Ethical Hacking and Penetration Testing
Intensive offensive security workshop delivered by BugXploit at Koteshwor, Kathmandu. Documenting real-time methodology, reconnaissance workflows, exploitation techniques, and defense counter-measures.
Workshop Session
Select any sessions below to read in-depth reports, command cheat-sheets, and lab findings.
Day 1: Lab Setup, VirtualBox & Nmap Intro
Bugcrowd researcher onboarding, downloading & configuring Metasploitable 2 and Kali Linux 2026.2, network adapter setup, IP discovery, ping verification, and Nmap intro.
Day 2: Service Enumeration, VSFTPD (CVE-2011-2523) & SSH Brute-Force
Port versioning with nmap -sV, browser web recon, triggering vsftpd 2.3.4 backdoor (CVE-2011-2523) root shell on port 6200, Metasploit ssh_login, and legacy RSA SSH login.
Day 3: Active vs Passive Recon & OSINT Tooling
Active vs Passive recon, Bugcrowd Tesla scope analysis, Google Dorking, c99 Subdomainfinder, DNSDumpster, crt.sh, WHOIS, MXToolbox, Emkei spoofing analysis, Wayback Machine, and Shodan IoT search engine.
Day 4: OS Command Injection & Burp Suite CSRF Lab
Command execution on DVWA (192.168.1.1 && ls, pwd, whoami), DVWA security tiers, Burp Suite request modification, GET to POST conversion, anti-CSRF token evasion, and csrfshark.github.io PoC generation.
Day 5: Burp Intruder, SQLMap & XSS Cookie Stealing
Burp Intruder Sniper brute force, automated database takeover via SQLMap (--dbs, -T users --dump), HTML injection, Reflected & Stored XSS, client-side maxlength bypass, and Webhook.site session exfiltration.
Day 6: Nuclei Scanning & GitHub Reconnaissance
ProjectDiscovery Nuclei automated scanning with session cookies, 69 findings triage (CVE-2012-1823 PHP-CGI, Samba 3.0.20, DistCC, default credentials, security headers), GitHub dorking, streaak/keyhacks API validation, iscan.today & TruffleHog.
Day 7: Android Pentest, MobSF & JADX Decompilation
Static vs dynamic analysis, direct downloads for JDK 26 & JADX-GUI, automated SAST audit of DivaApplication.apk via MobSF (Security Score 36/100, Janus flaw, hardcoded pkey, exported components, raw SQLite injection), and manual reverse engineering.
Day 8: PortSwigger Authentication Labs & Reset Poisoning
Username enumeration via response differences, bypassing rate limits via JSON array credential batches, 2FA simple bypass via forced browsing, broken password reset logic, and Host header poisoning via middleware.
Day 9: AI LLM Attacks & Prompt Injection
Exploiting LLM APIs with excessive agency (SQL injection via chatbot), and Indirect Prompt Injection via product reviews to hijack LLM behavior and execute unauthorized API calls on victims.