00:00 - Introduction talking about what the Looney Tunable exploit is and my thoughts on the severity of the exploit02:30 - Start talking about how the vulne...

Ever feel like you’re hacking your way through a dungeon, unlocking secret doors one by one? That’s exactly how it felt during my OSWE prep, especially when I stumbled upon a classic IPPSEC video while working through the retired HTB machine Blocky . Suddenly, I was deep-diving into the world of Java reverse engineering — and discovering just how much a single .jar file can hide. Today, I’ll walk you through how I unraveled Blocky’s secrets using nothing but a few free tools and a hacker’s curiosity. If you’re prepping for the OSWE, love IPPSEC, or want to level up your Java reversing game, this one’s for you. Level 1: Spotting the Java Clue After a quick web enumeration, I spotted something interesting: a couple of  .jar files hanging out on the site. If you’re new to Java, a .jar file is really just a ZIP with a different badge. So, first things first — let’s crack it open. unzip BlockyCore.jar Pro tip: Always peek inside any Java archive you find during a pentest. You never know what’s hidden inside… Level 2: From Bytecode to Human-Readable Code Inside the extracted files, I found the usual suspects: MANIFEST.MF and a mysterious BlockyCore.class. Here’s where the magic starts. Java compiles source code into .class files (bytecode), which aren’t meant to be human-friendly. But with the right tools, you can reverse that process. Meet jad , your new best friend for Java reverse engineering. This tool “decompiles” bytecode back into something readable. jad BlockyCore.class Jad analyzes the bytecode and spits out a best-guess reconstruction of the original Java source — typically as a .jad or .java file. Pro tip: Not every line will be perfect, but even partial code can reveal hardcoded passwords, API keys, or logic flaws. Level 3: Inspecting the Loot Here’s what I found when opening BlockyCore.jad: Compare that to the raw .class binary — pure matrix code for most humans: But wait — what if you’re working with a ton of .class files, or just want a faster way to browse through everything? Level 4: GUI Power-Up — Meet JD-GUI For larger or more complex Java archives, JD-GUI is a lifesaver. It’s a graphical tool that lets you point-and-click through entire .jar files, instantly viewing the decompiled source for every class. Pro tip: Sometimes, the real keys to the kingdom are hidden several classes deep — don’t just stop at the first file! With these credentials, we successfully accessed the target machine via its SSH service. Final Boss: Why This Matters Reverse engineering isn’t just about flexing your technical muscles — it’s about understanding how developers leave behind clues, credentials, and vulnerabilities. On Blocky, that single decompiled file revealed exactly how authentication worked (and, spoiler: it wasn’t as secure as you’d hope). If you’re prepping for the OSWE, make Java reversing part of your toolkit. It’ll help you: Discover hidden logic vulnerabilities Find hardcoded credentials Understand application flow for web exploits Bonus: Try This Yourself! Download any Java-based CTF machine or app. Unzip the  .jar Decompile with jad or browse with  JD-GUI Look for authentication, key generation, or API logic. Share your findings in the comments! If you want to see this technique in action, check out IPPSEC’s legendary video on Blocky. And if you’re hungry for more OSWE stories, follow me for future write-ups and exclusive scripts to automate your own journey. https://medium.com/media/445f6726723f844158e3eb9236811e56/href May your .jar files always unzip — and your payloads always execute. 👾 Padawans, enjoyed this guide? • 👏🏽Clap now or comment which channel you’ll try first —  it helps me craft even better content! • 🔗Share with friends embarking on their cybersecurity journey —  your support means a lot. • 🤝Follow me, Douglas Costa and Infosec-Writeup, for more Red Team wizardry. Ready to start pentesting? Join our beginner group and let your environment shape your success! 👉 Click here to join now OSWE Web Hacking Tips (IPPSEC): Java Reversing #2 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Ace your OSWE exam by mastering key web exploitation techniques. Our weekly series breaks down proven methods directly from IPPSEC’s invaluable YouTube classics. Expect deep dives into SQL Injection, robust file upload bypass tactics, sophisticated polyglot web shells, and the intricacies of magic bytes. Essential, practical insights for ethical hackers and penetration testers serious about OSWE certification. Small Wins Preparing for the OSWE has been nothing short of a marathon  — about three brutal months (and, honestly, probably longer) packed with late nights, laser-like focus, and a constant balancing act between work, university, and everything else life throws at me . If you’ve ever fought through an OffSec course, you know their mantra by heart: “Try Harder.” But it’s more than just a catchy slogan — it’s my daily reality, demanding a level of commitment and resilience I didn’t fully appreciate until now . To be frank, squeezing in study time hasn’t been easy . Most of my day vanishes on those long commutes , and I end up cramming OSWE prep, job tasks, and my university assignments into every spare minute . Writing here on Medium is my passion project , but it also steals whatever free time I manage to carve out. Still, I’m determined to make each of those stolen moments count  — not just for myself, but for anyone else struggling down this same path . So this week, I decided to flip my routine on its head . Instead of letting my commute be wasted time , I started diving into IPPSEC’s OSWE prep videos whenever I had a spare moment on the bus or train . As I watched, I thought, “Why not share the most