Server-side attacks and the file system

What this path is#

Injection showed you input crossing into a database query or an HTML page. This path goes after the server itself, the machine and its file system, where the impact is highest. Here your input makes the server read a file it should not, fetch a URL you chose, parse data in a dangerous way, or run a command. The findings on this shelf are the ones that end in reading source code, stealing cloud credentials, or executing commands on the box: full server compromise.

You will learn path traversal and file inclusion, file-upload-to-code-execution, command injection, server-side request forgery, XML external entities and web-service testing, server-side template injection, and insecure deserialization. Most lessons end in a real Academy lab.

Who it is for#

• Anyone who finished Injection and wants the highest-impact bug classes.
• Someone preparing for an entry-level web-application penetration testing exam. This path covers the security-testing and web-service objectives (traversal, upload RCE, LFI/RFI, command injection, SSRF, XXE, components, web services) those exams assess, built on the public OWASP Web Security Testing Guide. It is not affiliated with, or endorsed by, any exam vendor and uses none of their material.

The plan#

1. Thinking server-side. The instinct: the server acts on your input.
2. Path traversal and file inclusion. Reading files outside the intended folder.
3. File upload to code execution. Getting a script into a place the server runs.
4. Command injection. Making the server run your shell commands.
5. Server-side request forgery (SSRF). Making the server fetch a URL you choose.
6. XXE and web services. Turning an XML parser into a file reader.
7. Server-side template injection. When your input is evaluated as an expression.
8. Deserialization and vulnerable components. Hostile objects and known-broken libraries.

Before you start#

Finish Injection first; several bugs here are injection with a different interpreter. You need a browser, curl, and an intercepting proxy. This path reaches the highest impact, command execution, credential theft, so the scope line is absolute: only against targets you are authorised to test, and always with the gentlest proof. On this Academy's labs you are always in scope and the environments are disposable.