+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: exploiting a website (/showthread.php?tid=6292351)
Pages: Pages
1
2
exploiting a website - ichung - Feb 15, 2025
Hi guys anyone can suggest me any expoit i can use for an https site? I would like to get an admin access, I've done a quick analysis of the site and noticed that it doesn't have CSP and HSTS, it doesn't even have X-Frame-Options and X-Content-Type-Options. The version of the server is Apache/2.4.6 that is pretty old. Any advice??
RE: exploiting a website - Tyr - Feb 15, 2025
sqlmap is my go to and is great for beginners but best way to learn in manual injection by playing with parameters
RE: exploiting a website - ichung - Feb 15, 2025
(Feb 15, 2025 09:55 AM)Tyr Wrote: sqlmap is my go to and is great for beginners but best way to learn in manual injection by playing with parameters
oh thanks dude, can you give me some good sources for that? Another thing, what about logs? I've noticed that logs are not always easy to hide. Thanks for your kindness
RE: exploiting a website - Tyr - Feb 15, 2025
(Feb 15, 2025 10:32 AM)ichung Wrote: oh thanks dude, can you give me some good sources for that? Another thing, what about logs? I've noticed that logs are not always easy to hide. Thanks for your kindness
sure: https://github.com/sqlmapproject/sqlmap/wiki/usage - if you prefer videos just search on YT; there's many. as far as logs do you mean obfuscated your attempts at cracking the site? i.e. getting blocked?
RE: exploiting a website - DramaKing - Feb 15, 2025
(Feb 15, 2025 10:32 AM)ichung Wrote: oh thanks dude, can you give me some good sources for that? Another thing, what about logs? I've noticed that logs are not always easy to hide. Thanks for your kindness
Your attacks will be logged. There is nothing that you can do to get around that.
Some vulnerabilities to look at:
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=apache+2.4
https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=apache+2.4&search_type=all&isCpeNameSearch=false
I haven't even been able to hack apache2 on vulnerable lab machines, so I won't be much more help.
RE: exploiting a website - Money- - Feb 15, 2025
These things you mentioned aren't going to get you admin access though , they are just information for you to further find out more severe vulnerabilities to exploit further.
RE: exploiting a website - ichung - Feb 16, 2025
(Feb 15, 2025 10:47 AM)Tyr Wrote: - if you prefer videos just search on YT; there's many. as far as logs do you mean obfuscated your attempts at cracking the site? i.e. getting blocked?
yeah exactly cause sometimes the sites register everithing, even small changes.
(Feb 15, 2025 11:14 PM)Money- Wrote: These things you mentioned aren't going to get you admin access though , they are just information for you to further find out more severe vulnerabilities to exploit further.
yeah, but with an SQL injection i should be able to get admin access, isn't it?
(Feb 15, 2025 01:06 PM)DramaKing Wrote: Your attacks will be logged. There is nothing that you can do to get around that.
Some vulnerabilities to look at:
I haven't even been able to hack apache2 on vulnerable lab machines, so I won't be much more help.
really? No way to hide that?
RE: exploiting a website - vetbesim - Feb 16, 2025
Maybe you could find an admin login or something you could use to get admin access. Check out robots.txt and also run a directory brute forcer like dirsearch
RE: exploiting a website - ichung - Feb 16, 2025
(Feb 16, 2025 09:24 AM)vetbesim Wrote: Maybe you could find an admin login or something you could use to get admin access. Check out robots.txt and also run a directory brute forcer like dirsearch
oh i didn't know about that brute forcer, i checked it out and seems great. Yeah probably burte force is a great way to obtain the admin credentials. Thanks for all the advices dude
RE: exploiting a website - Tyr - Feb 17, 2025
(Feb 16, 2025 06:44 AM)ichung Wrote: yeah exactly cause sometimes the sites register everithing, even small changes.
yeah, but with an SQL injection i should be able to get admin access, isn't it?
really? No way to hide that?
i gotcha. yeah sqli is a very good ttp to get into many webservers especially phpmyadmin stacks without proper hardening applied
RE: exploiting a website - vetbesim - Feb 17, 2025
Here, this will help you learn about some ways to break in https://www.hacksplaining.com/lessons and https://www.hacksplaining.com/owasp
RE: exploiting a website - everynight - Feb 18, 2025
I need help because I want to learn hacking, and I am a beginner.In addition, I also need to send a character, don’t blame (β) translation
RE: exploiting a website - Skorp - Feb 18, 2025
Website sounds like a easy target and vuln to mime if it doesn't have the xcontent header. You definitely don't need sqlmap for this, what's the url? Easy shell for me.
RE: exploiting a website - Money- - Feb 18, 2025
(Feb 18, 2025 03:21 PM)Skorp Wrote: Website sounds like a easy target and vuln to mime if it doesn't have the xcontent header. You definitely don't need sqlmap for this, what's the url? Easy shell for me.
What methodology you plan to use? Bypass MIME via file upload? Since xcontent aren't specified.
RE: exploiting a website - ichung - Feb 20, 2025
(Feb 18, 2025 06:21 PM)Money- Wrote: What methodology you plan to use? Bypass MIME via file upload? Since xcontent aren't specified.
ehy dude, I don't know if MIME (image/jpeg, application/pdf) could work, I was going through sqlmap but the only problem is that it's hard to get an admin access with that, you know.