Web-Application-Cheatsheet - This cheatsheet is aimed at the CTF Players and Be

项目说明

🌐 Web Application Cheatsheet ()

A practical Web Application Penetration Testing cheat sheet designed for CTF players, penetration testers, bug bounty hunters, and cybersecurity learners to understand common web and exploitation techniques.

🌐 Connect With Us

🔵
⚫ Twitter/X – Follow Us
🟣 Discord – Join Server
💼 LinkedIn – Follow HackingArticles

🎓 Training Program

🚀 Join Our Cybersecurity Training Program

Hands-on training in Penetration Testing, Red Teaming, and Cybersecurity.

Table of Contents
=================

* Drupal
* Jenkins
* Joomla
* WebMin
* Wordpress
* Builder Engine
* CMS Made Simple
* CouchDB
* Cuppa
* Cute News 2.0.3
* Impress
* LibreNMS
* Moodle
* Php Mailer
* Playsms
* Rips
* SPHP Blog
* Squirrel Mail
* PHPText
* Wolf
* Zenphoto
* Redis
* Nano CMS
* OpenEclass E-learning

<a name="drupal"></a>

Drupal ⤴

|No.| Machine Name | Exploit/|
|---|-----------------------|------------|
|1. |Droopy|Drupalgeddon|
|2. |Billu Box 2|Drupalgeddon2 |
|3. |Lampiao : 1|Drupalgeddon2 |
|4. |Typhoon : 1.02|Drupalgeddon2 |
|5. |DC-1|Drupalgeddon2|
|6. |RootThis : 1|Manual|
|7. |DC:7|Manual|
|8. |DC:8

<a name="jenkins"></a>

Jenkins ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Jarbas : 1|Jenkins Script Console|

<a name="joomla"></a>

Joomla ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Hackademic-RTB2|SQL Injection|
|2. |Kevgir|Joomla! 1.5.x - 'Token'
|3. |DC-3|Joomla! 3.7.0 - 'com_fields' SQL Injection|
|4. |Born2Root: 2|Enumeration|

<a name="webmin"></a>

WebMin ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |pWnOS -1.0|Webmin File Disclosure
|2. |: 1| DistCC Daemon Command Execution
|3. |Nezuko:1|Webmin 1.920 - Remote Code Execution

<a name="wordpress"></a>

Wordpress ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. | Hackademic-RTB1|Enumeration|
|2. | Mr. Robot|Bruteforce|
|3. | Stapler|Enumeration/Bruteforce|
|4. | Minotaur|Wordpress SlideShow Gallery Authenticated File Upload|
|5. | Freshly |Manual|
|6. | USV |Enuemration|
|7. | Quaoar |Enumeration|
|8. | Lazysysadmin |WordPress Admin Shell Upload|
|9. | BTRSys:dv 2.1|Enumeration|
|10. | Basic Penetration |WordPress Admin Shell Upload|
|11. | DerpNStink|Wordpress SlideShow Gallery Authenticated File Upload|
|12. | BSides : 2018 |WordPress Admin Shell Upload|
|13. | Raven|Enumeration|
|14. | HackinOS : 1|Enumeration|
|15. | Web De : 1|WordPress Photo Gallery Unrestricted File Upload|
|16. | DC-2 |Enumeration/Bruteforce|
|17. | DC6 |Plainview Activity Monitor 20161228|
|18. | symfonos : 1 |WordPress Plugin Mail Masta 1.0 - Local File Inclusion|
|19. | PumpkinFestival |Enumeration|
|20. | SP:Jerome|WordPress Crop-image Shell Upload|
|21. | dpwwn:2 |Wordpress Plugin Site Editor 1.1.1|
|22. | GrimTheRipper:1 |Bruteforce|
|23. |symfonos : 2|WordPress Plugin Mail Masta 1.0 - Local File Inclusion|
|24. |Prime: 1| Enumeration|
|25. |HA: Wordy| Multiple |
|26. |Loly: 1|WordPress Plugin AdRotate 3.6.5 - SQL Injection|

<a name="builder"></a>

Builder Engine ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Sedna|builderengine_upload_exec|

<a name="cmsms"></a>

CMS Made Simple ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |West Wild: 2|CMSMS Showtime2 File Upload RCE |

<a name="couch"></a>

CouchDB ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Moonraker:1|Node.js deserialization RCE|

<a name="cuppa"></a>

Cuppa ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |W1R3S.inc|'/alertConfigField.php' LFI/RFI|
|2. |BRAVERY|'/alertConfigField.php' LFI/RFI|

<a name="cute"></a>

Cute News ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Simple|CuteNews 2.0.3 Remote File Upload|

<a name="impress"></a>

Impress ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Breach 1.0|Enumeration|

<a name="moodle"></a>

Moodle ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Golden Eye:1|Moodle - Remote Command Execution|

<a name="phpmailer"></a>

PHP Mailer ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Raven : 2|PHPMailer < 5.2.18 - Remote Code Execution|

<a name="playsms"></a>

Playsms ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Dina|PlaySMS import.php Authenticated CSV File Upload Code Execution|

<a name="rips"></a>

Rips ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Mercy|RIPS 0.53 - Multiple Local File Inclusions|

<a name="sphp"></a>

Simple PHP Blog ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |pWnOS -2.0|Simple PHP Blog Remote Command Execution

<a name="squirrel"></a>

Squirrel Mail ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |DE-ICE:S1.140|Enumeration|

<a name="phptext"></a>

PHPTax ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Kioprtix: 5|PhpTax Remote Code Injection

<a name="wolf"></a>

Wolf ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |SickOS 1.1|Default Credential

<a name="zen"></a>

Zenphoto ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Orcus|Enumeration|

<a name="redis"></a>

Redis ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |Gemini inc:2|Remote Code Execution(RCE)|

<a name="nano"></a>

Nano CMS ⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. |LAMPSecurity: CTF 5|NanoCMS '/data/pagesdata.txt' Password Hash Information Disclosure|

<a name="open"></a>

GUnet OpenEclass E-learning platform⤴

|No.| Machine Name |Exploit/|
|---|-----------------------|------------|
|1. | 1.0.1|GUnet OpenEclass E-learning platform 1.7.3|

项目信息

开发语言：未知

Star 数：486

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This cheatsheet is aimed at the CTF Players and Beginners to help them understand Web Application Vulnerablity with examples.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。