK CSRF TOKENS
                  • SERVER-SIDE
                    • SSRF
                      • 01.DISCOVERY
                        • BLIND SSRF
                      • ENUMERATION
                      • LFI
                    • SSTI
                      • IDENTIFICATION
                      • JINJA (EXPLOITATION)
                      • TWIG (EXPLOITATION)
                      • HANDLEBARS NODEJS (EXPLOITATION)
                        • PAYLOAD
                    • SSI INJECTION
                      • SSI (EXPLOITATION)
                    • XSLT INJECTION
                      • IDENTIFICATION
                      • XSLT INJECTION (EXPLOITATION)
                • FILE UPLOADS
                  • 01.DISCOVERY
                  • FILTER EVASION/BYPASS
                    • CLIENT-SIDE VALIDATION
                      • BACK-END REQUEST MODIFICATION
                      • DISABLING FRONT-END VALIDATION
                    • BACK-END VALIDATION
                      • BLACKLIST EXTENSION FILTERS
                      • WHITELIST EXTENSION FILTERS
                      • CONTENT TYPE FILTER
                  • UPLOAD EXPLOITATION
                    • WEB SHELL
                      • CUSTOM WEB SHELLS
                        • PHP WEB SHELL
                        • .NET WEB SHELL
                        • HTML FORM SHELL
                    • REVERSE SHELLS
                      • CUSTOM REVERSE SHELLS
                    • LIMITED FILE UPLOADS
                      • EMBEDDED JAVASCRIPT (XSS)
                      • XML EXTERNAL ENTITY (XXE)
                    • TFTP
                  • ARBITRARY FILE UPLOAD
                • BRUTE FORCE
                  • WEB
                    • BASIC HTTP AUTHENTICATION
                    • WEB LOGIN FORMS
                      • HYDRA
                      • FFUF
                    • PASSWORD RESET: TOKENS
                    • 2FA
                    • LOW-HANGING FRUIT
                      • EMPTY/DEFAULT PWS
                      • DEFAULT CREDENTIALS
                    • PASSWORD RESET: SECURITY QUESTIONS
                    • PIN CRACKING
                    • SESSION TOKENS
                      • IDENTIFICATION
                      • TAMPERING/FORGING SESSION TOKENS
                  • EXPOSED SERVICES
                    • SSH
                    • FTP
                    • RDP
                    • SMB
                  • PASSWORD CRACKING (OFFLINE)
                    • HASH IDENTIFICATION
                    • JOHN THE RIPPER
                    • HASHCAT
                • AUTHENTICATION BYPASS
                  • DIRECT ACCESS
                  • PARAMETER MODIFICATION
                  • HTTP VERB TAMPERING
                    • INSECURE CONFIGURATION
                    • INSECURE CODING
                  • SESSION ATTACKS
                    • SESSION HIJACKING
                    • SESSION FIXATION
                      • DISCOVERY
                • WI-FI
                  • WPA/WPA2 CRACKING
                • IDOR
                  • IDENTIFICATION
                  • INFORMATION DISCLOSURE
                    • PLAINTEXT REFERENCES
                    • PARAMETER MANIPULATION & COOKIE TAMPERING
                    • ENCODED REFERENCES
                  • INFORMATION ALTERATION
                    • INSECURE FUNCTION CALLS
                • FILE INCLUSION
                  • LFI
                    • DISCOVERY
                      • FUZZING FOR LFI PAYLOADS (AUTOMATED)
                        • EXTRA PAYLOADS
                    • BASIC BYPASSES
                    • SOURCE CODE DISCLOSURE
                    • RCE
                      • FILE UPLOADS
                      • LOG FILE POISONING
