Week 09 · Files & Secrets ULTIMATE · 7 days × 180 min

Upload → RCE. Exposure → keys. Redact everything.

LFI/RFI → upload bypasses → backup/config → JS/Swagger → headers/TLS/debug → error disclosure. Partial proof (***-1234), read-only validation, stop on sensitive data.

redacted proofsread-only validationticks bbv2-09
🎉 Week complete — all boxes ticked. Move to Week 10.
Real 180 min · file param = traversal first

  1. 0:00–0:15 Include sinks + wrappers + RFI precondition

    List include/require + ?file= ?page= ?lang= + php://filter/zip/data + allow_url_include for RFI. Read WSTG ATHZ-01 § objectives ONLY.

    WSTG: ATHZ-01
    Why this matters ▼

    Done-when

    Sinks + wrappers + RFI condition cold.

  2. 0:15–1:05 Traversal + wrappers + log-poison path (lab only)

    Do THM filepathtraversal Task 3–6 (LFI/RFI/payloads/challenges) + PortSwigger traversal labs (stripped ../, null-byte legacy) ONLY. Test ....// + %2e%2e/ + php://filter/convert.base64-encode/resource=index (lab) + log-poison THEORY (no prod writes) per HackTricks.

    THM: filepathtraversal T3–6Lab: traversal simple firstAll labs: traversal filterHackTricks: wrappers/poison
    Why this matters ▼

    YT

    Search LFI to RCE log poisoning bug bounty.

    Done-when

    Depth + 2 bypasses + wrapper read (lab).

  3. 1:05–2:00 Config-read chain + LFI→RCE pivot (which fired)

    Read 1 config-read (THM Include-style: /etc/passwd → app config → key) + 1 LFI→RCE (log/wrapper/upload pivot named) — pivot ONLY each.

    pentester.land: LFI→RCE pivotH1: LFI mirror
    Why this matters ▼

    Done-when

    2 pivots named with conditions.

  4. 2:00–2:35 Include + wrapper + RFI matrix

    Consolidate per PATT File Inclusion rows ONLY. Add RFI allow_url_include check column (lab).

    PATT: file inclusion rows
    Why this matters ▼

    Done-when

    Matrix saved.

  5. 2:35–3:00 Poison-path test + gaps

    Explain log-poison flow without touching prod. Triage gaps (upload next).

    HackTricks: re-check poison
    Why this matters ▼

    Done-when

    Recited + matrix archived.

Hunter mindset: Read config first, RCE second.
Real 180 min · upload + exec = RCE

  1. 0:00–0:15 Bypass families: ext/MIME/magic/polyglot/SVG/archive

    List .php5/.phtml/.svg/.htaccess + image/jpeg + GIF89a + polyglot + unzip-slip. Read OWASP Upload sheet § validation checklist ONLY.

    OWASP: upload checklist
    Why this matters ▼

    Done-when

    6 families + 1 example each.

  2. 0:15–1:05 Ext/MIME/magic/polyglot/SVG/double-ext + race (lab)

    Do PortSwigger upload 9 labs (ext/MIME/content/race/polyglot) + THM uploadvulnerabilities Task 2–6 (bypass/magic/race/shell) ONLY. Proofs: magic-byte GIF89a + double-ext + SVG <svg onload> + race Turbo 1×gate (lab). YT: unrestricted file upload bypass pentest.

    Lab: race-condition upload (hardest first look)All labs: upload filter (start simple)THM: upload T2–6PATT: upload rows
    Why this matters ▼

    Done-when

    Bypass matrix (family × result) + exec proof (lab URL).

  3. 1:05–2:00 Upload→webshell critical + SVG-XXE + ImageTragick/ExifTool/ZIP-slip

    Read 1 upload→webshell critical (search file upload RCE) — bypassed check + exec URL ONLY + 1 SVG-XXE (Week 07 bridge) + ImageTragick CVE-2016-3714 / ExifTool CVE-2021-22204 / Zip-Slip pattern names ONLY.

    H1: upload RCE searchPATT: polyglot/slip rows
    Why this matters ▼

    Stacks

    Image pipelines (convert/identify) = shell-out; archives = traversal. Note .htaccess on Apache.

    Done-when

    3 vector notes with bypass + exec.

  4. 2:00–2:35 Bypass matrix + execution-proof column

    Consolidate + add .htaccess + race-timing columns.

    PATT: re-check matrix
    Why this matters ▼

    Done-when

    Matrix saved.

  5. 2:35–3:00 Magic-byte test + gaps

    Explain magic-byte bypass end-to-end. Triage gaps (exposure next).

    PortSwigger: re-check
    Why this matters ▼

    Done-when

    Recited + matrix archived.

