HTTP/HTTPS:

Post-Exploitation

Web shell management, upgrades, and config credential harvesting

2 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

2 guides

Credential Harvesting from Web Configs

Techniques for extracting plaintext credentials and secrets from web application config files post-compromise, targeting HTTP/HTTPS services.

Mar 28, 2026 • 6 min read

Web Shell Management and Upgrade

Covers deploying, managing, and upgrading web shells over HTTP/HTTPS for persistent post-exploitation access, including shell stabilisation and capability escalation.

Mar 28, 2026 • 3 min read

Web post-exploitation is about extracting maximum value from a compromised web application. Once you have code execution or file read access, the target shifts to harvesting credentials, secrets, and configuration data that enable deeper access into the infrastructure.

Database connection strings in config files (wp-config.php, .env, settings.py, appsettings.json) frequently contain reusable credentials. API keys for cloud services, payment processors, and third-party integrations sit in environment variables and config stores. Session tokens and cookies can be stolen for account takeover without knowing passwords.

Source code review of the compromised application often reveals hardcoded secrets, internal service endpoints, and business logic that exposes additional attack paths. The subpages cover systematic credential extraction, secrets enumeration, and turning web-level access into persistent footholds.