                        • PHP SESSION POISONING
                        • SERVER LOG POISONING
                  • RFI
                    • DISCOVERY
                    • RCE
                • OPEN REDIRECT
                  • DISCOVERY
                  • CREDENTIAL THEFT
              • CVE
            • DEFENSE EVASION
            • FOOTHOLD
              • RECONNAISSANCE (INTERNAL)
                • HOST DISCOVERY
              • ENUMERATION
                • SERVICES
                  • SMB
                  • MS SQL
                • WINPEAS
              • PERSISTENCE
              • COMMAND & CONTROL
                • REVERSE SHELLS
                  • PHP
        • 02.THROUGH
          • NETWORK PIVOTING
            • MITM (POST-EXPLOITATION)
              • SESSION HIJACKING
            • PORT FORWARDING
              • LOCAL PORT FORWARDING
          • DISCOVERY
          • PRIVILEGE ESCALATION
            • PSEXEC.PY
            • HARDCODED CREDENTIALS
            • MISCONFIGURATIONS
              • SETUID
            • VI
          • EXECUTION
          • CREDENTIAL ACCESS
            • SESSION HIJACKING
            • PASSWORD CRACKING
              • JOHN THE RIPPER
                • CRACKING ENCRYPTED FILES (ZIP)
                • CRACKING ENCRYPTED FILES (PDF)
              • HASHCAT
                • CRACKING MD5 HASHES
          • LATERAL MOVEMENT
        • 03.OUT
          • COLLECTION
          • EXFILTRATION
            • SCP
          • IMPACT
            • DOS
              • XXE PAYLOAD DOS
              • DECOMPRESSION BOMB
              • PIXEL FLOOD
              • REDOS
                • DISCOVERY
            • TIMING ATTACKS
              • RACE CONDITIONS
            • MITM
              • WEBSOCKETS
          • OBJECTIVES
      • 03.POST-ENGAGEMENT
        • ARTIFACTS CLEARING
        • DEBRIEF
        • INFRASTRUCTURE RESET
        • DOCUMENTATION
          • REPORT
    • DEV
    • SRE
      • REVERSE ENGINEERING
        • ANALYSIS
          • 01.REBASING: IDENTIFYING BASE ADDRESS (IF REQUIRED)
          • 02.IDENTIFYING MAIN() IN STRIPPED BINARIES
          • 03.IDENTIFYING GLOBAL VARIABLES
          • C CODE CONSTRUCTS IN ASSEMBLY
            • GLOBAL & LOCAL VARIABLES
            • ARITHMETIC OPERATIONS
            • FUNCTION CALLS
            • ARRAYS
            • STRUCTS
            • LINKED-LIST TRAVERSAL
            • FLOW CONTROL
              • IF STATEMENTS
              • SWITCH STATEMENTS
              • LOOPS
        • STRING PATCHING
        • BINARY PATCHING
        • STACK MAPPING
      • ANTI-DEBUGGING
      • SOFTWARE EXPLOITATION
        • STACK REDIRECTION
        • SHELLCODE
        • DISASSEMBLER/GHIDRA SCRIPTING
        • FORMAT STRINGS
        • ENVIRONMENT VARS
        • BUFFER OVERFLOWS
          • DISABLING ASLR (LINUX)
        • VULNERABLE C FUNCTIONS
  • ENGINEERING
    • INSTALLATION PROCEDURES
      • TARGETS
        • DVWA
        • VULNHUB
    • CONFIGURATION PROCEDURES
      • WEB
        • BASIC HTTP AUTHENTICATION
        • CSRF PROTECTED FORM
      • NETWORKING
        • CISCO SWITCH
          • VLAN TRUNKS
          • PORT SECURITY
        • CISCO ROUTER
  • SYSTEM ADMINISTRATION
    • LINUX
      • NETWORKING
        • RESTART NETWORK SERVICES
        • LOCAL DNS RESOLUTION
      • LOCATING
      • FILE SHARING
      • PACKAGES
        • NORDVPN
    • WINDOWS
      • DISK PARTITIONING
        • DISKPART
      • ACTIVE DIRECTORY
        • PASSWORD
        • DOMAIN USER
      • OPEN SSH
        • PRIVATE KEY PERMISSIONS
      • LOCAL DNS RESOLUTION
  • TOOLING
    • DCO
      • CYBER THREAT INTELLIGENCE (CTI)
        • OPENCTI
        • MALWARE INFORMATION SHARING PLATFORM (MISP)
      • DETECTION ENGINEERING
        • HOST