Hunter mindset: Bypass without exec = info. Bypass + URL = RCE.
Real 180 min · exposure needs no exploit

  1. 0:00–0:15 Extension list: .bak/.old/.swp/~/ .zip/.sql/.git/.env

    Write list + tool mapping (ffuf -e). Read SecLists Discovery/Web-Content README § backup/config lists ONLY.

    SecLists: backup lists
    Why this matters ▼

    Done-when

    List + tool flags cold.

  2. 0:15–1:05 ffuf -e + .git/HEAD + .env triage (lab + gentle VDP paths)

    Run ffuf -u host/FUZZ -w common.txt -e .bak,.old,.zip,.sql -mc 200,403 -fc 404 (1 small list) + /.git/HEAD + /.env + config.php~ GET-only checks. WSTG INFO-03 metafiles § objectives ONLY. nuclei http/exposures/configs/ + http/exposures/backups/ on LAB ONLY.

    ffuf -e flagsWSTG: INFO-03nuclei: exposures (lab)
    Why this matters ▼

    X

    Search ".git exposed" bugbounty for git-dumper replay pattern.

    Done-when

    Ext fuzz + 3 triage results.

  3. 1:05–2:00 .git-leak + secrets.yml prod-key cases

    Read H1 #768322 (.git → code → chain: /.git/HEAD + git-dumper replay) FULL + 1 secrets.yml prod-key (read-only s3 ls/endpoint 200 proof, redacted) — validation ONLY.

    H1 #768322 .git leakpentester.land: secrets.yml key
    Why this matters ▼

    Surprise

    .git = full source = more bugs. One exposure funds the rest of the hunt.

    Done-when

    2 validation flows (redacted).

  4. 2:00–2:35 Partial-capture + stop rule card

    Write card: ***-1234 capture, no full secret/PII storage, stop on sensitive data + 24h report.

    HuntBook: redaction rule
    Why this matters ▼

    Done-when

    Card saved + notes redacted.

  5. 2:35–3:00 .git-reconstruct test + gaps

    Explain HEAD → objects → dumper flow. Triage gaps (JS next).

    H1 #768322: re-check flow
    Why this matters ▼

    Done-when

    Recited + logs archived.

Hunter mindset: Capture partial, stop, report.
Real 180 min · large Swagger = under-tested surface

  1. 0:00–0:15 Secret shapes: AKIA/JWT/private-key/internal-URL

    Write 4 regexes + triage rule (verify read-only or redact). Check SecretFinder README verification rows ONLY. YT: JavaScript secrets bug bounty LinkFinder SecretFinder.

    SecretFinder: verify rows
    Why this matters ▼

    Done-when

    Shapes + rule cold.

  2. 0:15–1:05 LinkFinder + SecretFinder on 3 largest + Swagger 4-path (gentle)

    Run linkfinder.py -i app.js -o cli -d 1 + SecretFinder.py -i app.js -o cli on 3 bundles + GET /swagger/v1, /v3/api-docs, /api-docs, /openapi.json. Extract paths→keys via jq on lab spec. X: JS secrets AWS key takeover min_faves:100.

    LinkFinder runSecretFinder run
    Why this matters ▼

    Done-when

    Secrets list + Swagger endpoints + risk rank.

  3. 1:05–2:00 JS AWS-key takeover + Swagger under-tested API

    Read 1 JS AWS-key takeover (aws sts get-caller-identity read-only validation) + 1 Swagger hidden-route BOLA (Week 10 bridge) — validation ONLY, redacted.

    PATT: key→takeover validationpentester.land: Swagger hidden API
    Why this matters ▼

    Done-when

    2 validation flows (redacted).

  4. 2:00–2:35 Validation log + risk rank (no damage)

    Log each secret: value(redacted) → validation (safe read/200) → risk → stop point. Never use keys beyond proof.

    HuntBook: safe validation
    Why this matters ▼

    Done-when

    Log saved, all redacted.

  5. 2:35–3:00 Safe-validation test + gaps

    Recite validation ladder (regex → read-only → redact → stop). Triage gaps.

    SecretFinder: re-check
    Why this matters ▼

    Done-when

    Recited + log archived.

Hunter mindset: Validate read-only, then stop.
Real 180 min · misconfig enables higher bugs

  1. 0:00–0:15 CSP/HSTS/cookie/TLS fields + debug paths

    List headers + /actuator/*, /debug, /console, /.env. Read testssl README --fast row ONLY.

    testssl --fast row
    Why this matters ▼

    Done-when

    Fields + paths cold.

  2. 0:15–1:05 testssl + header table + debug inventory (2 hosts, gentle)

    Run ./testssl.sh --fast host:443 + header table (CSP/HSTS/cookies) + debug-endpoint GETs on 2 hosts. Check actuator auth (Week 07 bridge): mappings vs 401/403.

    testssl runHackTricks: actuator auth
    Why this matters ▼

    Done-when

    Table + TLS + debug results.

