https://blog.kernelstub.dev/tags/pentesting/Recent content in Pentesting on Prepakis Georgios | Kernelstub | Security ResearcherHugoen-USMon, 16 Feb 2026 00:00:00 +0000https://blog.kernelstub.dev/posts/a-full-infrastructure-takeover-on-gsis.gr/Mon, 16 Feb 2026 00:00:00 +0000https://blog.kernelstub.dev/posts/a-full-infrastructure-takeover-on-gsis.gr/<p><strong>Table of Contents</strong></p> <ul> <li><a href="#phase-1-massive-reconnaissance-with-skuntscan">Phase 1: Massive Reconnaissance with SkuntScan</a></li> <li><a href="#phase-2-the-exposed-configuration-that-broke-everything">Phase 2: The Exposed Configuration That Broke Everything</a></li> <li><a href="#phase-3-ftp-and-the-forgotten-server">Phase 3: FTP and the Forgotten Server</a></li> <li><a href="#phase-4-oracle-webcenter-leaks-and-ldap-access">Phase 4: Oracle webCenter Leaks and LDAP Access</a></li> <li><a href="#phase-5-hardcoded-jwt-private-key">Phase 5: Hardcoded JWT Private Key</a></li> <li><a href="#phase-6-server-status-as-a-network-mapping-tool">Phase 6: Server-Statme as a Network Mapping Tool</a></li> <li><a href="#phase-7-iis-short-names-and-aspnet-backend">Phase 7: IIS Short Names and ASP.NET Backend</a></li> <li><a href="#phase-8-domibus-424--finding-the-zero-day">Phase 8: Domibme 4.2.4 – Finding the Zero-Day</a></li> <li><a href="#phase-9-from-xxe-to-ssh-on-borisgsisgr">Phase 9: From XXE to SSH on boris.gsis.gr</a></li> <li><a href="#phase-10-axis2-admin-service--deploying-a-backdoor">Phase 10: Axis2 Admin Service – Deploying a Backdoor</a></li> <li><a href="#phase-11-privilege-escalation-to-root">Phase 11: Privilege Escalation to Root</a></li> <li><a href="#phase-12-internal-network-pivot--the-1019318024-discovery">Phase 12: Internal Network Pivot – The 10.193.18.0/24 Discovery</a></li> <li><a href="#phase-13-staging-authentix-auth-and-the-database-goldmine">Phase 13: STAGING-AUTHENTIX-AUTH and the Database Goldmine</a></li> <li><a href="#phase-14-switches-firewalls-and-control-surfaces">Phase 14: Switches, Firewalls, and Control Surfaces</a></li> <li><a href="#phase-15-15-million-citizens--what-i-found">Phase 15: 15 Million Citizens – What I Found</a></li> </ul> <h2 id="phase-1-massive-reconnaissance-with-skuntscan">Phase 1: Massive Reconnaissance with SkuntScan</h2> <p>Every engagement starts with comprehensive reconnaissance. SkuntScan, our in‑house tool, combines passive enumeration with intelligent fingerprinting. It scrapes certificate transparency logs, DNS records, web archives, and then correlates everything with IP space to build a complete map of the target.</p>