Thoughts on website bypass intrusion and necessary conditions

What is "Side Note:As its name implies, it is injection from the side, that is, penetration by a virtual site on the host.
After we get a webshell with an important joint,
Use open programs on the host and some cross-site intrusion methods based on non-security settings.

Side-note process: 
1. Use tools or website WHOIS information you want to attack to obtain the domain name registration information of the website and determine whether the host is a virtual host,
In this way, injection can be performed from the side.

2. To view all website programs on the server, you must be familiar with the programming of each program and the functions of the program. (You can go to the source site to view the source code all day,
In this way, you will know how to separate programs)

3. Use all existing vulnerabilities to obtain webshells

4. view the system services opened by the host (this method is used to obtain the path of the target website)
For example, the user configuration file of Serv-u (not used to improve permissions) is the user configuration file of IIS (a large number of user paths will be leaked)
LOG of anti-virus software (this is unavoidable)

5. Try not to access the Admin permission of the website server (to avoid unnecessary troubles ))

6. We recommend that you use more than two ASP Trojans (ASP webmaster Assistant/hacker Trojan)

Additional ideas!

For example, if you want to intrude into website A, but cannot find the vulnerability on website! You can select website B on the same server as website A and website C to find vulnerabilities.
Upload vulnerabilities, SQL injection, and elevation of permissions after obtaining webshell. Find the directory of website A on the server...
What are the requirements and issues to pay attention to? I saw a good post in the red/Black alliance today. It provides detailed technical ideas for the bypass!
It is worth reading! This article describes the technical logic of the bypass, but the content is not detailed due to space reasons (or the author may be too lazy!
As a supplement to everyone's ideas and great expansion !!!!
Side-by-side attention is an idea. It is not a pure method of line intrusion because of Administrator settings and functional defects of programs,
It is useless to watch articles all day, just in vain