Pentesting 101

1) Intro  2)  How many services are running under port 1000?    For this we can use simple nmap command which is nmap <IP-TARGET> and as the question asked, we can see there are 2  services are running under port 1000.  3) What is running on the higher port?  ssh 4) What's the CVE you're using against the application?  we will be using command  gobuster dir -u <URL> -w <wordlist> to see if there is any directory we can access.  here, the /simple directory can be accessed as we scroll down, we can see version used by this cms, when it comes to something around "version", we can try to search any CVE associated with that version In Exploit-DB we can see the exact CVE associated with the version as suspected.  CVE-2019-9053 5) To what kind of vulnerability is the application vulnerable?  sqli 6) What's the password?  to know what password is being used, we need to download the exploit file first then we need...

 Introduction 1) Port Scan as usual, as the http is open, we go to the web browser and see what is in there. Don't forget to see the source code to see if there is anything interesting.  as we inspect, there is nothing we can find.  2) Directory scan let's see if there is any directory that we can acces as we go to the /webdav, it prompt us with username and password 3) Cadaver as we search on the internet, we can see there is a default credential for this "dav" there is a hash given under one of the directory, but sadly I can't crack it.  alternatively, I dig around google and find this. which means I can use cadaver command for my next step.  as we can see here, there is a "put" command which we can use to upload a file, which is a "shell" from our own machine to the webdav. 4) Reverse shell go to revshells.com to create our own reverse shell copy it and paste it on a document created on our machine.  as you can see we successfully upload it ...

 Introduction 1) Enumeration Fistly as usual we will be using nmap on our target to see if there is any open port Here you can see there is port 80, which means we can access the port through out browser.  Before doing anything, familiarize yourself to inspect or see the source code. Sometimes, there will be a hint dropped.  Here, you can see there is a name "jessie" which we can deduct it as username.  To see if there is any directories we can access, we use gobuster tool. Here you can see some of the directories that we might get an access to. As we go to one of the directory which is the /sitemap, it reveals the whole website. Also familiarize yourself inspect the pages, for this tutorial we will skip it. To see if there is any hidden directories, we use gobuster again on the /sitemap directory. as we can see, there is a /.ssh As we can see inside the id_rsa, there is a private key shown which will be using it in the exploitation phase.  2) exploit Save the k...