This repository contains a collection of penetration testing labs and reports that I have completed for practice and learning.
The labs cover web application security, network and system exploitation, post-exploitation, and mobile application security.
- Target:
https://ginandjuice.shop - Focus: Black/Grey-box web application penetration testing using Burp Suite.
- Key findings: SQL Injection, HTTP header injection, reflected XSS, client-side template injection, SSRF-like external interaction, vulnerable JS dependencies, missing HSTS, etc.
- Folder:
01-OWASP-Juice-Shop
- Target: Damn Vulnerable Web Application (DVWA) in a local lab environment.
- Focus: Practicing common web vulnerabilities such as SQLi, XSS, command injection, CSRF, and authentication/authorization weaknesses.
- Folder:
02-DVWA
- Target: WebGoat – an intentionally insecure web application by OWASP.
- Focus: Realistic web security scenarios, including injection attacks, access control issues, business logic flaws, and more.
- Folder:
03-WebGoat
- Target: Metasploitable2 vulnerable Linux server.
- Focus: Service enumeration, credential brute forcing, exploitation with Metasploit, privilege escalation to root, persistence, and basic detection avoidance.
- Folder:
04-Metasploitable2-Post-Exploitation
- Target: Android mobile application in a controlled lab environment.
- Focus: Insecure data storage, insecure communication, authentication and authorization issues, reverse engineering, and code tampering.
- Folder:
05-Android-App-Pentest
- Web Pentesting : Burp Suite, OWASP ZAP, browser dev tools
- Network & System : Nmap, Hydra, Metasploit Framework
- Mobile Security : Android Emulator/Device, APKTool, adb, Burp Suite
- Platforms : Linux (Kali, Ubuntu), Windows, Android