practical, under-the-radar web exploitation tricks I’m picking up from IPPSEC in a weekly series?” That way, I reinforce my own learning and keep my study sessions efficient  — and I can help fellow “padawans” by putting real, up-to-date web hacking techniques out there . If you’re chasing the OSWE (or you’re just hungry for hands-on web hacking tips), this series is for you . In this first installment, we dive into two powerful web vulnerabilities on the PopCorn  machine: SQL Injection testing via request replay , where we’ll capture and replay a login request with sqlmap to find injection points. Magic Bytes Bypass & Polyglot Web Shell upload , which teaches how to prepend PNG magic bytes to a PHP shell — encoded in Base64 — to bypass file-type checks. If you want to follow along or dive deeper into the same OSWE prep content I’m using, here’s the official OSWE YouTube playlist curated by IPPSEC . These videos have been invaluable for my learning — full of hands-on web exploitation walkthroughs, live debugging, and real-world attack strategies. Curious about launching your career in Offensive Security? Download my free eBook — a practical roadmap for beginners, packed with steps, resources, and tips to help you break into OffSec. 👉 Get your free career roadmap eBook here SQL Injection Testing via Request Replay One of the first things I saw was how IPPSEC approached SQL Injection testing on the login function. Instead of the usual browser-based fuzzing, he used a proxy (in this case, Burp Suite ) to intercept the login request. Here’s the exact process: Intercept the login request with Burp Suite. Burp Suite login Request Copy the full request text and save it as login.req using a simple text editor like vim or nano. (Tip: Make sure to remove any extra spaces between lines for proper formatting.) Request Run the following command to have sqlmap analyze the request for potential SQLi vulnerabilities: sqlmap -r login.reg --level 5 --risk 3 SQLmap will now replay the exact request — like sending a squadron of droids to probe every possible weakness in the Death Star’s defenses — systematically testing for SQL injection flaws at every risk and depth level. Why it matters: This approach is perfect when web forms or APIs use custom headers, tokens, or uncommon methods. By replaying a real intercepted request, you maximize sqlmap’s effectiveness and avoid missing subtle injection points. Have you tried request-based SQL injection testing before? Comment with your go-to tools or favorite tips! Magic Bytes Bypass & Polyglot Web Shell Upload Next up, the classic file upload restriction bypass. The target app allowed image uploads, but immediately rejected any obvious PHP web shell. Here’s the clever workaround: Request png Upload a normal image file via the web form and intercept the upload request in Burp Suite. Examine the request and spot the magic bytes (the file signature bytes that identify it as a PNG). Magic bytes Copy those magic bytes and prepend them to your simple PHP web shell file, so it begins with the same bytes as a valid image. Magic bytes base64 Encode the file in base64 if the application expects it, matching the original upload format. Decode Submit your “polyglot” file — now cleverly disguised, much like a Rebel agent sneaking past Imperial checkpoints with forged credentials — by sending it through the same upload request. “polyglot” file If the system accepts the upload and saves the file, visit the upload directory or trigger the shell to gain remote access. WebShell Why it works: Many web apps only check the file signature (magic bytes), not the entire file content. By combining the right magic bytes with your PHP code, you sneak past the filter and land a working web shell. Quick win: Test this technique on your next file upload target — and always remember to clean up your shells afterward! All of these techniques were demonstrated in IPPSEC’s PopCorn video, linked below for those who want to follow along or see the full walkthrough in action. https://medium.com/media/62198d46effa0c4a2300c7949254e692/href Ready to level up your hacking skills? Join Hack The Box — the ultimate platform to learn penetration testing and cybersecurity hands-on. 👉 Start hacking here and get access to real-world labs, challenges, and career-boosting skills. HTB Account Wrapping Up: From Daily Struggles to Practical Wins Balancing work, university, and the intense OSWE study routine hasn’t been easy. Most days, I find myself squeezing study time into crowded commutes, late nights, or brief moments between tasks. There were times I wondered if all this juggling was even worth it. But diving into these classic IPPSEC videos — right there on the bus or during those quiet, stolen hours — showed me that progress doesn’t have to be flashy. Sometimes, it’s about finding small wins in the middle of chaos: learning a new exploitation technique, solving a tricky challenge, or realizing you understand a concept today that felt impossible last week. Sharing these lessons here on Medium became more than just a way to document my journey — it turned into a way to connect with others walking a similar path. If you’re struggling to fit your own learning into a hectic schedule, know that you’re not alone. We all move at our own pace, and every bit of progress counts. Have you found creative ways to keep learning, even when life gets in the way? Drop your story in the comments, or just say hi — I’d love to hear how you’re making it work. Let’s keep pushing, learning, and supporting each other. The OSWE (and whatever comes next) is tough, but together, it’s a little less lonely. Ready to start pentesting? Join our beginner group and let your environment shape your success! 👉 Click here to join now OSWE Web Hacking Tips (IPPSEC): My Study Journey #1 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

