> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/cms.md).

# Exploração de CMS

Notas de exploração de CMS e painéis de administração focadas em enumeração, bypass de autenticação, abuso de plugins, RCE por upload de arquivo, cadeia de LFI para RCE, execução de comandos e entrega de shell reverso.

## Fluxo de Exploração de CMS

1. Identifique a aplicação, framework, CMS, versão, plugins, temas, módulos e painéis de administração expostos.
2. Enumere usuários, comportamento de login, arquivos de backup, recursos de upload, rotas de API, páginas de depuração e vazamentos públicos de configuração.
3. Verifique credenciais padrão, senhas fracas, fluxos de redefinição de senha, gerenciamento de sessão e bypasses de autenticação.
4. Valide CVEs conhecidas, vulnerabilidades de plugins, cadeias de LFI para RCE, injeção de comandos e caminhos de upload de arquivos.
5. Converta o acesso em um web shell controlado ou shell reverso, preservando exatamente o caminho de exploração.
6. Documente credenciais, payloads, prova de conceito e a passagem pós-exploração de forma clara.

## Seções Focadas

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-wordpress" style="color:$primary;">:wordpress:</i></h3></td><td><h4>WordPress</h4></td><td>Notas de pentest de WordPress para enumeração, WPScan, descoberta de plugins, força bruta em xmlrpc.php, RCE autenticada, plugins vulneráveis, LFI e credenciais vazadas.</td><td><a href="/pages/b05dfd2586f8aa2425145e82765680b2803fe398">/pages/b05dfd2586f8aa2425145e82765680b2803fe398</a></td></tr><tr><td><h3><i class="fa-database" style="color:$primary;">:database:</i></h3></td><td><h4>phpMyAdmin</h4></td><td>Notas de exploração do phpMyAdmin para RCE específica de versão, LFI para RCE, abuso de arquivos de sessão, injeção de comandos, descoberta de portas internas e shells reversos.</td><td><a href="/pages/9cb4b70d8e46d39d4c315d0eb5438678b5ef7311">/pages/9cb4b70d8e46d39d4c315d0eb5438678b5ef7311</a></td></tr><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Tomcat</h4></td><td>Notas de exploração do Apache Tomcat para acesso ao manager, força bruta de credenciais padrão, implantação de payload WAR, abuso do gerenciador em texto e shells reversos.</td><td><a href="/pages/a13696a58a3e65df34c2cb2d5fda4140ded1311d">/pages/a13696a58a3e65df34c2cb2d5fda4140ded1311d</a></td></tr><tr><td><h3><i class="fa-drupal" style="color:$primary;">:drupal:</i></h3></td><td><h4>Drupal</h4></td><td>Notas de pentest de Drupal para enumeração com Droopescan, manipulação de solicitações de redefinição de senha, RCE no Drupal 7, exploração do CVE-2018-7602 e shells reversos.</td><td><a href="/pages/6943f75ae657d2421bbcb05e0170c15c60b63eb9">/pages/6943f75ae657d2421bbcb05e0170c15c60b63eb9</a></td></tr><tr><td><h3><i class="fa-floppy-disk" style="color:$primary;">:floppy-disk:</i></h3></td><td><h4>Duplicati</h4></td><td>Notas de exploração do Duplicati para segredos de configuração em SQLite, bypass de autenticação de login, recuperação da frase-senha, abuso da restauração de backup e extração de arquivos sensíveis.</td><td><a href="/pages/984e94a177a46765723486258131e65cdd0324db">/pages/984e94a177a46765723486258131e65cdd0324db</a></td></tr><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Nostromo</h4></td><td>Notas de exploração do Nostromo para execução remota de comandos do CVE-2019-16278, entrega de shell reverso, revisão da configuração HomeDirs e descoberta de conteúdo protegido de usuários.</td><td><a href="/pages/3c4b7e219c49c9c1707f8aae2e277dd91b119d08">/pages/3c4b7e219c49c9c1707f8aae2e277dd91b119d08</a></td></tr><tr><td><h3><i class="fa-helmet-safety" style="color:$primary;">:helmet-safety:</i></h3></td><td><h4>HardHat C2</h4></td><td>Notas de exploração do HardHat C2 para bypass de autenticação JWT, forja de token de administrador, criação de usuário TeamLead, abuso do terminal ImplantInteract e RCE.</td><td><a href="/pages/14d70b64b43681d33b97736efcb1942dd4f8f9a6">/pages/14d70b64b43681d33b97736efcb1942dd4f8f9a6</a></td></tr></tbody></table>

