unauthorized-access-common-services

An offensive-security playbook in the yaklang hack-skills collection, focused on exploiting common infrastructure services that are exposed without authentication, during authorized penetration testing. Per its description it targets management interfaces and data services such as Redis, Rsync, PHP-FPM, AJP/Ghostcat (the Tomcat AJP connector), Hadoop YARN, and the H2 database console — cases where a service reachable on the network lacks proper authentication or network restrictions. It is framed as an expert reference for testers assessing the exposure of internal and internet-facing services and demonstrating the impact of misconfiguration. In a catalog context it is network and infrastructure penetration-testing tooling used to identify and prove risk from unauthenticated services so they can be locked down. Because it can lead to data access or code execution on affected systems, it should be used only against services the tester is authorized to assess. Operations and security teams can use the same service list as a hardening checklist: require authentication, restrict network exposure, and monitor access to Redis, Rsync, PHP-FPM, AJP, Hadoop, H2, and similar interfaces.