A complete penetration testing documentation of a vulnerable **Drupal CMS** machine performed inside a controlled VMware laboratory environment using Kali Linux.
This repository documents every phase of the penetration testing process, including reconnaissance, enumeration, exploitation, information disclosure, database enumeration, privilege escalation, and remediation.
> **Educational Purpose:** This project was completed in an isolated lab environment for cybersecurity learning and documentation.
The objective of this lab was to compromise a vulnerable Drupal web application without any initial credentials and document the complete attack lifecycle.
* Investigate sensitive configuration files.
| Phase | Description |
| -------------------- | -------------------------------------------- |
| Reconnaissance | Target identification and host verification. |
| Enumeration | Service scanning and directory discovery. |
| Exploitation | Drupal Remote Code Execution. |
| Post Exploitation | Configuration and database enumeration. |
| Privilege Escalation | Root access through Linux misconfiguration. |
| Remediation | Security recommendations and hardening. |
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
