Web Application Pentesting

Authentication, injection and server-side attacks against web applications, with the reasoning behind each exploit.

29 rooms, about 3 hours of reading

Start at room 1 Multi-Factor Authentication
  1. 1 Multi-Factor Authentication TryHackMe Multi-Factor Authentication room walkthrough — understanding MFA, common vulnerabilities, OTP leakage, and bypassing … 5 min
  2. 2 Server-side Template Injection (SSTI) TryHackMe SSTI room walkthrough — detecting template engines and exploiting Smarty, Pug, Jinja2, and Twig, plus mitigation … 2 min
  3. 3 Hammer: OTP Rate-Limit Bypass to JWT kid RCE Walkthrough of TryHackMe Hammer: leak a reset email from a log, bypass the OTP rate limit via X-Forwarded-For, forge a JWT from … 6 min
  4. 4 Advanced SQL Injection: Five Evasion Techniques Walkthrough of TryHackMe Advanced SQL Injection: second-order SQLi, keyword and space filter evasion, UNION out-of-band … 6 min
  5. 5 NoSQL Injection: MongoDB Operator and Syntax Walkthrough of TryHackMe NoSQL Injection: MongoDB operator injection to bypass login, blind regex password extraction, and … 5 min
  6. 6 XXE Injection: File Read, SSRF, and Exfiltration Walkthrough of TryHackMe XXE Injection: in-band XML External Entity file read, SSRF port scanning through the parser, and … 5 min
  7. 7 ORM Injection: whereRaw and ORDER BY Injection Walkthrough of TryHackMe ORM Injection: Laravel whereRaw raw query injection to dump admins and an ORDER BY json_extract break-out … 6 min
  8. 8 Injectics: SQLi Filter Bypass to Twig RCE Walkthrough of TryHackMe Injectics: bypassing the login SQLi keyword filter, stacked query injection, and a Twig sandbox escape … 7 min
  9. 9 Server-side Template Injection: SSTI to RCE Walkthrough of TryHackMe Server-side Template Injection: confirming SSTI in Smarty, Pug, and Jinja2, then escaping each to RCE … 6 min
  10. 10 LDAP Injection: Auth Bypass to Blind Exfiltration Walkthrough of TryHackMe LDAP Injection: tautology authentication bypass, enumerating every directory entry, and blind boolean … 5 min
  11. 11 Insecure Deserialisation: PHP Object Injection to RCE Walkthrough of TryHackMe Insecure Deserialisation: PHP cookie property tampering, object injection via __wakeup to a reverse … 5 min
  12. 12 SSRF: forging requests from the server side TryHackMe SSRF walkthrough: local config theft via file_get_contents, internal admin pivot, blind OOB phpinfo exfiltration, and … 4 min
  13. 13 File Inclusion: from path traversal to code execution TryHackMe File Inclusion walkthrough: relative and absolute path traversal, PHP wrapper code execution via base64 decode, and log … 5 min
  14. 14 Prototype Pollution: injecting properties through the chain TryHackMe Prototype Pollution walkthrough: JavaScript prototype chain exploitation for property injection, denial of service via … 6 min
  15. 15 Include: from property injection to log poisoning RCE TryHackMe Include walkthrough: property injection to admin, SSRF credential theft, nested traversal LFI bypass, and SMTP log … 5 min
  16. 16 XSS: reflected, stored, and DOM-based scripting attacks TryHackMe XSS walkthrough: reflected injection via copyparty CRLF, stored XSS sanitization in JavaScript and ASP.NET, and … 8 min
  17. 17 CSRF: token bypass and SameSite cookie exploitation TryHackMe CSRF walkthrough: GET-based transfer exploit, double submit cookie token prediction, SameSite Lax bypass for logout and … 9 min
  18. 18 DOM-Based Attacks: stored XSS via Vue v-html exploitation TryHackMe DOM-Based Attacks walkthrough: DOM tree fundamentals, source and sink analysis, stored XSS through Vue v-html, and … 7 min
  19. 19 CORS and SOP: cross-origin data exfiltration TryHackMe CORS and SOP walkthrough: arbitrary origin reflection, bad regex bypass via subdomain, and null origin exploitation … 8 min
  20. 20 HTTP Request Smuggling: CL.TE desync exploitation TryHackMe HTTP Request Smuggling walkthrough: CL.TE desync between ATS and Nginx to capture authenticated dashboard credentials … 7 min
  21. 21 HTTP/2 Request Smuggling: CRLF injection and cache poisoning TryHackMe HTTP/2 Request Smuggling walkthrough: H2.CL desync, CVE-2019-19330 CRLF injection via literal HPACK encoding, web cache … 10 min
  22. 22 WebSocket Request Smuggling: proxy bypass via fake upgrades TryHackMe WebSocket Request Smuggling walkthrough: broken WebSocket tunnel through Varnish, SSRF-based fake 101 injection to … 6 min
  23. 23 HTTP Browser Desync: client-side smuggling via Werkzeug TryHackMe HTTP Browser Desync walkthrough: Werkzeug CVE-2022-29361 keep-alive desync, form-based client-side smuggling, and XSS … 9 min
  24. 24 El Bandito: H2.CL desync to steal bot credentials TryHackMe El Bandito walkthrough: Spring Boot heapdump extraction and H2.CL desync via raw HTTP/2 frames to capture the bot's flag … 6 min
  25. 25 Web Frameworks Code Review: source-to-sink Flask audit TryHackMe Web Frameworks Code Review walkthrough: source-to-sink Flask audit with grep and Semgrep triage, then SQLi, SSTI, and … 8 min
  26. 26 Web Frameworks Java: Spring actuator to deserialization RCE TryHackMe Web Frameworks Java walkthrough: Spring actuator leak, UNION SQLi via JdbcTemplate, mass assignment overpost, and … 7 min
  27. 27 Web Frameworks Python: Django leak to Flask session forgery TryHackMe Web Frameworks Python walkthrough: Django DEBUG SECRET_KEY leak, ORM extra() SQLi, Flask session forgery with … 7 min
  28. 28 Web Frameworks .NET: ViewState RCE to Json.NET deser chain TryHackMe Web Frameworks .NET walkthrough: ViewState RCE via leaked machineKey, EF Core FromSqlRaw SQLi, mass assignment, and … 9 min
  29. 29 Source Code Review PHP: XXE to deserialization RCE TryHackMe Source Code Review PHP walkthrough: XXE via LIBXML_NOENT, unserialize Monolog/RCE1, magic hash bypass, and Laravel … 11 min