web

Files (18)

• SKILL.md
• blind-sqli.md
• business-logic.md
• command-injection.md
• crypto.md
• cve.md
• deserialization.md
• file-upload.md
• graphql.md
• idor.md
• lfi.md
• race-condition.md
• smuggling.md
• sqli.md
• ssrf.md
• ssti.md
• xss.md
• xxe.md

SKILL.md (first lines)

# Web Application Exploitation — Category Overview

This is a **routing skill**. It helps you identify the correct attack technique, then directs you to the specialized sub-skill with full exploitation procedures.

## Attack Technique Routing

Match the target's characteristics to the right sub-skill:

| Sub-Skill | Covers | When to Load | Path |
|-----------|--------|-------------|------|
| **sqli** | Union/Error/Blind/Time-based SQL injection, sqlmap | SQL database, query parameters, login forms, search, filtering | `load_skill("/skills/exploit/web/sqli.md")` |
| **blind-sqli** | Manual WAF-bypass companion to sqli — token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, exponential-probe binary search | Load AFTER sqli when sqlmap with `--tamper` cannot pass the WAF but a binary oracle (two distinct page states) exists; challenge tag is `blind_sqli` with active filtering | `load_skill("/skills/exploit/web/blind-sqli.md")` |
| **xss** | Reflected/stored/DOM XSS, bot exfiltration, CSP bypass | Client-side JS injection, bot/report URL, cookie stealing | `load_skill("/skills/exploit/web/xss.md")` |
| **ssti** | Jinja2, Twig, Freemarker, ERB, Razor template injection | Template rendering, `{{}}` or `${}` in output, Flask/Symfony/Java | `load_skill("/skills/exploit/web/ssti.md")` |
| **ssrf** | Cloud metadata, internal service access, Gopher smuggling | URL fetch parameter, redirect, internal network access | `load_skill("/skills/exploit/web/ssrf.md")` |
| **xxe** | XML entity injection, SOAP/WSDL, blind OOB | XML processing, SOAP endpoints, XML file uploads | `load_skill("/skills/exploit/web/xxe.md")` |
| **lfi** | Path traversal, PHP wrappers, log poisoning | File path parameters, `../`, include/require, file download | `load_skill("/skills/exploit/web/lfi.md")` |
| **command-injection** | OS command injection, blind/OOB, filter bypass | System commands, ping/traceroute, exec, subprocess | `load_skill("/skills/exploit/web/command-injection.md")` |
| **deserialization** | Java/PHP/.NET/Python deserialization RCE | Serialized objects, base64 blobs, ViewState, pickle | `load_skill("/skills/exploit/web/deserialization.md")` |
| **idor** | Authorization bypass, ID enumeration, privilege escalation | Object references, sequential IDs, UUIDs, access control | `load_skill("/skills/exploit/web/idor.md")` |
| **file-upload** | Webshell upload, extension/content-type bypass | File upload forms, unrestricted upload | `load_skill("/skills/exploit/web/file-upload.md")` |
| **graphql** | Introspection, SQLi via resolvers, auth bypass | GraphQL API, /graphql endpoint, GQL queries | `load_skill("/skills/exploit/web/graphql.md")` |
| **race-condition** | TOCTOU, parallel POST/GET races, session-write-before-verdict, quota/balance/coupon double-spend | bcrypt/Argon2 auth, check-then-act, slow-op widening race window, challenge tag includes race_condition/toctou/concurrent | `load_skill("/skills/exploit/web/race-condition.md")` |
| **smuggling** | HTTP request smuggling (HRS) — CL.TE/TE.CL/TE.TE, CL.0, HTTP/2 downgrade (h2.cl, h2.te, CR/LF injection), pipelining, connection-state pinning | Multi-proxy/CDN frontend, differential 4xx/5xx on duplicate or obfuscated TE/CL headers, two `Server:` strings, h2 frontend with h1 backend, challenge tag includes smuggling_desync/request_smuggling/hrs/desync | `load_skill("/skills/exploit/web/smuggling.md")` |
| **crypto** | Padding oracle (Vaudenay), AES-CBC bit-flipping, ECB block substitution, JWT alg confusion, hash-length extension | Base64 cookie/token w/ length %16 or %8, distinct invalid-pad vs auth-fail responses, JWT, repeated 16-byte ciphertext blocks, challenge tag includes `crypto`/`cipher`/`oracle`/`captcha` | `load_skill("/skills/exploit/web/crypto.md")` |
| **business-logic** | POST-body privilege fields, 2FA bypass, predictable TOTP codes, hidden auth headers, multi-step workflow tampering | Challenge tag includes `business_logic`, `privilege_escalation`, `2fa_bypass`, `auth_bypass` (not pure IDOR/JWT) | `load_skill("/skills/exploit/web/business-logic.md")` |
| **cve** | Known CVE exploitation — fingerprint → `cve_lookup` → `cve_poc_lookup` → adapt PoC → flag sweep; CMS/plugin/framework version-specific vulnerabilities | Challenge tag includes `cve`, recon fingerprinted a versioned CMS/framework/plugin, challenge name hints at specific software (WordPress, Joomla, Struts, Spring4Shell, Log4j) | `load_skill("/skills/exploit/web/cve.md")` |

