CWICP cheat sheet

HTTP/1.1 persistent connections are the default; the server keeps the TCP connection open unless the client sends Connection: close or the response includes it.

Idempotent methods are GET, HEAD, PUT, DELETE, OPTIONS, and TRACE; POST and PATCH are not idempotent, so automatic retries are unsafe for them.

Status class rules: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error; 401 means unauthenticated while 403 means authenticated but not permitted.

Cache-Control directives: no-store forbids caching entirely, no-cache requires revalidation before reuse, private restricts storage to the browser, max-age sets freshness lifetime in seconds.

Same-origin is defined by scheme, host, and port all matching; a different port on the same host is a different origin.

Cookies are matched by Domain and Path attributes, not by port, so a cookie set on example.com:8080 is also sent to example.com:443.

HTTP/2 multiplexes streams over one TCP connection with HPACK header compression, so header-based filtering must decode HPACK before inspecting.

A request body encoded as application/x-www-form-urlencoded uses percent-encoding with + for space; multipart/form-data uses boundary-delimited parts and is the default for file uploads.

Passive reconnaissance never touches target infrastructure: certificate transparency logs (crt.sh), WHOIS/RDAP, DNS history, search engine caches, and job postings reveal hosts and technologies without target-side logs.

Certificate transparency search by domain returns subdomains because every publicly trusted certificate is logged with its Subject Alternative Names.

DNS record types that matter: A/AAAA (addresses), CNAME (aliases), MX (mail hosts), TXT (SPF, DKIM, verification tokens), NS (delegation), SOA (zone authority).

Zone transfer attempt: query the authoritative NS for AXFR; success indicates misconfiguration, failure is the expected secure state.

Subdomain brute forcing compares response codes and body sizes; wildcard DNS makes every name resolve, so a baseline random-name response must be subtracted.

Fingerprinting signals: Server and X-Powered-By headers, cookie names, default error pages, favicon hashes, robots.txt and sitemap.xml entries, and TLS certificate metadata.

Search operators: site: restricts to a domain, filetype: or ext: filters by extension, inurl: and intitle: match URL and title content.

Scope is defined before scanning; active scanning of out-of-scope hosts is unauthorized testing regardless of intent.

Credential stuffing replays breached username/password pairs; password spraying tries one common password across many accounts, staying under lockout thresholds.

Username enumeration indicators: differing response bodies, status codes, or timing between valid and invalid accounts on login and password-reset flows.

Session token strength is judged by length and entropy: a token needs enough random bits that guessing is infeasible; predictable sequences, timestamps, or hashed usernames fail.

Session fixation: if the session identifier is unchanged after successful login, an attacker who pre-set the cookie can reuse the authenticated session.

Cookie attributes to verify: Secure (HTTPS only), HttpOnly (no JavaScript access), SameSite=Strict or Lax (CSRF mitigation), and a bounded Expires/Max-Age.

Logout must invalidate the token server-side; a token that still works after logout is a session management flaw.

MFA bypass checks: response manipulation, direct navigation past the MFA step, code reuse, missing rate limit on code submission, and backup-code weakness.

Password reset tokens must be single-use, time-limited, and bound to the account; a token embedded in a URL leaks via Referer headers and logs.

IDOR occurs when an object reference (ID, filename, GUID) is used without a server-side ownership check; testing swaps the reference between two accounts of equal privilege.

Vertical privilege escalation moves to a higher role (user to admin); horizontal escalation stays at the same role but accesses another user's data.

Missing function-level access control: an administrative endpoint that only hides its UI link but does not check role on the server is directly reachable.

Forced browsing tests whether URLs, API routes, and backup files are protected by authorization rather than only by absence of links.

Multi-tenant isolation must be enforced server-side from the session's tenant, never from a client-supplied tenant ID, header, or subdomain alone.

Role matrix testing: enumerate every role and every endpoint, then verify each cell returns allow or deny as designed; gaps are the findings.

JWT authorization flaws: accepting alg:none, trusting the kid header for path traversal, or reading role claims without verifying the signature.

Deny-by-default is the reference design; allow-lists per role and per object are auditable, while scattered inline checks are not.

