Attacking Common Applications

Directory map

• Application Discovery & Enumeration — asset inventory, Nmap web discovery, EyeWitness, Aquatone, interpreting results, note-taking structure

ColdFusion

• ColdFusion — searchsploit, CVE-2010-2861 directory traversal, CVE-2009-2265 unauthenticated RCE
  • Attacking ColdFusion — searchsploit, password.properties traversal, FCKeditor unauthenticated file upload RCE

CGI Applications

• CGI Applications — Shellshock overview, enumeration, exploitation, mitigation
  • Shellshock (CVE-2014-6271) — CGI background, vulnerability mechanics, Gobuster enumeration, curl confirmation, reverse shell

WordPress

• WordPress — discovery & enumeration overview, user roles, WPScan, brute force, RCE
  • Discovery & Enumeration — footprinting, manual curl enumeration, plugin/theme fingerprinting, user enumeration, WPScan
  • Attacking WordPress — login brute force (xmlrpc), theme editor RCE, Metasploit shell upload, mail-masta LFI, wpDiscuz RCE (CVE-2020-24186)

Drupal

• Drupal — discovery & enumeration, node URLs, CHANGELOG version, droopescan
  • Discovery & Enumeration — footprinting, node URLs, CHANGELOG version, droopescan, admin login

Joomla

• Joomla — discovery & enumeration, template RCE, CVE-2019-10945
  • Discovery & Enumeration — footprinting, version fingerprinting, droopescan, JoomlaScan, login brute force
  • Attacking Joomla — template RCE, web shell hygiene, CVE-2019-10945 directory traversal

Splunk

• Splunk — discovery & enumeration, default creds, Splunk Free, scripted input RCE, deployment server pivot
  • Discovery & Enumeration — ports, default credentials, Splunk Free, scripted inputs, data of interest
  • Attacking Splunk — scripted input RCE, app structure, PowerShell/Python reverse shells, deployment server pivot

Tomcat

• Tomcat — discovery & enumeration, Manager access, WAR deployment, default credentials, CGI RCE
  • Discovery & Enumeration — fingerprinting via /docs, directory structure, default credentials, Manager enumeration, common entry points
  • Attacking Tomcat — credential brute force (Metasploit, Python, cURL), WAR upload RCE, web shell hygiene, CVE-2020-1938 Ghostcat
  • Tomcat CGI — CVE-2019-0232 — enableCmdLineArguments RCE, ffuf CGI discovery, URL-encoded command injection (Windows)

Jenkins

• Jenkins — discovery & enumeration, Script Console RCE, default credentials, plugin enumeration
  • Discovery & Enumeration — fingerprinting, version detection, anonymous access, API enumeration, plugin discovery, credential testing
  • Attacking Jenkins — Script Console RCE, Groovy command execution, reverse shells (Linux/Windows), vulnerabilities, data exfiltration, persistence

Thick Client Applications

• Thick Client Applications — discovery, enumeration, reverse engineering, hardcoded credentials, DLL hijacking
  • Discovery & Enumeration — application identification, metadata extraction, dependency analysis, static analysis, configuration discovery
  • Attacking Thick Client Applications — hardcoded credentials extraction, static/dynamic analysis, case study, DLL hijacking, insecure storage exploitation, GDB/PEDA & dnSpy connection-string extraction
  • Exploiting Web Vulnerabilities — SQL injection, path traversal, JAR modification, signature bypass, three-tier architecture attacks

LDAP

• LDAP — protocol overview, use cases, LDAP vs AD, ldapsearch, LDAP injection, authentication bypass
  • LDAP — protocol mechanics, client-server model, ldapsearch, injection attacks, wildcard auth bypass, enumeration

IIS (Internet Information Services)

• IIS — tilde enumeration, 8.3 short file names, IIS-ShortName-Scanner, Gobuster full-name resolution
  • IIS Tilde Enumeration — 8.3 short file name vulnerability, IIS-ShortName-Scanner, wordlist generation, Gobuster full-name resolution

PRTG Network Monitor

• PRTG Network Monitor — discovery & enumeration, CVE-2018-9276 command injection, default credentials, persistence
  • Overview — background, key facts, vulnerabilities, prevalence in assessments
  • Discovery & Enumeration — network discovery, service fingerprinting, version detection, default credentials
  • Exploitation — CVE-2018-9276 authenticated command injection, step-by-step walkthrough, payload crafting
  • Post-Exploitation — reverse shells, persistence mechanisms, scheduled tasks, lateral movement, log cleanup

Summary

Attacking common applications begins with a structured discovery phase before any exploitation is attempted. Nmap sweeps the scope list for common web ports (80, 443, 8000, 8080, 8180, 8888, 10000) using --open -oA to produce XML output that downstream tools can consume directly. A follow-up service version scan (-sV) fingerprints what is actually running — frequently revealing Splunk, PRTG, Tomcat, or other management interfaces on non-standard ports that are easily missed.

EyeWitness (eyewitness --web -x web_discovery.xml) and Aquatone (cat web_discovery.xml | ./aquatone -nmap) both accept Nmap XML and produce HTML screenshot reports, grouping targets into categories such as “High Value Targets.” These reports rapidly surface default-credential login pages (Tomcat Manager, Splunk, PRTG) and default install pages that confirm software versions without manual browsing across dozens of hosts.

When interpreting results, prioritize applications with known default credentials or recent CVEs: Tomcat Manager enables WAR-based RCE, Splunk’s search engine can execute server-side scripts, PRTG has authenticated RCE vulnerabilities in older versions (CVE-2018-9276), and osTicket can leak internal employee/email data useful for phishing. Findings should be tracked in a hierarchical note structure (host → application → credentials → exploitation path) throughout the engagement to support the final report.

PRTG Network Monitor deserves special attention in internal assessments — it’s frequently encountered in monitored network infrastructure, has a well-known authenticated command injection (CVE-2018-9276 < v18.2.39), and default credentials (prtgadmin:prtgadmin) are often unchanged. Successful exploitation yields SYSTEM-level code execution with built-in persistence through scheduled notifications, plus access to credentials stored for monitored infrastructure enabling further lateral movement.

IIS tilde enumeration leverages the Windows 8.3 short file name format to discover hidden directories and files on IIS 7.5 and earlier. The IIS-ShortName-Scanner tool automates the character-by-character HTTP probing, and Gobuster resolves identified short names (e.g., TRANSF~1.ASP) to their full filenames using a prefix-filtered wordlist.

LDAP injection exploits web applications that delegate authentication to LDAP without sanitising input. Injecting the wildcard character * into username or password fields can cause the underlying LDAP query to match any directory entry, bypassing authentication entirely. Anonymous ldapsearch queries against exposed port 389 can also enumerate users and organizational structure without credentials.