ippsec has released the Wanderer Prep playlist, designed to help users prepare for the Wanderer Pro Lab on Hack The Box. This playlist covers advanced techniques, including SQL Injection bypasses, Android app dynamic analysis, and SetUID exploitation. 🔗 URL: You Should Know: 1. Advanced SQL Injection Bypass Techniques Many web applications use WAFs (Cloudflare) or strict validation (FastAPI + Pydantic).

YouTube video by 0xdf

Trying to run `certipy` over `proxychains` was failing for me. In this video, I'll show how I troubleshot, and what the issues was. We'll cover proxychains, ...

EvilCUPS is all about the recent CUPS exploits that have made a lot of news in September 2024. I’ll abuse the four recent CVEs to get remote code execution on a Linux box through cupsd. In the root step, I’ll find an old print job and recreate the PDF to see it has the root password. In Beyond Root, I’ll look at the PPD file created during the exploit path.

Knock Knock is a Sherlock from HackTheBox that provides a PCAP for a ransomware incident. I’ll find where the attacker uses a password spray to compromise a publicly facing FTP server. In there, the...

YouTube video by IppSec

Ever feel like you’re hacking your way through a dungeon, unlocking secret doors one by one? That’s exactly how it felt during my OSWE…

From Red Team Village’s CTF to Hack The Box, learn how our newest lab created by ippsec became a reality. Let’s dive into some lore.

NAHAMCON 2023June 15 - June 17 2023NahamCon is a free virtual offensive security conference, hosted on Twitch! Hosted By Email Address Sign Up Thank you! @_johnhammond @ippsec @Alh4zr3d CTF Workshops Conference Join Discord June, 15-17 Friday, June 16 Saturday, June 17 Watch Live WORKSHOPSPlease cli…

Come join the Red Team CTF @ DEFCON! We've got an action packed event with an amazing final scenario hand crafted by the infamous Ippsec!