{"id":461,"date":"2025-10-24T15:00:23","date_gmt":"2025-10-24T15:00:23","guid":{"rendered":"https:\/\/people.utm.my\/abdulghafar\/?page_id=461"},"modified":"2026-05-09T08:59:37","modified_gmt":"2026-05-09T08:59:37","slug":"web-defacement-attack","status":"publish","type":"page","link":"https:\/\/people.utm.my\/abdulghafar\/web-defacement-attack\/","title":{"rendered":"Ethical Hacking 5:"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Web defacement is a cyberattack where an attacker gains unauthorized access to a website and alters its visual content, often replacing legitimate pages with propaganda, threats, or offensive messages. These attacks typically exploit vulnerabilities in web applications or weak administrative controls and aim to damage reputations, spread misinformation, or deliver political messages. This lab provides step-by-step instructions for executing web defacement so that security practitioners can safely observe indicators of compromise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You may need to change the IP address in the IIS configuration. Click Windows Start Button -&gt; Internet Information Services -&gt; Select WebSite &gt; Bindings -&gt; Select or Add Port 80 &gt; Click Edit &gt; Choose IP Address From The Drop Down List -&gt; Click Ok.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Disclaimer:<\/strong>&nbsp;<strong>This article is suitable for intermediate and expert users and only for education.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"490\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface1-1024x490.jpg\" alt=\"\" class=\"wp-image-463\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface1-1024x490.jpg 1024w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface1-300x144.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface1-768x368.jpg 768w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface1.jpg 1494w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Open a web browser and type the IP address selected from the IIS configuration. Success configuration will result in the following web content:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"411\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface2-1024x411.jpg\" alt=\"\" class=\"wp-image-465\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface2-1024x411.jpg 1024w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface2-300x120.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface2-768x308.jpg 768w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface2.jpg 1212w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Use any exploitation technique in lab Activity: Exploitation &amp; Clearing Traces<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure the connection to the target server successfully establish<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"79\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface3-1024x79.jpg\" alt=\"\" class=\"wp-image-467\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface3-1024x79.jpg 1024w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface3-300x23.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface3-768x59.jpg 768w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface3-1536x118.jpg 1536w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface3.jpg 1614w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Type pwd and hit enter<\/p>\n\n\n\n<figure class=\"wp-block-image size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"59\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface4-300x59.jpg\" alt=\"\" class=\"wp-image-469\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface4-300x59.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface4.jpg 394w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Type cd .. (change the directory)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Type pwd and hit enter<\/p>\n\n\n\n<figure class=\"wp-block-image size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"92\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface5-300x92.jpg\" alt=\"\" class=\"wp-image-471\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface5-300x92.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface5.jpg 355w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Type cd .. (change the directory)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Type pwd and hit enter<\/p>\n\n\n\n<figure class=\"wp-block-image size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"98\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface6-300x98.jpg\" alt=\"\" class=\"wp-image-472\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface6-300x98.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface6.jpg 316w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Download any deface file and place into \/home\/kali (the default directory used by Metasploit to upload and download).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Type dir and hit enter (list target directory)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"448\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface7.jpg\" alt=\"\" class=\"wp-image-473\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface7.jpg 1024w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface7-300x131.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface7-768x336.jpg 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Note:<br>i. Folder name Source contains a source file for the web content.<br>ii. In an actual attack, you need to search the source folder of the web content by predicting the folder name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Type cd Source and hit enter<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Type dir and hit enter<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1003\" height=\"460\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface8.jpg\" alt=\"\" class=\"wp-image-476\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface8.jpg 1003w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface8-300x138.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface8-768x352.jpg 768w\" sizes=\"auto, (max-width: 1003px) 100vw, 1003px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Type del and hit enter (delete original file)<\/p>\n\n\n\n<figure class=\"wp-block-image size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"25\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface9-1-300x25.jpg\" alt=\"\" class=\"wp-image-479\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface9-1-300x25.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface9-1.jpg 402w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Type upload index.html and hit enter (deface file)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"898\" height=\"87\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface10.jpg\" alt=\"\" class=\"wp-image-480\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface10.jpg 898w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface10-300x29.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface10-768x74.jpg 768w\" sizes=\"auto, (max-width: 898px) 100vw, 898px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Type shell and hit enter (to go into Windows CMD)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Type iisreset and hit enter (restart Windows Server IIS)<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"735\" height=\"372\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface11.jpg\" alt=\"\" class=\"wp-image-482\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface11.jpg 735w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface11-300x152.jpg 300w\" sizes=\"auto, (max-width: 735px) 100vw, 735px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Browse the web server content by using the web server IP address (Deface successfully)<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"350\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface12-1024x350.jpg\" alt=\"\" class=\"wp-image-483\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface12-1024x350.jpg 1024w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface12-300x102.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface12-768x262.jpg 768w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2025\/10\/Deface12.jpg 1075w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Web defacement is a cyberattack where an attacker gains unauthorized access to a website and alters its visual content, often replacing legitimate pages with propaganda, threats, or offensive messages. These attacks typically exploit vulnerabilities in web applications or weak administrative controls and aim to damage reputations, spread misinformation, or deliver political messages. This lab provides [&hellip;]<\/p>\n","protected":false},"author":25922,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-461","page","type-page","status-publish","hentry","entry"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages\/461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/users\/25922"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/comments?post=461"}],"version-history":[{"count":21,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages\/461\/revisions"}],"predecessor-version":[{"id":545,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages\/461\/revisions\/545"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/media?parent=461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}