          • NETWORK MINER
        • NETWORK
          • SNORT
            • SELF-TEST MODE
            • SNIFFER MODE
            • PACKET LOGGER MODE
            • IDS/IPS MODE
            • PCAP READING MODE
            • RULE WRITING
              • SAMPLE RULES
              • MAGIC NUMBERS
      • THREAT HUNTING
        • NETWORK ANALYSIS
          • IDS/IPS
            • SNORT
            • SURICATA
          • PACKET ANALYZER
            • WIRESHARK
              • MERGING PCAPS
              • FINDING SPECIFIC STRINGS/PACKETS
              • EXPORTING PACKETS
              • EXPORTING OBJECTS
              • CREATING PROFILES
              • BOOKMARKING FILTERS
              • PACKET FILTERING
                • OPERATORS & FUNCTIONS
                • PROTOCOL FILTERS
                  • IP FILTERS
                  • TCP/UDP FILTERS
                  • APPLICATION FILTERS
                • FILTER BUILDER
              • CREATING FW RULES
            • TSHARK
              • SNIFFING TRAFFIC
                • CAPTURE FILTERS
              • READING CAPTURE FILE
                • DISPLAY FILTERS
                • OUTPUT FORMAT SELECTOR
              • FOLLOWING DATA STREAMS
              • EXTRACTING DATA
              • PACKET FILTERING
                • DISPLAYING PACKET STATISTICS
                • ADVANCED FILTERING
            • TCPDUMP
              • EXTRACTING INFORMATION
          • SIEM
            • ELASTIC STACK
            • SECURITY ONION
            • SPLUNK
          • NSM
            • ZEEK
              • MODES
              • LOGS
              • SIGNATURES
                • HTTP CLEARTEXT PASSWORD DETECTION
                • FTP BRUTE FORCE DETECTION
              • SCRIPTING
              • EVENT CORRELATION
              • FRAMEWORK
                • FILE FRAMEWORK | HASHES
                • FILE FRAMEWORK | EXTRACT FILES
                • NOTICE FRAMEWORK | INTELLIGENCE
                • CLEARTEXT SUBMISSION OF PWDS
                • GEO-LOCATION DATA
              • PACKAGES
        • HOST ANALYSIS
          • YARA
          • FLOSS
          • BRIM
            • QUERIES
            • QUERY REFERENCE
          • SYSINTERNALS
            • TCPVIEW
            • PROCESS EXPLORER
            • SYSMON
          • POWERSHELL
          • WINDOWS EVENT LOGS
          • OSQUERY
          • EDR
            • WAZUH
      • DFIR
        • EXIFTOOL
        • NETWORK FORENSICS
          • NETWORK MINER
      • ATOMIC RED TEAM
      • UTILITIES
        • JQ
      • REVERSE ENGINEERING
        • DISASSEMBLERS
          • RADARE2
          • GHIDRA
          • IDA PRO
          • BINARY NINJA
          • CUTTER
          • HOPPER
        • DEBUGGERS
          • GDB/GEF
          • GEF
          • X64DBG
          • WINDBG
    • OCO
      • C2
        • COBALT STRIKE
        • SLIVER
        • MYTHIC C2
          • INSTALLATION
            • ON-PREMISE
            • AWS EC2
            • AZURE
          • C2 PROFILES
            • HTTP
          • AGENTS
            • WINDOWS
          • PAYLOAD CREATION
            • AWS CLOUDFRONT IMPLEMENTATION
            • AZURE FRONT DOOR IMPLEMENTATION
            • NGINX CONDITIONAL REDIRECTION IMPLEMENTATION
        • MITRE CALDERA
          • ON-PREMISE
        • HAVOC C2
        • METASPLOIT
      • VPS
        • REDIRECTORS
          • AWS CLOUDFRONT
            • LOAD BALANCER (AWS EC2)
            • CLOUDFRONT
              • GEO RESTRICTION (OPSEC)
          • AZURE FRONT DOOR
            • FRONT DOOR
          • NGINX (AWS EC2/AZURE)
            • C2 AGENT/USER-AGENT CONDITIONAL REDIRECTION (OPSEC)
              • NGINX FW RULE
              • C2 SERVER FW RULE
            • DIRECTORY REDIRECTION (OPSEC)
          • NGINX (ON-PREMISE)
