RIS602 Lab 3 Timestamps: Web & Database Attack Chapters
1. Introduction and Attack Chain Overview
Salah introduces the lab on attacking vulnerable web and database services, outlining the full attack chain and the five stages of the attack.
2. Deploying and Using Tomcat Web Shell
Creating a GSP web shell, packaging it into a WAR file, deploying it via Tomcat manager, and executing non-interactive commands through the shell.
3. Privilege Escalation via Windows Sticky Keys
Explaining and demonstrating privilege escalation by replacing sethc.exe with cmd.exe to gain a fully interactive system shell through the Windows login screen.
4. Exploiting Jenkins Script Console for Command Execution
Using Jenkins built-in script console to run Groovy code for OS-level command execution on a separate machine with admin access.
5. Compromising Microsoft SQL Server
Using Metasploit to authenticate to MSSQL with weak credentials, enabling xp_cmdshell, and executing OS commands through the database server.
6. Extracting Windows Password Hashes
Exporting registry hives via xp_cmdshell, sharing and downloading them over SMB, and extracting NLM password hashes for offline cracking and pass-the-hash attacks.
7. Conclusion and Lab Summary
Recap of the chained attack steps, highlighting how each vulnerability led to the next, privilege escalation simplicity, database to OS compromise, and credential theft impact.
[0:00] Introduction and Attack Chain Overview Salah introduces the lab on attacking vulnerable web and database services, outlining the full attack chain and the five stages of the attack. [2:00] Deploying and Using Tomcat Web Shell Creating a GSP web shell, packaging it into a WAR file, deploying it via Tomcat manager, and executing non-interactive commands through the shell. [15:00] Privilege Escalation via Windows Sticky Keys Explaining and demonstrating privilege escalation by replacing sethc.exe with cmd.exe to gain a fully interactive system shell through the Windows login screen. [23:00] Exploiting Jenkins Script Console for Command Execution Using Jenkins built-in script console to run Groovy code for OS-level command execution on a separate machine with admin access. [27:00] Compromising Microsoft SQL Server Using Metasploit to authenticate to MSSQL with weak credentials, enabling xp_cmdshell, and executing OS commands through the database server. [31:00] Extracting Windows Password Hashes Exporting registry hives via xp_cmdshell, sharing and downloading them over SMB, and extracting NLM password hashes for offline cracking and pass-the-hash attacks. [37:00] Conclusion and Lab Summary Recap of the chained attack steps, highlighting how each vulnerability led to the next, privilege escalation simplicity, database to OS compromise, and credential theft impact.
Heads up!
These timestamps were automatically generated using AI with the Free YouTube Video Timestamp Tool by LunaNotes.
Generate timestamps for freeRelated Videos
SQL for Beginners Timestamps: Learn SQL Step-by-Step Chapters
Explore the detailed timestamps for our beginner-friendly SQL course to quickly navigate through essential SQL concepts and hands-on exercises. These chapters enable you to efficiently skip to topics from basic queries to advanced database management, enhancing your learning experience.
Week 6 Session 1 Timestamps: Database Logical Design Explained
Explore the comprehensive chapter breakdown of Week 6 Session 1 focusing on the logical design of database schemas. These timestamps guide you through essential theory on structuring data, relationships between tables, and creating efficient database designs for practical applications.
HTTP vs HTTPS vs SSL vs TLS: Video Timestamps Explained
Explore clearly defined chapters breaking down how web security works with HTTP, HTTPS, SSL, and TLS. These timestamps help you navigate the video to understand internet privacy, encryption, and the technology that keeps your data safe online.
Next.js 16 Full Course Timestamps | Build & Deploy Full Stack App
Explore the detailed chapter breakdowns of this comprehensive Next.js 16 full course. Use these timestamps to easily navigate through essential topics like routing, UI development, API building, database modeling, and deployment strategies, making your learning experience efficient and organized.
Microsoft Azure Fundamentals AZ-900 Timestamps – Pass Exam Fast
Explore detailed timestamps for the Microsoft Azure Fundamentals Certification Course (AZ-900). This chapter breakdown helps you navigate key topics efficiently and master exam essentials in just 8 hours. Use these chapters to streamline your study and boost your confidence for passing the certification.
Most Viewed
Anjali Schmuck SPLITSVILLA 16 Timestamps: Connection, Fight & More
Explore detailed timestamps breaking down Anjali Schmuck's revelations about her connections, conflicts, and experiences on SPLITSVILLA 16. These chapters help viewers navigate key moments for a deeper understanding of the show's behind-the-scenes drama and personal stories.
Etsy Ads Timestamps: 2026 Strategy Guide Breakdown
Explore the detailed chapter breakdowns of the 2026 Etsy Ads Strategy Guide video to easily navigate key topics like when to start ads, how they work, and tips for success. These timestamps help you understand and implement profitable Etsy ad campaigns effectively for your shop growth.
Complete CA Inter FM Revision Chapters with Timestamps
इस पेज पर CA Intermediate Finance Management के वीडियो के सभी चैप्टर्स और महत्वपूर्ण टॉपिक्स के टाइमस्टैम्प्स दिए गए हैं, जिससे आप आसानी से अपने रिवीजन को व्यवस्थित कर सकते हैं। यहाँ प्रत्येक चैप्टर का लॉजिक समझाया गया है और कठिन प्रश्नों का समाधान भी मिलता है। कंटेंट को फॉलो कर आप अपना फाइनेंसियल मैनेजमेंट मजबूत बना सकते हैं।
OpenClaw Proactive Chapters: Tools, Skills, Heartbeats & Crons
इस वीडियो के टाइम्पस्टैम्प्स से आपको OpenClaw एजेंट के सेटअप में टूल्स, स्किल्स, हार्टबीट्स और क्रोंस की विस्तार से समझ मिलेगी। प्रत्येक चैप्टर आपको उपकरणों और कौशलों के उपयोग में मार्गदर्शन करता है, जिससे आपकी सेटअप प्रक्रिया सरल और प्रभावी बनती है।
AI Search Timestamps: How SEO Works in 2026 Explained
Explore detailed chapters breaking down how AI search functions in 2026 from an SEO professional's perspective. These timestamps help you navigate key topics such as AI vs traditional SEO, major AI models, and practical strategies for SEO agencies.

