Tryhackme-Vulnerability Research_who is the author of exploit-db-CSDN博客

本文链接：https://blog.csdn.net/qq_36531487/article/details/120786862

本文档深入探讨了漏洞研究的基础知识，包括权限升级、应用逻辑漏洞等类型。介绍了CVSS和VPR两种漏洞评分系统，并通过实例展示了如何发现和利用漏洞。此外，提到了NVD中2021年7月的CVE提交数量以及Exploit-DB的作者。最后，鼓励读者继续学习相关领域的更多内容。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Vulnerability Research

Read this task!

1.An attacker has been able to upgrade the permissions of their system account from “user” to “administrator”. What type of vulnerability is this?

Operating System

2.You manage to bypass a login panel using cookies to authenticate. What type of vulnerability is this?

Application Logic

1.What year was the first iteration of CVSS published?

2005

2.If you wanted to assess vulnerability based on the risk it poses to an organisation, what framework would you use?

Note: We are looking for the acronym here.

VPR

3.If you wanted to use a framework that was free and open-source, what framework would that be?

Note: We are looking for the acronym here.

CVSS

1.Using NVD, how many CVEs were submitted in July 2021?

1585

NVD - July 2021 Listing (nist.gov)

2.Who is the author of Exploit-DB?

What type of vulnerability did we use to find the name and version of the application in this example?

Version Disclosure

Follow along with the showcase of exploiting ACKme’s application to the end to retrieve a flag. What is this flag?

THM{ACKME_ENGAGEMENT}

Continue on your learning with the additional rooms in this module.