        • PAYLOAD SERVER
          • NGINX (AWS EC2/AZURE)
            • FW RULES
            • CONFIGURATION
              • FACADE FILES
          • PWNDROP
        • PHISHING SERVER
          • EVILGINX (AWS EC2/AZURE)
            • FW RULES
            • HOMOGRAPHS
            • TRIGGERS
              • CREDENTIAL HARVESTING
              • MFA BYPASS
          • GOPHISH
            • FW RULES
            • CONFIGURATION
            • CAMPAIGNS
            • TRIGGERS
              • MALICIOUS DOWNLOADS
      • WIFI
        • ALFA AWUS1900 WIRELESS ADAPTER
          • DRIVERS
      • OSINT
        • FINAL RECON
        • RECON-NG
        • THE HARVESTER
        • SPIDERFOOT
        • OSINT FRAMEWORK
      • UTILITIES
        • BROWSER DEVTOOLS
        • CADAVER
        • CURL
        • CUSTOM WORDLIST
          • USERNAME ANARCHY
          • CUPP
        • DATABASE
          • MYSQL
          • PSQL
        • DIG
        • DNSENUM
        • FIND
        • FTP
        • HTML2TEXT
        • IMPACKET
          • PSEXEC.PY
          • MSSQLCLIENT.PY
        • MULTI-FUNCTION
        • NETCAT
        • NMAP
        • PASSWORD
          • BRUTE FORCE (ONLINE)
            • HYDRA
            • MEDUSA
            • FFUF
            • CRACKMAPEXEC (SMB)
          • CRACKING (OFFLINE)
            • HASH-ID.PY
            • HASHID
            • JOHN THE RIPPER
            • HASHCAT
        • PRIVESC
          • WINPEAS
        • PROXIES
          • WRAPPER
            • PROXYCHAINS
          • WEB PROXIES
            • BURP SUITE
              • SETTINGS
              • WEB CRAWLING
            • ZED ATTACK PROXY (ZAP)
          • BROWSER PROXIES
            • FIREFOX
            • EXTENSIONS
              • FOXY PROXY
              • PROXY SWITCHYOMEGA (BRAVE BROWSER)
        • REMOTE ACCESS
          • FREERDP
        • RESPONDER
        • RSYNC
        • SCRIPT
        • SMBCLIENT
        • SQLMAP
          • GET REQUESTS
          • POST REQUESTS
          • BYPASSING WEBAPP PROTECTIONS
            • TAMPER SCRIPTS
          • OS EXPLOITATION
          • SQLI
            • CMD INJECTION
        • SSH
        • SSTIMAP
        • TEE
        • TREE
        • WEB CONTENT DISCOVERY
          • GOBUSTER
          • DIRB
        • WGET
        • WPSCAN
      • TECHNOLOGY PROFILER
        • WAPPALYZER
  • RESOURCES
    • ARMY
      • 350-1
      • CAC PKI CERTIFICATES RECOVERY
      • FORCE MANAGEMENT
      • DEFENSE ACQUISITION TRAININGS
      • CAREER MANAGEMENT
      • COLLECTION
        • MISC
        • COMMANDS
        • TRAINING
      • MILITARY RETIREMENT
        • CHECKLIST
        • RESUME
    • CYBER
      • DCO
        • CYBER THREAT EMULATION
        • SYSTEM HARDENING
        • MALWARE ANALYSIS
          • MALWARE BAZAAR
          • MALWARE TRAFFIC ANALYSIS.NET
          • THE ZOO (AKA MALWARE DB)
        • THREAT HUNTING
          • MITRE ATT&CK
          • MITRE CAR
          • MITRE D3FEND
          • MITRE ENGAGE
          • MITRE ENGENUITY
          • ULTIMATE WINDOWS SECURITY
          • TECHNIQUE INTERFACE ENGINE
      • OCO
        • NETWORK PIVOTING
          • THE CYBER PLUMBER'S LAB GUIDE
        • BUG BOUNTY PROGRAMS
        • LIVING OFF THE LAND
          • LOLBAS (WINDOWS)
          • GTFOBINS (UNIX)
          • LOLDRIVERS (WINDOWS)
          • LOLAPPS
        • RECONNAISSANCE
          • WAYBACK MACHINE
          • SHODAN
          • CENSYS
        • VULNERABILITY/EXPLOIT LISTINGS
          • EXPLOIT DB
          • VULNERABILITY LAB
      • OT
        • ICS/SCADA
      • GENERAL
        • GENERATIVE AI/COPILOT
          • CAMOGPT
          • CHATGPT
          • PENTESTGPT
        • UNIFIED KILLCHAIN (UKC)
        • BLOGS
    • AUDIO
Powered by GitBook
On this page

