Important Notice: This project and its contents are for educational and ethical security testing purposes only. The target application,
CyberStepsVuln, is a deliberately vulnerable environment hosted within an isolated virtual network. The author assumes no liability for any misuse of this information, unauthorized access to systems, or damages resulting from the use of these materials. Always ensure you have explicit, written permission before testing any system you do not own.
Project Context: This repository documents hands‑on cybersecurity practice and active vulnerability hunting. It simulates the exact type of assessment and professional reporting delivered by real‑world penetration testers to enterprise clients.
The objective of this project was to conduct a continuous penetration test against a deliberately vulnerable web application called CyberStepsVuln. Rather than waiting until the end of a training module, the assessment was performed dynamically – vulnerabilities were hunted and exploited immediately after they were identified during live analysis sessions.
The final deliverable is a professional‑grade penetration testing report created with SysReptor, designed to demonstrate the ability to uncover critical flaws and communicate them effectively to both technical and executive stakeholders.
- Target: A deliberately vulnerable Ubuntu 20.04 virtual machine hosting the CyberStepsVuln application, running inside VMware Workstation.
- Attacker: A Kali Linux virtual machine on the same VMware host, configured on an identical virtual network subnet (
/24). - Connectivity: Both VMs communicate directly over a private virtual network (e.g.,
vmnet), simulating an internal network assessment with full TCP reachability to all target services.
During the assessment of the CyberStepsVuln application and its underlying infrastructure, the following vulnerabilities were successfully identified, analysed, and exploited:
- Network & Infrastructure Weaknesses: Insecure NFS export leading to unauthorised file access and credential leakage.
- Injection Flaws: Error‑based and UNION‑based SQL Injection (SQLi), XML External Entity (XXE) Injection.
- Authentication & Session Control: Broken authentication (unauthenticated password change), client‑side authentication bypass, sensitive data in GET request parameters.
- File & Server Manipulation: Local File Inclusion (LFI), Server‑Side Request Forgery (SSRF) including
file://scheme abuse. - Privilege Escalation: SUID binary exploitation to escalate from unprivileged user to root.
- Cleartext Credential Storage: Plain‑text passwords and hardcoded database credentials found in exposed files and source code.
- Cross‑Site Request Forgery (CSRF): Missing anti‑CSRF tokens on password change endpoint.
Note: While a WordPress instance was discovered, no specific vulnerabilities were exploited in it during this assessment; it is identified as a potential additional attack surface.
- Continuous Vulnerability Logging: Findings were documented incrementally throughout the active assessment, mirroring a real engagement lifecycle.
- Executive & Technical Reporting: All findings were compiled into a structured report using SysReptor, complete with CVSS 3.1 scoring, detailed Proof of Concept steps, and remediation guidance.
- Real‑World Application: Applied industry‑standard methodologies (black‑box testing, manual and automated analysis, exploitation and post‑exploitation) to bridge the gap between theoretical knowledge and defensive/offensive capabilities.
The assessment followed a black‑box approach, using tools such as:
- RustScan / Nmap for service discovery.
- Burp Suite Community for manual web application testing.
- sqlmap for automated SQL injection exploitation.
- curl, ssh, gpg and common Unix utilities for exploitation and credential handling.
- Feroxbuster for directory enumeration.
All testing was performed in an isolated lab environment against 10.10.10.10.