## Quick Detection — Which Attack Type?

Run these probes to identify which sub-skill to load:

```bash
# 1. SQL Injection — single quote error
curl -s 'https://<TARGET>/page?id=1%27' -o /dev/null -w '%{http_code}'

# 2. SSTI — math evaluation
curl -s 'https://<TARGET>/page?input={{7*7}}' | grep -o '49'

# 3. XSS — reflection check
curl -s 'https://<TARGET>/search?q=<script>test</script>' | grep '<script>test'

# 4. LFI — path traversal
curl -s 'https://<TARGET>/file?name=../../../etc/passwd' | grep 'root:'

# 5. Command Injection — command chaining
curl -s 'https://<TARGET>/ping?host=127.0.0.1;id' | grep 'uid='

# 6. SSRF — localhost access
curl -s 'https://<TARGET>/fetch?url=http://127.0.0.1/' -o ssrf_test.txt

# 7. XXE — XML acceptance
curl -s 'https://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>'

# 8. GraphQL — endpoint discovery
curl -s 'https://<TARGET>/graphql' -H 'Content-Type: application/json' -d '{"query":"{ __typename }"}'
```

## Decision Flow

```
Web target identified?
├── Has query parameters → Try sqli.md, then ssti.md
├── Has file/path parameters → Try lfi.md
├── Has URL/fetch parameters → Try ssrf.md
├── Has search/input reflection → Try xss.md
├── Has file upload form → Try file-upload.md
├── Accepts XML input → Try xxe.md
├── Has /graphql endpoint → Try graphql.md
├── Has ping/exec functionality → Try command-injection.md
├── Has serialized data (cookies, POST) → Try deserialization.md
├── Has object IDs in URLs → Try idor.md
├── Tag/hint includes race/concurrent/toctou → Try race-condition.md
├── Tag/hint includes smuggling/desync/hrs OR multi-proxy stack detected → Try smuggling.md
├── Tag/hint includes crypto/cipher/oracle/captcha OR base64 cookie %16==0 with distinct pad-vs-auth errors → Try crypto.md
├── Tag includes business_logic / privilege_escalation / 2fa_bypass / auth_bypass → Try business-logic.md
├── Tag includes cve OR challenge description mentions a specific CVE/plugin vulnerability → Load cve.md
└── Unknown → Run quick detection probes above
```

## CVE / Known-Exploit Methodology

For CVE-class exploitation, load `cve.md` (full procedure includes fingerprinting → `cve_lookup` tool call → `cve_poc_lookup` → PoC adaptation → flag sweep).
Once the CVE class is identified (SQLi/LFI/RCE/auth bypass), also load the matching attack-class sub-skill (`sqli.md`, `lfi.md`, `command-injection.md`, etc.) for the continuation primitive.

## Payload Pacing — Cross-Technique Rule

After 3 payloads of the **same bypass class** against the same endpoint all produce the same-class negative result (all blocked / all 404 / all no-reflection), pivot to the **next bypass class** from the sub-skill's cookbook. Do not iterate further within the exhausted class.

| Blocked class | Next class to try |
|---|---|
| `<script>` tag variants | Event handlers (`onerror`, `onload`, `onfocus`, `ontoggle`) |
| Event handlers | javascript: URL / srcdoc iframe |
| javascript: URL | Template literal / charcode encoding |
| Quote-escape SQLi | UNION-based or stacked-query |
| `;cmd` injection | Backtick / `$()` subshell |
| `{{7*7}}` Jinja2 | `${7*7}` Freemarker, `<%= 7*7 %>` ERB |

A "class" is the **bypass mechanism**, not the payload string. Three payloads that differ only in the injected JS expression (e.g. `alert(1)` → `alert(2)` → `confirm(1)`) are ONE class.

After exhausting 3 bypass classes on the same endpoint: the endpoint is hardened. Write `exploit/PIVOT.md` and switch to a different endpoint or vulnerability class from recon SUMMARY.md.

## Sub-Skill Loading Rule

**ALWAYS load the specialized sub-skill before executing any attack.** This overview provides routing only — the sub-skills contain the actual exploitation procedures, tool commands, bypass techniques, and decision trees needed for successful exploitation.

For the agent loop (intake handoff verification, confirm-gate phase, verification, silent-stall recovery, three-strike rule) see the root workflow at `load_skill("/skills/exploit/workflow.md")`.

From DebasishTripathy13/Pandora, Apache-2.0.

More from DebasishTripathy13/Pandora