Antonio Vitale - Offensive Security Engineer e Penetration Tester Milano
Benvenuto nel terminale di Antonio Vitale. Sono un Ethical Hacker e Security Researcher specializzato in:
Penetration Testing (Web & Network)
Smart Contract Auditing & Blockchain Security
Python & Linux Hardening
Sviluppo Tool di Sicurezza
Progetti Cybersecurity
nmap2report: Automazione reportistica Pentest da XML Nmap.
QRX-Scanner: Scanner di vulnerabilità mobile per QR Code malevoli.
Misinformation Fight System: Analisi Fake News tramite AI e OSINT.
Smart Contract Fuzzing: Tesi Magistrale sullo sviluppo di fuzzer per Blockchain.
Contatti
Email: vitaleleinfo@gmail.com
LinkedIn: Antonio Vitale
root@vitale-box:~/bin/zsh
ROOT_ACCESS // CHALLENGES[ ESC ]
1. Crypto
2. Network
3. Web SQL
4. Logic
5. Linux
6. Code
7. XSS
8. LFI
Level 1: Basic Encoding
Attackers often hide payloads in Base64. Decode this string to find the flag.
V2VsY29tZVRvVGhlRGZzaWRl
Base64 is an encoding scheme that converts binary data into ASCII characters. It is widely used to obfuscate payloads. In Linux, you can decode it using: echo "string" | base64 -d.
Level 2: Packet Analysis
Analyze the TCP Header Hex Dump. What is the Destination Port (Decimal)?
In a TCP Header, bytes 22 and 23 represent the Destination Port. Hex 00 50 converts to 80 in decimal, which is the standard port for HTTP traffic.
Level 3: SQL Injection
Target Query: SELECT * FROM admin WHERE pass = '$input'
What is the classic "Tautology" payload to make the condition always TRUE?
By inserting ' OR '1'='1, the query becomes WHERE pass = '' OR '1'='1'. Since 1 always equals 1, the database evaluates this as True for every row, effectively bypassing authentication.
Level 4: Reverse Engineering Logic
Calculate the final output of this C snippet.
int main() {
int a = 10; // Binary: 1010
int b = 5; // Binary: 0101
int res = a ^ b; // Bitwise XOR
printf("%d", res + 0xA);
}
1. 1010 XOR 0101 results in 1111 (Decimal: 15).
2. 0xA is Hex for 10.
3. 15 + 10 = 25.
Level 5: Privilege Escalation
You find a binary with these permissions: -rwsr-xr-x.
What does the 's' stand for (acronym), which allows executing it as the owner?
SUID (Set User ID upon execution). When a file with the SUID bit is executed, it runs with the permissions of the file owner (often root), rather than the user who ran it. This is a common vector for Privilege Escalation.
Level 6: Secure Coding
Identify the vulnerability in this Python snippet:
import os
user_input = input("Enter file to read: ")
# User enters: "data.txt; rm -rf /"
os.system("cat " + user_input)
What is the name of this vulnerability? (Two words)
Command Injection. The user input is concatenated directly into a system shell command without sanitization. An attacker can use separators like ; or && to execute arbitrary commands on the OS.
Level 7: Reflected XSS
You see this PHP code. What HTML tag is commonly injected to test for XSS?
The input $_GET['query'] is echoed back to the page without sanitization (like htmlspecialchars). An attacker can inject <script> tags to execute malicious JavaScript in the victim's browser.
Level 8: Path Traversal (LFI)
A website loads files via ?page=about.html. What string sequence is used to traverse up directories (e.g. to reach /etc/passwd)?
The sequence ../ (dot-dot-slash) tells the operating system to move one directory up. By chaining them (e.g., ../../../../etc/passwd), an attacker can escape the web root and access sensitive system files.