Different ways to upload a WebShell in a Web Server

[Guest Iker]

Hi,

I'm Iker, student of THP course.

In module 2 : Hunting Network: Network Analysis 

     Part 3: Hunting web shells, on page 7 it says that you can upload a webshell using an XSS, it is possible to upload a shell using xss? Or the same is that it is not well explained and is not fully understood.

 

Iker,

Best Regards,

 

[dimitrios 547]

Hi,

Please create a proper (not guest) account.

 

You can "upload" a webshell through XSS. An example is a persistent XSS that will load and install a malicious WordPress plugin (it can contain webshell functionality). A wordpress admin will need browse the vulnerable to persistent XSS page of course for that to happen.

[iker.lopez 0]

Perfect I understood it.

Thank you so much.

BR,

[dimitrios 547]

It's kind of and edge case, but still possible.

 

Thanks for the heads up.

[mdinasec 3]

Hows the course going for you so far? I am debating whether to go with PTP or the new THP...