OPSECTLAS you are here: Web
Web

Decision Tree: Web Injection Point → What First?

reference

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

reached from Web injection point

needsWeb injection point
yieldsWeb injection point

A parameter reflects or errors on your input: you have a confirmed injection point, a vulnerable parameter. Identify the class, then jump to the working exploitation.

start A confirmed web injection point, a vulnerable parameter

  1. 1
    SQL Injection (SQLi) (errors or boolean/time differences? dump the database)
  2. 2
    Cross-Site Scripting (XSS) (input reflected into the page? steal sessions)
  3. 3
    Command Injection (shell metacharacters change the response? get RCE)
  4. 4
    File Inclusion (LFI / RFI) (a file or path parameter? read files, then RCE)
  5. 5
    Server-Side Request Forgery (SSRF) (a URL parameter? reach the metadata service)
connected
follows
CMS-Specific AttacksNoSQL InjectionSQL Injection (SQLi)Command Injection