Common web applications

From Grayhat cheatsheets
Jump to navigationJump to search

(UNFINISHED)


When a computer that is acting as a web server is researched, regardless of the port, we are likely to find web applications that have been adapted to that company's needs, but are based on existing (usually open source) projects. Some of these have known vulnerabilities, which may be found in www.exploit-db.com or in www.packetstormsecurity.com. It is common that when we are faced for the first time with one such webapp, we are not sure what it is used for, and knowing this would facilitate the process of choosing the most appropriate attack vector. This page aims at containting a brief description of webapps or services found in real machines, as well as links to known vulnerabilities or online tutorials on how to abuse them.

  • Apache Tomcat:

Platform for executing java programs online (servlets). In the local directory /etc/tomcat7 the file tomcat-users.xml contains the usernames and passwords for the tomcat manager. By default some are commented and don't work.

  • SQUID


HTTP servers[edit | edit source]

  • Oracle HTTP server
  • Nginx: An HTTP and reverse proxy server, a mail proxy server, and a generic TCP/UDP proxy server.
  • Apache httpd

Content Management Systems (CMS)[edit | edit source]

  • Dragonfly CMS
  • Webmin: Online application that can be used to administrate a host. If we get login, in the search box, if we write ' an interactive file manager opens. Doesn't work equally well with every web browser.

Security systems[edit | edit source]

  • pi-hole: An add-blocker for raspberry pi. With docker it can now be used in any platform. Appears in mirai (HTB), and the default credentials grant login (user: pi, pass: raspberry)
  • fail2ban: Program which bans IPs that try to connect too many times and fails. It therefore protects the target against online brute force attacks, and the attacking IP will have to be manually enabled by the victim in order to try to login again.

Applications to build websites[edit | edit source]

Application Attack Vectors Examples online Pentest writeups

  • Wordpress (www.wordpress.com): Website for creating websites. Can be enumerated with wpscan. If we manage to log in, we can upload a php shell. Appart from malicious plugins, we can edit themes, so that we can upload a reverse shell by modifying both, plugins and themes, since they are both php files and we can hide a shell inside. For example, nice tutorial in: https://pentaroot.com/exploitation/exploit-wordpress-backdoor-theme-pages/
  • Builder Engine () Application to build e-Commerce websites
  • Drupal (https://www.drupal.org/home) Website to build and manage websites. The default file CHANGELOG.txt indicates the installed version of Drupal.