HTTP/HTTPS:
Post-Exploitation
Web shell management, upgrades, and config credential harvesting
Credential Harvesting from Web Configs
Techniques for extracting plaintext credentials and secrets from web application config files post-compromise, targeting HTTP/HTTPS services.
Web Shell Management and Upgrade
Covers deploying, managing, and upgrading web shells over HTTP/HTTPS for persistent post-exploitation access, including shell stabilisation and capability escalation.
Web post-exploitation is about extracting maximum value from a compromised web application. Once you have code execution or file read access, the target shifts to harvesting credentials, secrets, and configuration data that enable deeper access into the infrastructure.
Database connection strings in config files (wp-config.php, .env, settings.py, appsettings.json) frequently contain reusable credentials. API keys for cloud services, payment processors, and third-party integrations sit in environment variables and config stores. Session tokens and cookies can be stolen for account takeover without knowing passwords.
Source code review of the compromised application often reveals hardcoded secrets, internal service endpoints, and business logic that exposes additional attack paths. The subpages cover systematic credential extraction, secrets enumeration, and turning web-level access into persistent footholds.