  3. 1:05–2:00 Debug-panel RCE + TLS-misconfig note

    Read 1 debug-panel RCE (Django/Rails debug=true → console) + 1 TLS-misconfig (HSTS absent/weak cipher) — trigger + impact ONLY.

    pentester.land: debug/TLSH1: debug mirror
    Why this matters ▼

    Surprise

    Debug + version strings are Week 07/CVE fuel — log versions here, match NVD later.

    Done-when

    2 trigger→impact notes.

  4. 2:00–2:35 Panel-auth checklist + version log

    Checklist: endpoint × auth × data. Log versions → KEV match (no exploit).

    CISA KEV match
    Why this matters ▼

    Done-when

    Checklist + version log.

  5. 2:35–3:00 Misconfig-impact test + gaps

    Summarize how each misconfig enables a higher bug. Triage gaps.

    WSTG: INFO-03 re-check
    Why this matters ▼

    Done-when

    Recited + table archived.

Hunter mindset: Headers today, shells tomorrow.
Real 180 min · 500 = injection hint, version = CVE

  1. 0:00–0:15 Error shapes: stack/SQL/version/path

    List shapes + example strings. Read WSTG INFO-05 content-review § objectives ONLY.

    WSTG: INFO-05All labs: info-disclosure filter
    Why this matters ▼

    Done-when

    4 shapes + 1 example each.

  2. 0:15–1:05 Forced 404/500 collection + bodies saved (lab + gentle VDP)

    Force errors (' " \ .. ; {{7*7}} singles, observe only) on lab + 2 VDP pages. Save bodies. Note SQL/stack/version/path leaks. No fuzz floods.

    WSTG: error drill
    Why this matters ▼

    Done-when

    Error log with bodies (redacted as needed).

  3. 1:05–2:00 Stack-trace DB-leak + version→CVE RCE

    Read 1 stack-trace (DB creds/SQL in trace) + 1 version→CVE RCE (banner → NVD → patched-version diff) — leaked string + match ONLY.

    pentester.land: trace/CVENVD: version match
    Why this matters ▼

    LinkedIn/X

    X: "information disclosure" bug bounty triaged for version-info gate debates.

    Done-when

    2 leak→match notes.

  4. 2:00–2:35 HTML comments + source-maps review

    Review comments + .js.map (Week 02 bridge) for keys/paths. Update version map → KEV.

    LinkFinder: map re-check
    Why this matters ▼

    Done-when

    Comment/map findings + version update.

  5. 2:35–3:00 Error-triage test + gaps

    Recite triage (shape → leak → match → impact). Triage gaps (live hunt next).

    WSTG: re-check
    Why this matters ▼

    Done-when

    Recited + log archived.

Hunter mindset: Errors are free recon. Log them.
Real 180 min · sweep order: upload → backup → JS → errors

  1. 0:00–0:15 Sweep plan + no-PII rule recall

    Write order + redaction rule (***-1234, no storage). Check WSTG checklist INFO + BUSL-08 malicious-upload rows ONLY.

    WSTG: INFO+BUSL-08
    Why this matters ▼

    Done-when

    Plan + rule cold.

  2. 0:15–1:05 Upload matrix + backup fuzz + JS re-scan (VDP, gentle)

    Run Day-2 matrix (safe extensions only, no webshell on live) + Day-3 ffuf -e (1 small) + Day-4 JS re-scan (2 bundles). Safe probes, redacted captures.

    PATT: safe matrix rowsffuf -e gentleSecretFinder re-scan
    Why this matters ▼

    YT

    Search swagger API hidden endpoints bounty if Swagger signals appear.

    Done-when

    Matrix + fuzz + re-scan logged (redacted).

  3. 1:05–2:00 Same-program exposures (2, redacted)

    Read H1 hacktivity same-program (upload/exposure/git/JS) 2 — vector + validation ONLY, redacted. Compare your sweep gaps.

    H1: same-program exposureH1: mirror
    Why this matters ▼

    Done-when

    2 vectors + gap paragraph (redacted).

  4. 2:00–2:35 Exposure playbook + duplicate check

    Update playbook (upload/backup/JS/errors). Dup-check pentester.land + H1 before drafting. Kill unvalidated regex hits.

    pentester.land: dup check
    Why this matters ▼

    Done-when

    Playbook + dup result + kills.

  5. 2:35–3:00 Disclosure-ethics test + gaps to Week 10

    Recite redaction + stop + 24h rules. Assign gaps (API/logic) to Week 10.

    HuntBook: ethics + handoffCommunity: lab solutions by topic (attempt first)
    Why this matters ▼

    Done-when

    Recited + archive + assignments.

Hunter mindset: Redact first, ask impact later.