OSCP Web Exploitation Guide: SQLi, LFI, RCE & File Upload Attacks Explained

Introduction

The Offensive Security Certified Professional (OSCP) certification is a hallmark of practical penetration testing skills, emphasizing hands-on exploitation in real-world scenarios. Web applications are often the gateway to compromising a system, serving as the initial foothold that pentesters use to pivot deeper into a network. This blog outlines the systematic approach to exploiting web applications the "OSCP way," from reconnaissance to achieving root-level access. We’ll cover methodologies, tools, and techniques while staying true to the OSCP mantra: "Try Harder."

Phase 1: Reconnaissance and Enumeration

Reconnaissance is the foundation of any successful penetration test. The goal is to gather as much information as possible about the target web application to identify potential vulnerabilities.

Passive Reconnaissance

Start with passive techniques to avoid detection:

• WHOIS Lookup: Use tools like whois to identify domain ownership and registration details.
• OSINT: Leverage sources like Shodan, Censys, or public records on X to find exposed services or misconfigurations.
• Google Dorking: Use advanced Google search operators (e.g., site:target.com inurl:login) to uncover hidden pages or sensitive files.

Active Enumeration

Once passive recon is complete, move to active enumeration:

• Port Scanning: Use nmap to identify open ports and services. For example:

  nmap -sV -p- -T4 target.com

• Directory Bruteforcing: Tools like dirb or gobuster can uncover hidden directories:

  gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt

• Web Crawling: Use Burp Suite or OWASP ZAP to map the application’s structure.

Focus on identifying technologies (e.g., Apache, PHP, WordPress) and potential entry points like login pages, file uploads, or API endpoints.

Phase 2: Gaining a Foothold

With reconnaissance complete, the next step is to exploit vulnerabilities to gain initial access to the web application.

Common Web Vulnerabilities

• SQL Injection: Test input fields with payloads like ' OR 1=1 -- using tools like sqlmap:

  sqlmap -u http://target.com/login --data="username=admin&password=pass" --dbs

• Cross-Site Scripting (XSS): Inject scripts like to test for reflected or stored XSS.
• File Inclusion Vulnerabilities: Test for Local File Inclusion (LFI) or Remote File Inclusion (RFI) with payloads like ../../etc/passwd.
• File Upload Vulnerabilities: Attempt to upload malicious files (e.g., a PHP webshell) to gain code execution.

Exploiting a Vulnerability

Suppose you identify an LFI vulnerability. You can leverage it to read sensitive files or, if combined with a file upload, achieve remote code execution (RCE). For example, upload a webshell (shell.php) and access it via LFI:

Then, access it: http://target.com/index.php?page=../../uploads/shell.php&cmd=id.

This could yield a low-privilege shell, your foothold into the system.

Phase 3: Post-Exploitation and Privilege Escalation

With a foothold, the goal is to deepen access, often by escalating privileges or pivoting to other services.

Enumerating the System

Run commands to gather system information:

whoami
uname -a
cat /etc/passwd
netstat -tulnp

Look for misconfigurations, such as world-writable files or outdated software.

Lateral Movement

If the web server has access to other internal services, use it to pivot. For example, scan internal networks with a simple PHP script:

";
}
?>

This can reveal other hosts to target.

Privilege Escalation

Common privilege escalation techniques include:

• Kernel Exploits: Check the kernel version (uname -r) and search for known exploits using tools like searchsploit.
• Sudo Misconfigurations: Run sudo -l to check for commands executable as root.
• Weak File Permissions: Look for misconfigured /etc/shadow or cron jobs.

Phase 4: Achieving Root

Root access is the ultimate goal in OSCP-style engagements. Let’s say you find a sudo misconfiguration allowing /usr/bin/vim to run as root:

sudo vim
:shell
whoami
# root

Alternatively, a kernel exploit like Dirty COW could be used if the system is vulnerable. Compile and run the exploit to gain root privileges.

Once root is achieved, maintain persistence (e.g., add a backdoor user) and document your steps for reporting.

Best Practices for OSCP-Style Web App Exploitation

• Stay Methodical: Follow a structured approach (recon, exploit, escalate) to avoid missing critical vulnerabilities.
• Automate Wisely: Use tools like Burp Suite or sqlmap to speed up testing, but verify findings manually.
• Document Everything: Take screenshots and log commands for your OSCP report.
• Practice Ethics: Only test systems you have permission to engage with.

Conclusion

Exploiting web applications the OSCP way is a blend of technical skill, creativity, and persistence. From reconnaissance to achieving root, each phase builds on the previous, requiring thorough enumeration and exploitation. By mastering these techniques and maintaining a methodical approach, you’ll be well-prepared for the OSCP exam and real-world pentesting. Keep practicing, stay curious, and always “Try Harder!”