9.3.0 Stage 03: Initial Access
← Main index | Strategy map | Study methods: Turn application weaknesses into access; Select and adapt public exploits; Establish sessions and move files; Check which other hosts your current identity can access
Purpose: convert a validated service/application primitive into useful access or verified execution, then establish and verify the resulting session or application privilege.
| Task | Use it to |
|---|---|
| Obtain an authorized interactive desktop session | Connect to an assigned Windows host and recognize the resulting source position |
| Web file handling | Separate traversal, inclusion, upload/write and executable handling |
| Command and SQL injection | Prove OS command execution or manually exploit SQL query control |
| Check whether application permissions or browser execution enable useful access | Validate object/role/API weaknesses and useful browser-context execution |
| WordPress and SSRF | Map WordPress capabilities/components and prove server-side fetching/internal reachability |
| Public exploit selection and adaptation | Match a PoC to exact prerequisites, audit it, repair runtime/code assumptions and independently verify its effect |
Exit condition: useful application privilege or operating-system execution is verified under a named identity/context. After OS access, verify host and identity, re-enumerate, and hand session reliability to Block 7; use file transfer when tools or evidence must cross hosts.