Attacking Common Applications

Directory map

• Application Discovery & Enumeration — asset inventory, Nmap web discovery, EyeWitness, Aquatone, interpreting results, note-taking structure

WordPress

• WordPress — discovery & enumeration overview, user roles, WPScan, brute force, RCE
  • Discovery & Enumeration — footprinting, manual curl enumeration, plugin/theme fingerprinting, user enumeration, WPScan
  • Attacking WordPress — login brute force (xmlrpc), theme editor RCE, Metasploit shell upload, mail-masta LFI, wpDiscuz RCE (CVE-2020-24186)

Drupal

• Drupal — discovery & enumeration, node URLs, CHANGELOG version, droopescan
  • Discovery & Enumeration — footprinting, node URLs, CHANGELOG version, droopescan, admin login

Joomla

• Joomla — discovery & enumeration, template RCE, CVE-2019-10945
  • Discovery & Enumeration — footprinting, version fingerprinting, droopescan, JoomlaScan, login brute force
  • Attacking Joomla — template RCE, web shell hygiene, CVE-2019-10945 directory traversal

Tomcat

• Tomcat — discovery & enumeration, Manager access, WAR deployment, default credentials
  • Discovery & Enumeration — fingerprinting via /docs, directory structure, default credentials, Manager enumeration, common entry points
  • Attacking Tomcat — credential brute force (Metasploit, Python, cURL), WAR upload RCE, web shell hygiene, CVE-2020-1938 Ghostcat

Summary

Attacking common applications begins with a structured discovery phase before any exploitation is attempted. Nmap sweeps the scope list for common web ports (80, 443, 8000, 8080, 8180, 8888, 10000) using --open -oA to produce XML output that downstream tools can consume directly. A follow-up service version scan (-sV) fingerprints what is actually running — frequently revealing Splunk, PRTG, Tomcat, or other management interfaces on non-standard ports that are easily missed.

EyeWitness (eyewitness --web -x web_discovery.xml) and Aquatone (cat web_discovery.xml | ./aquatone -nmap) both accept Nmap XML and produce HTML screenshot reports, grouping targets into categories such as “High Value Targets.” These reports rapidly surface default-credential login pages (Tomcat Manager, Splunk, PRTG) and default install pages that confirm software versions without manual browsing across dozens of hosts.

When interpreting results, prioritize applications with known default credentials or recent CVEs: Tomcat Manager enables WAR-based RCE, Splunk’s search engine can execute server-side scripts, PRTG has authenticated RCE vulnerabilities in older versions, and osTicket can leak internal employee/email data useful for phishing. Findings should be tracked in a hierarchical note structure (host → application → credentials → exploitation path) throughout the engagement to support the final report.