### Notas Independentes

<table><thead><tr><th data-type="content-ref"></th></tr></thead><tbody><tr><td><a href="/pages/dff3280790afc422b155bcc6760f4ade90d4fad1">/pages/dff3280790afc422b155bcc6760f4ade90d4fad1</a></td></tr><tr><td><a href="/pages/499882ba5496323489e53c73f1bb179cd389b1b4">/pages/499882ba5496323489e53c73f1bb179cd389b1b4</a></td></tr><tr><td><a href="/pages/420ee081348316256ea7cd4cbbc709fa4bf7e57b">/pages/420ee081348316256ea7cd4cbbc709fa4bf7e57b</a></td></tr><tr><td><a href="/pages/d95e4795b104206efb518d1567c4510d89b16da6">/pages/d95e4795b104206efb518d1567c4510d89b16da6</a></td></tr><tr><td><a href="/pages/84e64f6164126591cc7df6cc1e1c0d4cb7218f2d">/pages/84e64f6164126591cc7df6cc1e1c0d4cb7218f2d</a></td></tr><tr><td><a href="/pages/d749e843681869f37f0708be68855530b42adbe9">/pages/d749e843681869f37f0708be68855530b42adbe9</a></td></tr><tr><td><a href="/pages/4258fb88d567070846dfd09cf5c254e9c833dfce">/pages/4258fb88d567070846dfd09cf5c254e9c833dfce</a></td></tr><tr><td><a href="/pages/e88dd90950158e6adf0db91a7ab6c4280fec6e51">/pages/e88dd90950158e6adf0db91a7ab6c4280fec6e51</a></td></tr><tr><td><a href="/pages/8aa79b875341c1a6343e919fd8ae75307658bd74">/pages/8aa79b875341c1a6343e919fd8ae75307658bd74</a></td></tr><tr><td><a href="/pages/3285c02652b23807af7ab8368ffc907f39d1424a">/pages/3285c02652b23807af7ab8368ffc907f39d1424a</a></td></tr><tr><td><a href="/pages/d5869401f6217c9d52ada2de34c01aab13389de0">/pages/d5869401f6217c9d52ada2de34c01aab13389de0</a></td></tr><tr><td><a href="/pages/dd932973dada472bee9f83987e4e52e7fd87c23c">/pages/dd932973dada472bee9f83987e4e52e7fd87c23c</a></td></tr><tr><td><a href="/pages/924c9e218726fbc524a12070ca581202e2e0cd0b">/pages/924c9e218726fbc524a12070ca581202e2e0cd0b</a></td></tr><tr><td><a href="/pages/24c4856e72da6244353e2543e7864dee8dbe1109">/pages/24c4856e72da6244353e2543e7864dee8dbe1109</a></td></tr><tr><td><a href="/pages/9e51109d69e7d8325694de405ff5fe8c8167c9b0">/pages/9e51109d69e7d8325694de405ff5fe8c8167c9b0</a></td></tr><tr><td><a href="/pages/f969d9e6989634d01113be40b0cd7d7eda697883">/pages/f969d9e6989634d01113be40b0cd7d7eda697883</a></td></tr><tr><td><a href="/pages/6d2e671af0e22f72d424945b47104b50ba7c44c8">/pages/6d2e671af0e22f72d424945b47104b50ba7c44c8</a></td></tr><tr><td><a href="/pages/f52187b603c614564cb28b644a1b8ff5a1c60333">/pages/f52187b603c614564cb28b644a1b8ff5a1c60333</a></td></tr><tr><td><a href="/pages/d29fc3e40d2b7dc9dce1fefdec22c10f9ac4a0fa">/pages/d29fc3e40d2b7dc9dce1fefdec22c10f9ac4a0fa</a></td></tr><tr><td><a href="/pages/99592a96febbd22a95949050bda916895ad6a243">/pages/99592a96febbd22a95949050bda916895ad6a243</a></td></tr><tr><td><a href="/pages/67ab8b623bc8baa66a3ea971c854cf34739dc0d5">/pages/67ab8b623bc8baa66a3ea971c854cf34739dc0d5</a></td></tr><tr><td><a href="/pages/3f286a39edf0d524a75b183e53adf3f07aaf548f">/pages/3f286a39edf0d524a75b183e53adf3f07aaf548f</a></td></tr><tr><td><a href="/pages/b4a206f67e9ec969452cc433b01005bbe5fe46a4">/pages/b4a206f67e9ec969452cc433b01005bbe5fe46a4</a></td></tr><tr><td><a href="/pages/f17bbbb4033f0c9af9b4f8372cc6622ee5b2fab2">/pages/f17bbbb4033f0c9af9b4f8372cc6622ee5b2fab2</a></td></tr><tr><td><a href="/pages/e0f668eea9d822143f4d47086e62610ae7c60c6f">/pages/e0f668eea9d822143f4d47086e62610ae7c60c6f</a></td></tr><tr><td><a href="/pages/47541eb0a40f5c1fa4196035867decb5c335cf6e">/pages/47541eb0a40f5c1fa4196035867decb5c335cf6e</a></td></tr><tr><td><a href="/pages/9f004a59f881907268d610f53b9f8222302ad487">/pages/9f004a59f881907268d610f53b9f8222302ad487</a></td></tr><tr><td><a href="/pages/89e7f053bd86bbefbcd485c20407bae89983083a">/pages/89e7f053bd86bbefbcd485c20407bae89983083a</a></td></tr><tr><td><a href="/pages/52210559fa7a113fdf1836fbe9f382da83c6955d">/pages/52210559fa7a113fdf1836fbe9f382da83c6955d</a></td></tr><tr><td><a href="/pages/60b8310a9268e74f64eb493342c36818baec81e6">/pages/60b8310a9268e74f64eb493342c36818baec81e6</a></td></tr><tr><td><a href="/pages/485d4701204bc9a0e56a0a5307adbe211507579d">/pages/485d4701204bc9a0e56a0a5307adbe211507579d</a></td></tr><tr><td><a href="/pages/5b14bb8582c237a5c2ca26baae1d7b481e1d3402">/pages/5b14bb8582c237a5c2ca26baae1d7b481e1d3402</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/pt-br/cms.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.