Attacking Common Applications

Introduction to Attacking Common Applications

Web-based applications are prevalent in most if not all environments that we encounter as penetration testers. During our assessments, we will come across a wide variety of web applications such as Content Management Systems (CMS), custom web applications, intranet portals used by developers and sysadmins, code repositories, network monitoring tools, ticketing systems, wikis, knowledge bases, issue trackers, servlet container applications, and more. It's common to find the same applications across many different environments. While an application may not be vulnerable in one environment, it may be misconfigured or unpatched in the next. An assessor needs to have a firm grasp of enumerating and attacking the common applications covered in this module.

Application Data

Just some of the categories of applications we may come across during a given assessment that we may be able to leverage to gain a foothold or gain access to sensitive data include:

Category	Applications
Web Content Management	Joomla, Drupal, WordPress, DotNetNuke, etc.
Application Servers	Apache Tomcat, Phusion Passenger, Oracle WebLogic, IBM WebSphere, etc.
Security Information and Event Management (SIEM)	Splunk, Trustwave, LogRhythm, etc.
Network Management	PRTG Network Monitor, ManageEngine Opmanger, etc.
IT Management	Nagios, Puppet, Zabbix, ManageEngine ServiceDesk Plus, etc.
Software Frameworks	JBoss, Axis2, etc.
Customer Service Management	osTicket, Zendesk, etc.
Search Engines	Elasticsearch, Apache Solr, etc.
Software Configuration Management	Atlassian JIRA, GitHub, GitLab, Bugzilla, Bugsnag, Bitbucket, etc.
Software Development Tools	Jenkins, Atlassian Confluence, phpMyAdmin, etc.
Enterprise Application Integration	Oracle Fusion Middleware, BizTalk Server, Apache ActiveMQ, etc.

Common Applications

Application	Description
WordPress	WordPress is an open-source Content Management System (CMS) that can be used for multiple purposes. It's often used to host blogs and forums. WordPress is highly customizable as well as SEO friendly, which makes it popular among companies. However, its customizability and extensible nature make it prone to vulnerabilities through third-party themes and plugins. WordPress is written in PHP and usually runs on Apache with MySQL as the backend.
Drupal	Drupal is another open-source CMS that is popular among companies and developers. Drupal is written in PHP and supports using MySQL or PostgreSQL for the backend. Additionally, SQLite can be used if there's no DBMS installed. Like WordPress, Drupal allows users to enhance their websites through the use of themes and modules.
Joomla	Joomla is yet another open-source CMS written in PHP that typically uses MySQL but can be made to run with PostgreSQL or SQLite. Joomla can be used for blogs, discussion forums, e-commerce, and more. Joomla can be customized heavily with themes and extensions and is estimated to be the third most used CMS on the internet after WordPress and Shopify.
Tomcat	Apache Tomcat is an open-source web server that hosts applications written in Java. Tomcat was initially designed to run Java Servlets and Java Server Pages (JSP) scripts. However, its popularity increased with Java-based frameworks and is now widely used by frameworks such as Spring and tools such as Gradle.
Jenkins	Jenkins is an open-source automation server written in Java that helps developers build and test their software projects continuously. It is a server-based system that runs in servlet containers such as Tomcat. Over the years, researchers have uncovered various vulnerabilities in Jenkins, including some that allow for remote code execution without requiring authentication.
Splunk	Splunk is a log analytics tool used to gather, analyze and visualize data. Though not originally intended to be a SIEM tool, Splunk is often used for security monitoring and business analytics. Splunk deployments are often used to house sensitive data and could provide a wealth of information for an attacker if compromised. Historically, Splunk has not suffered from a considerable amount of known vulnerabilities aside from an information disclosure vulnerability (CVE-2018-11409), and an authenticated remote code execution vulnerability in very old versions (CVE-2011-4642).
PRTG Network Monitor	PRTG Network Monitor is an agentless network monitoring system that can be used to monitor metrics such as uptime, bandwidth usage, and more from a variety of devices such as routers, switches, servers, etc. It utilizes an auto-discovery mode to scan a network and then leverages protocols such as ICMP, WMI, SNMP, and NetFlow to communicate with and gather data from discovered devices. PRTG is written in Delphi.
osTicket	osTicket is a widely-used open-source support ticketing system. It can be used to manage customer service tickets received via email, phone, and the web interface. osTicket is written in PHP and can run on Apache or IIS with MySQL as the backend.
GitLab	GitLab is an open-source software development platform with a Git repository manager, version control, issue tracking, code review, continuous integration and deployment, and more. It was originally written in Ruby but now utilizes Ruby on Rails, Go, and Vue.js. GitLab offers both community (free) and enterprises versions of the software.

Example One Note structure

An example OneNote (also applicable to other tools) structure may look like the following for the discovery phase:

External Penetration Test - <Client Name>

• Scope (including in-scope IP addresses/ranges, URLs, any fragile hosts, testing timeframes, and any limitations or other relative information we need handy)

• Client Points of Contact

• Credentials

• Discovery/Enumeration

  • Scans

  • Live hosts

• Application Discovery

  • Scans

  • Interesting/Notable Hosts

• Exploitation

  • <Hostname or IP>

  • <Hostname or IP>

• Post-Exploitation

  • <Hostname or IP>

  • <<Hostname or IP>