Tutorial Demonstrates Bypassing Web-Application Filters to Gain Server Command Execution

Summary

The tutorial targets a site identified as Tiki Wei 1.9.5 and demonstrates bypassing input filters to execute commands, create a PHP web shell, and read database credentials.

Key points

The presenter uses SearchSploit to find a command-execution exploit associated with the site's graph-form function.
The tutorial intercepts and modifies requests with Burp Suite, describing how input filtering blocks spaces and special characters.
After modifying the payload, the presenter demonstrates running operating-system commands on the server.
The presenter creates a PHP web shell and uses it to access server files, including a database configuration file containing credentials.
The video frames the demonstration as ethical hacking but shows exploitation and remote control of a site without establishing authorization.

Article Details

Topics: [00:00] Application-layer filtering and the tutorial's server-access objective
[01:03] Searching for Tiki Wei vulnerabilities and identifying a command-execution exploit
[03:12] Configuring Burp Suite to intercept and modify site requests
[05:03] Testing server command execution and observing input-filter behavior
[06:47] Bypassing filtering to create and use a PHP web shell
[09:48] Using a remote-control tool to interact with the server and read files

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe tutorial demonstrates exploiting a web application's command-execution flaw through crafted requests to the site's graph-form function.

Summary

Key points

Article Details

MITRE ATT&CK

Related Articles