Posts on: Web-Technologies

---

Apache Tomcat is the reference implementation of Jakarta Servlet, Jakarta Pages, and Jakarta WebSocket — it is the default Java application server for millions of deployments, and it ships inside countless appliances, CI/CD tools, and management consoles that developers do not realise are running Tomcat under the hood. For an attacker, Tomcat is valuable for three reasons: the Manager and Host Manager web applications deploy arbitrary WAR files (immediate RCE), the AJP connector on port 8009 is frequently exposed and still exploitable via Ghostcat, and the path normalisation difference between a reverse proxy and Tomcat enables authentication and security-constraint bypass.

A Common Gateway Interface (CGI) is the mechanism that lets a web server hand a request to an external program and return its output — it is the original “middleware” between the web server, external databases, and information sources. CGI scripts and programs live in the /cgi-bin/ directory, are typically written in C, C++, Java, or Perl, and run in the security context of the web server (usually www-data, sometimes root).

WordPress powers over 40% of the web, and its attack surface is three-layered: the core, the plugin/theme ecosystem, and the administrative session. Historically, the plugin layer was the dominant risk; 2025–2026 changed that with two unauthenticated core RCE chains — wp2shell (CVE-2026-63030 + CVE-2026-60137) and XSS2Shell (CVE-2026-64638) — that work against stock installations with zero plugins. At the same time, AI-augmented campaigns (CyberXero, TRUST#GRAFT) are industrialising the exploitation of known WordPress flaws at scale.

Many web applications provide a PDF generation functionality which may contain dynamic user input. Some of these generators may be vulnerable due to HTML injection, allowing several attacks. PDF Library Enumeration Determining the PDF generation library used by a web application may be pretty easy: most of them add information in the metadata of the generated file such as the library name and version. To display the metadata of a PDF file, there are multiple options:

Internet Information Services (IIS) for Windows Server is a flexible, secure and manageable Web server for hosting anything on the Web. From media streaming to web applications, IIS’s scalable and open architecture is ready to handle the most demanding tasks. 2025–2026 context: IIS remains a live attack surface not because of the web server itself, but because of legacy Windows filesystem features it exposes, misconfigured WebDAV, and the ASP.NET ViewState/machineKey ecosystem. The tilde (8.3 short name) disclosure is still being assigned CVEs in 2025 — CVE-2025-46294 covers FileMaker Server’s implementation, rated CVSS 5.3 (CWE-200) — and the real impact is what those short names reveal: hidden upload endpoints, backup files, and configuration files that standard directory brute-forcing never finds.

WebDAV (Web Distributed Authoring and Versioning) is a protocol that extends the HTTP protocol, allowing users to collaboratively author and manage files on a web server, enabling actions like creating, editing, moving, and deleting files remotely. An HTTP Server with WebDav might require valid credentials to perform file operations, such as creating, deleting or editing existing files. The credentials are most probably required via HTTP Basic Authentication. Success Notice: You will need to use the HTTP PUT, DELETE and MOVE verbs to respectively upload, delete and move files. Warning Sometimes, the WebDav instance might be configured to deny any file upload using specific file extensions. If this configuration is not properly set, you might be able to subvert it by uploading the file with any other accepted extension, and then using a move (rename) operation or a copy operation.

WebSphere is a Java EE application server provided by IBM, used to deploy and manage enterprise-level Java applications. Discovery & Fuzzing Fuzz for IBM WebSphere specific endpoints using this wordlist: https://github.com/kkrypt0nn/wordlists/blob/main/wordlists/vulnerabilities/websphere.txt Fuzz for files with the following extensions: *.do *.jsp *.jsv *.jsw Missing Authorization in administrative servlets You may find some interesting administrative endpoints lacking authentication. One particular endpoint is the snoop servlet, typically located at the server’s webroot: https://example.com/snoop/

Introduction SAP system consists of a number of fully integrated modules, which covers virtually every aspect of business management. The product is marketed as a service-oriented architecture for enterprise application integration. It can be used for custom development and integration with other applications and systems, and is built primarily using the ABAP programming language, but also uses C, C++, and Java. It can also be extended with, and interoperate with, technologies such as Microsoft .NET, Java EE, and IBM WebSphere.