.

Web app attacks and using web shells

<<

Jhaddix

User avatar

Sr. Member
Sr. Member

Posts: 317

Joined: Wed Oct 29, 2008 10:25 pm

Post Mon Aug 31, 2009 10:47 am

Web app attacks and using web shells

Awesome paper:

http://www.phx2600.org/archive/2009/08/ ... -by-evil1/

Yessir, I busted my ass hump to pump out another paper. 40 pages of ownage, awesome, and win.
Download it here.

The paper covers web shells in PHP, ASP, JSP, Coldfusion, and Perl as well as hacking techniques for auditing each language (brief, but to the point).

If you have any questions about the paper, email me. Contact info on the site / in the paper.
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Mon Aug 31, 2009 11:53 am

Re: Web app attacks and using web shells

Does he ever release in PDF format? Call me paranoid, but I don't like downloading .doc files from the interwebs. :)
OSWP, Sec+
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Mon Aug 31, 2009 12:55 pm

Re: Web app attacks and using web shells

And PDFs don't make you paranoid?  ;)

Don
CISSP, MCSE, CSTA, Security+ SME
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Mon Aug 31, 2009 5:53 pm

Re: Web app attacks and using web shells

don wrote:And PDFs don't make you paranoid?  ;)

Don


Not as paranoid, I know about word macros and the easiness of having the word doc do other things. The pdf as an entry vector I don't know about. Doesn't mean it doesn't exist, just that I have more to learn.
OSWP, Sec+
<<

Evil1

Newbie
Newbie

Posts: 7

Joined: Mon Aug 31, 2009 6:21 pm

Post Mon Aug 31, 2009 6:27 pm

Re: Web app attacks and using web shells

You're right don. Here it is in PDF form. http://www.wtfchan.org/~evil1/Web-Shells-rev2.pdf
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Tue Sep 01, 2009 12:27 am

Re: Web app attacks and using web shells

chrisj wrote:[...] The pdf as an entry vector I don't know about. Doesn't mean it doesn't exist, just that I have more to learn.


In the past there were several vulnerabilities found in pdf, often also critical ones. I too would say that doc offers more space for malicious actions though. But anyway, it would be naive to think that nothing malicious can happen when opening a pdf-file.

Thanks for the paper, looks interesting.
<<

RoleReversal

User avatar

Hero Member
Hero Member

Posts: 928

Joined: Fri Jan 04, 2008 8:54 am

Location: UK

Post Tue Sep 01, 2009 2:48 am

Re: Web app attacks and using web shells

Paranoia aside, the paper is good reading. Web apps aren't my area of expertise but found the information very easy to understand, and with a quick play in my lab over the weekend, very easy to put into practice.

Nice work Evil1

<edited> (bold) to stop me lying (typo)</edit>
Last edited by RoleReversal on Thu Jan 20, 2011 5:46 pm, edited 1 time in total.
<<

Darktaurus

User avatar

Full Member
Full Member

Posts: 181

Joined: Thu Sep 03, 2009 8:48 am

Post Thu Jan 20, 2011 11:41 am

Re: Web app attacks and using web shells

Does anyone have a copy of that pdf?  The link is down: http://www.wtfchan.org/~evil1/Web-Shell ... pdf.&nbsp;
OSCE, OSCP, OSWP, CISSP, GPEN

www.agoonie.com
<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Thu Jan 20, 2011 11:50 am

Re: Web app attacks and using web shells

Last edited by Data_Raid on Fri Jan 21, 2011 5:40 am, edited 1 time in total.
All men by nature desire knowledge.

Aristotle
<<

Darktaurus

User avatar

Full Member
Full Member

Posts: 181

Joined: Thu Sep 03, 2009 8:48 am

Post Thu Jan 20, 2011 12:58 pm

Re: Web app attacks and using web shells

Thanks!! Just doing some research on some web exploits.  I saw that Jhaddix provided some info but the link didn't work.  Thanks again. Hopefully it is something else I can use in the OSCP course.  =-)
OSCE, OSCP, OSWP, CISSP, GPEN

www.agoonie.com
<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Thu Jan 20, 2011 1:35 pm

Re: Web app attacks and using web shells

No worries, the PDF will definitely come in handy for the OSCP  ;)
All men by nature desire knowledge.

Aristotle
<<

T_Bone

Full Member
Full Member

Posts: 199

Joined: Sat Feb 21, 2009 7:11 am

Post Thu Jan 20, 2011 4:36 pm

Re: Web app attacks and using web shells

This paper sounds cool but don't seem to be able to download it?
<<

RoleReversal

User avatar

Hero Member
Hero Member

Posts: 928

Joined: Fri Jan 04, 2008 8:54 am

Location: UK

Post Thu Jan 20, 2011 5:49 pm

Re: Web app attacks and using web shells

T_Bone wrote:This paper sounds cool but don't seem to be able to download it?


Really? Data_Raid's rapidshare link worked for me. I can mirror elsewhere if you're still having problems...
<<

T_Bone

Full Member
Full Member

Posts: 199

Joined: Sat Feb 21, 2009 7:11 am

Post Fri Jan 21, 2011 4:59 am

Re: Web app attacks and using web shells

@ Andrew

Yeah it appears to no longer be available for download on the rapidshare site...  :(
<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Fri Jan 21, 2011 5:42 am

Re: Web app attacks and using web shells

I've removed the rapidshare link (max of 10 download limit reached) and I have added some additional links in my post above: http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,4571.msg35138/#msg35138.

Hopefully those links will suffice  :)
Last edited by Data_Raid on Fri Jan 21, 2011 5:44 am, edited 1 time in total.
All men by nature desire knowledge.

Aristotle
Next

Return to Web Applications

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software