Last updated 10 hours ago

Rebasing ensures that code in reverse engineering tools like Ghidra matches its actual runtime memory layout. This prevents misaligned addresses, broken references, and incorrect analysis results. It enables accurate disassembly, direct correlation with debugger or crash log addresses, and is crucial for tasks like exploit development and malware analysis. Rebasing also avoids redundant work if the correct base address is identified later.

  1. Accurate Disassembly: without the right base address, all code and data references will be misaligned. This leads to broken function pointers, incorrect jump/call targets, and misleading cross-references.

  2. Match Runtime Addresses: analysis of memory dump, debugger output, or logs from a system (e.g. 0x401234 seen in a crash trace), enables the ability to correlate those addresses to functions in Ghidra without manual translation. If Ghidra is loaded at a wrong base, an address of 0x401234 might appear as something like 0x00401234 - 0x1000 = 0x00400234 which requires constant manual math calculations.

  3. Exploit Development / Reverse Engineering: Exploit writers often need to reference exact instruction addresses (e.g., ROP gadgets). Malware analysts rely on real virtual addresses when correlating instructions to logs, behaviors, or indicators of compromise (IOCs).

  4. Avoids Rework: analyzing a binary at the wrong base, and later get the correct base (from a debugger trace), the analyst might have to either redo the work or rebase the whole analysis.

STEP 1: WINDBG

STEP 2: GHIDRA

Ghidra must be set to the same "base address" found by WinDBG. When the interesting code parts are found and identified, no address translation will be required, as the addresses in WinDBG and Ghidra will match.

PS C:\sre> WinDBG
 ...

WinDBG > File > Open Executable > anti-debug.exe

//step 1: list the modules and identify the "base address" of the anti-debug program
WinDBG > Command
 0:000> lm
 Start          End          module_name
 00c00000       00c6b000     anti_debug   (deferred)
 76a70000       76b60000     KERNEL32     (deferred)
 770f0000       7730c000     KERNELBASE   (deferred)
 77320000       774c4000     ntdll        (pdb symbols)     c:\ProgramData\dbg\sym\wntdll.

 * ghidra will be set to the same "base address" found by WinDBG
    - Base Address: 00c00000
PS C:\sre> ghidra
 ...
 
Ghidra > File > Open > anti-debug.exe > Open in Code Browser
 Analyze: Yes
 Options: Default

Ghidra > Memory Map > Home Icon
 Base Image Address: 00c00000
 
 * ghidra's default base address is 00400000
  1. PLAYBOOK
  2. SRE
  3. REVERSE ENGINEERING
  4. ANALYSIS

01.REBASING: IDENTIFYING BASE ADDRESS (IF REQUIRED)

PreviousANALYSISNext02.IDENTIFYING MAIN() IN STRIPPED BINARIES
  • STEP 1: WINDBG
  • STEP 2: GHIDRA