IAmMasterCraft

[IAmMasterCraft @BOmoakin]

Guess what? I finally got that portfolio up and running today!

https://t.co/TDoZTQyiuR

[IAmMasterCraft @BOmoakin]

@grandbusta Dopamine driven development? 🫣

[TryHackMe @tryhackme]

🚨 We’re giving away $1 MILLION in PT1 certs! 🚨

If you hold an eJPT, PJPT, or OSCP, apply now to be 1 of 3300 people to access TryHackMe’s PT1 certification!

📅 May 27–30 2025 only
🎯 Limited to 3,300 winners

👉Apply today! https://t.co/zjimgxGjg🚨 We’re giving away $1 MILLION in PT1 certs! 🚨

If you hold an eJPT, PJPT, or OSCP, apply now to be 1 of 3300 people to access TryHackMe’s PT1 certification!

📅 May 27–30 2025 only
🎯 Limited to 3,300 winners

👉Apply today! https://t.co/zjimgxGjg🚨 We’re giving away $1 MILLION in PT1 certs! 🚨

If you hold an eJPT, PJPT, or OSCP, apply now to be 1 of 3300 people to access TryHackMe’s PT1 certification!

📅 May 27–30 2025 only
🎯 Limited to 3,300 winners

👉Apply today! https://t.co/zjimgxGjg🚨 We’re giving away $1 MILLION in PT1 certs! 🚨

If you hold an eJPT, PJPT, or OSCP, apply now to be 1 of 3300 people to access TryHackMe’s PT1 certification!

📅 May 27–30 2025 only
🎯 Limited to 3,300 winners

👉Apply today! https://t.co/zjimgxGjg🚨 We’re giving away $1 MILLION in PT1 certs! 🚨

If you hold an eJPT, PJPT, or OSCP, apply now to be 1 of 3300 people to access TryHackMe’s PT1 certification!

📅 May 27–30 2025 only
🎯 Limited to 3,300 winners

👉Apply today! https://t.co/zjimgxGjgV

[IAmMasterCraft @BOmoakin]

Topped the league on @tryhackme, but the grind doesn't stop.
The hacking continues, the learning continues the coffee continues.
On to the next challenge!
#tryhackme #cybersecurity #hacking #learning

[IAmMasterCraft @BOmoakin]

I just published 'My Experience Pen testing an E-Learning Platform'
Started with an anonymous FTP login.
Ended with root access.
Check the full gist of my first pentest 👇🏼👇🏼👇🏼:

https://t.co/b7LXly8Dup

[IAmMasterCraft @BOmoakin]

Ahead ahead 🔥🔥

[IAmMasterCraft @BOmoakin]

I'm diving down the rabbit hole of Cyber Security 101 with @tryhackme
Let’s see where this road leads with a 30-day challenge… 🔐💻

#CyberSecurity #infosec #EthicalHacking #Pentesting

[IAmMasterCraft @BOmoakin]

@iamgrandbusta Buy domain 🏃‍♂️

[IAmMasterCraft @BOmoakin]

Although I could not complete Cyber Security 101 in 30 days, I was able to cover
- basic intro to cyber security
- fundamentals of OS (Linux & windows)
- CLI Usage
- networking
- cryptography
- reconnaissance &enumeration
- web hacking & offensive security

[IAmMasterCraft @BOmoakin]

Day 30 - Defensive Security
Defensive security is not just about blocking cyber attacks, it is all about having an understanding of what you have, watch and observe what happens to it, quickly respond to threats before things fall apart.

[IAmMasterCraft @BOmoakin]

Day 29 of 30 - Shells
A shell is a command-line access to a target system, often after exploitation.
Things you can do with a shell include:
-Run commands
-Browse files
-Modify configurations
-Install malware
-Create users
-Exfiltrate data
-Move laterally

[IAmMasterCraft @BOmoakin]

@iamgrandbusta See how the turns have tabled 😹

[IAmMasterCraft @BOmoakin]

It is a useful brute-force enumeration tool for:
- web directories
- DNS subdomains
- VHOSTs
- Files, fuzzing, and more

[IAmMasterCraft @BOmoakin]

Day 28 of 30 - Directory brute-forcing with gobuster
Gobuster is a beast for discovering hidden paths, directories, and files on web servers it is fast, simple, and deadly when paired with the right wordlist.

[IAmMasterCraft @BOmoakin]

When using hydra it is very important to
- use valid usernames
- understand form responses (failure strings)
- adjust thread count for speed/stealth
- watch out for rate-limiting

[IAmMasterCraft @BOmoakin]

Day 27 of 30 - Brute-forcing with Hydra
Hydra is a powerful tool for brute-forcing services like SSH, FTP, and web logins.
It is fast, it is scriptable and when misconfigurations exist, it produces results.

[IAmMasterCraft @BOmoakin]

- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging & Monitoring Failures
- Server-Side Request Forgery (SSRF)

[IAmMasterCraft @BOmoakin]

Day 26 of 30 - OWASP Top 10
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration

[IAmMasterCraft @BOmoakin]

Day 25 of 30 - Burp suite & features
Burp Suite is the toolkit for web & mobile app testing, features include: proxy, repeater, intruder, decoder, comparer, sequencer and extensions

[IAmMasterCraft @BOmoakin]

they include:
- Content-Security-Policy (CSP)
- Strict-Transport-Security (HSTS)
- X-Content-Type-Options, and
- Referrer-Policy

[IAmMasterCraft @BOmoakin]

Day 24 of 30 - HTTP Security Headers
These tiny lines of text can stop big attacks.
Security headers run silently in the background while defending against XSS, clickjacking, and data leaks

[IAmMasterCraft @BOmoakin]

Categories of Status Codes:
1xx =informational (the server is processing it e.g. 100 Continue)
2xx =success (everything’s good e.g. 200 OK)
3xx =redirection (resource moved e.g. 301 Moved Permanently)
4xx =client error (your fault e.g.404 Not Found)
5xx =server error -their fault

[IAmMasterCraft @BOmoakin]

Day 23 of 30 - HTTP Status Codes
Every time you interact with a website, the server replies with a status code; a 3-digit number telling you if the request was successful, redirected, failed, or exploded.