Posts on: Web

---

Introduction Jenkins is a continuous integration server. Jenkins runs on Tomcat port 8080 by default The default installation typically uses Jenkins’ database to store credentials and does not allow users to register an account. Jenkins if often inside internal networks Jenkins is often installed on Windows servers running as the SYSTEM account. If we can gain access via Jenkins and gain remote code execution as the SYSTEM account, we would have a foothold in Active Directory to begin enumeration of the domain environment. It is not uncommon to find Jenkins instances that do not require any authentication during an internal penetration test We can fingerprint Jenkins quickly by the telltale login page. Jenkins Script Console RCE [Authenticated] After gaining access to a Jenkins application, you can navigate to the script console: http://jenkins.test.example:8000/script The script console allows us to run arbitrary Groovy scripts within the Jenkins controller runtime. This can be abused to run operating system commands on the underlying server. Linux PoC Script:

Web caches sit between the client and the origin server to reduce latency and load. A cache key — a subset of request attributes — decides whether two requests may share a cached response. Every bug in this class is a disagreement between the cache and the origin about what the request means: either the cache keys on something the origin ignores (poisoning), or the cache serves a private response as if it were public (deception).

Local File Inclusion occurs when an application includes a file whose path is influenced by user input, without proper validation. The impact ranges from source disclosure to full remote code execution — and the gap between the two is smaller than it was a few years ago, because 2024–2026 produced PHP filter-chain techniques that turn a plain php://filter read into arbitrary code execution without allow_url_include, without a log file, and without a writable path.

Remote File Inclusion (RFI) occurs when an application loads a file from a remote URL supplied by the attacker — typically through a PHP include() or require() statement that uses user-controlled input. Unlike LFI, which reads files already on the server, RFI fetches the file from the attacker’s server and executes it, which makes it a direct path to remote code execution without writing anything to disk. The catch: RFI requires allow_url_include = On in php.ini. This is disabled by default since PHP 5.2 and remains off on virtually every modern installation. The vulnerability is therefore less common than LFI, but when it exists, it is the fastest route to RCE — no log poisoning, no file upload, no race condition.

An XML External Entity Injection (XXE) vulnerability occurs when an application parses attacker-supplied XML with external entity processing enabled. The parser resolves an attacker-defined entity that references a local file, an internal URL, or a remote DTD — turning the XML input into a file-read, SSRF, or RCE primitive. 2026 context: XXE is no longer just a “SOAP endpoint” bug. It lives in document-processing pipelines (DOCX, XLSX, SVG, PDF/XFA), SAML, XSLT transforms, and AI/LLM document loaders. The scanner-bypass research of 2025–2026 shows that even applications that do implement a DOCTYPE filter can be bypassed through encoding tricks (PhpSpreadsheet’s XmlScanner) and parser-differential behaviour.

XML Path Language (XPath) is a query language for selecting nodes from XML documents, used by applications that store or retrieve data in XML — user stores, configuration files, SOAP/SAML backends, and legacy XML databases. When user input is concatenated into an XPath expression without sanitisation, an attacker can rewrite the query’s logic. Because XPath has no privilege model, a successful injection typically exposes the entire document rather than a single row — there is no table-level or column-level access control to stop it.

Lightweight Directory Access Protocol (LDAP) is a protocol used to access directory servers such as Active Directory (AD) via queries to retrieve information. Web applications may use LDAP for integration with AD or other directory services for authentication or data retrieval purposes. 2025–2026 context: LDAP injection remains a CWE-90 issue with a steady stream of CVEs because the same mistake repeats: user input concatenated into a search filter without RFC 4515 escaping. What has changed is the exploitation depth — blind extraction now uses binary search and OID-based bitwise ordering rather than character-by-character wildcard guessing, and WAF bypass relies on RFC-compliant hex escaping and OID aliasing rather than encoding tricks.

HTTP verb tampering exploits web servers and frameworks that treat HTTP methods inconsistently — a path that returns 403 on GET might return 200 on POST, PUT, or an obscure WebDAV method. The attack works by sending a request with an unexpected method to bypass authorization checks, security filters, or middleware that was only written for GET and POST. The core problem is that many access-control configurations are method-specific. A rule like <Limit GET POST> require valid-user </Limit> in Apache protects only those two verbs; every other method — HEAD, OPTIONS, PUT, DELETE, PATCH, or an invented verb — reaches the handler without authentication.