Hands-On Web Penetration Testing with Metasploit

Chapter 10

1. Different Drupal versions have different architectures and different features. If an exploit is based on Drupal's core components, it can be used for older versions as well. Other module- and plugin-based exploits may not work in the case of different Drupal versions.

2. It is a good practice to install Drupal locally to test an exploit. If we are successful in exploiting Drupal locally, then we can use the same exploit on a remote Drupal site.

3. Sometimes, there's a Web Application Firewall (WAF) placed in front of the web application, meaning that an exploit doesn't run successfully. In that case, we can either obfuscate or encode the payload used in the exploit and bypass WAF protection.

4. If we have access to the Drupal administrator ...