Border breakthrough (internal share notes) penetration process

General penetration process:

1. Information gathering
   
   1. Asset information collection
      1. Next to the station
      2. Subdomain
      3. Public network ip, etc.
   2. Personal information collected
      personal mailbox
      
      
2. Extranet breakthrough
   1. Acquisition target public authority
      Webshell
      server system privileges
   2. Environmental rights within the target PC,
      individual employee PC,
3. Intranet breakthrough
   
   1. Determining the network topology
   2. Detecting other hosting services
   3. Looking for other network assets
   4. Determining the target location
4. Lateral movement

Cracking

1. Injection
   SQL injection
2. Failure of the authentication, sensitive data leakage
   weak passwords, password cracking
   source code leak
   Cookie forgery, Cookie bypass the
   database file disclosure
   logic bypass the login
   backup file
   password recovery