SQL injection classes: in-band (union, error-based), blind (boolean, time-based), and out-of-band via DNS or HTTP callbacks; parameterized queries are the structural fix.

Union-based SQLi requires matching column count and compatible types; ORDER BY n increments until an error reveals the column count.

NoSQL injection often abuses operator objects such as {"$ne": null} or {"$gt": ""} where a string was expected; type confusion is the root cause.

Command injection separators: ; | || & && ` $() and newline; blind detection uses time delays (sleep, ping -c) or out-of-band callbacks.

SSTI payloads like {{7*7}} evaluate to 49 in Jinja2/Twig; the fix is not blacklisting but rendering user data as data, never as template source.

XXE requires an XML parser with external entity resolution enabled; a DOCTYPE with SYSTEM file:// or an external DTD confirms it, and out-of-band DTDs bypass response filtering.

SSRF targets internal ranges (127.0.0.1, 169.254.169.254, RFC1918) and cloud metadata endpoints; allow-list destination hosts and block redirects to internal addresses.

LDAP injection uses * ) ( | & characters to alter filters; escaping per RFC 4515 is the mitigation.

Reflected XSS echoes input in the immediate response; stored XSS persists server-side; DOM XSS arises from client-side sinks such as innerHTML, document.write, eval, and location assignment.

Context determines encoding: HTML body, attribute, URL, JavaScript string, and CSS each need different escaping; HTML-encoding inside a script block does not stop execution.

Content-Security-Policy with script-src 'unsafe-inline' or overly broad hosts weakens XSS defense; nonce- or hash-based policies are the strong form.

CSRF requires a state-changing request with ambient credentials and no unpredictable token; SameSite cookies and per-request tokens are the standard defenses.

Clickjacking is countered by X-Frame-Options: DENY/SAMEORIGIN or CSP frame-ancestors; the absence of both permits framing.

postMessage handlers must verify event.origin and never pass received data to eval or innerHTML; a wildcard targetOrigin '*' leaks data to any opener.

CORS misconfiguration: Access-Control-Allow-Origin reflected from the request plus Allow-Credentials: true lets any site read authenticated responses.

Open redirect parameters (return, next, redirect_uri) accept absolute URLs; validation must use an allow-list of paths, not substring matching.

TLS 1.2 and 1.3 are acceptable; SSLv3, TLS 1.0, and TLS 1.1 are deprecated and should be disabled.

Cipher suites with RC4, 3DES, or export-grade strength are weak; prefer AEAD suites such as AES-GCM and ChaCha20-Poly1305.

HSTS (Strict-Transport-Security) with max-age and includeSubDomains forces HTTPS; the preload list hardcodes it in browsers.

Certificate validation failures to test: expired cert, hostname mismatch, self-signed chain, incomplete intermediate chain, and weak signature algorithm like SHA-1.

Symmetric encryption uses one shared key (AES); asymmetric uses a public/private pair (RSA, ECDSA) for key exchange and signatures.

Hashing (SHA-256, bcrypt, Argon2) is one-way and for integrity or passwords; encryption is reversible and for confidentiality; never store passwords with reversible encryption.

Password storage: bcrypt, scrypt, or Argon2 with per-user salt; MD5 and SHA-1 are unsuitable for password hashing.

Secure randomness comes from a CSPRNG; predictable sources such as Math.random or time-based seeds break tokens, keys, and reset codes.

Directory listing enabled exposes files not linked anywhere; the fix is disabling autoindex (Apache Options -Indexes, Nginx autoindex off).

Default credentials on admin panels, databases, and management consoles are a common high-impact finding; test documented defaults and blank passwords.

Unnecessary HTTP methods (PUT, DELETE, TRACE) should be disabled; TRACE enabling cross-site tracing is a configuration weakness.

Verbose errors and stack traces leak paths, versions, and framework details; production should return generic errors and log details server-side.

Security headers to check: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy.

Cloud storage exposure: an S3 or blob bucket that allows anonymous list or read is a data exposure; test with unauthenticated requests.

Backup and config files (.git/, .env, .bak, web.config, .DS_Store) in the web root are retrievable and often contain secrets.

Server version disclosure via banners and headers aids targeted exploitation; suppress version strings where the platform allows.

A WAF is a signature and heuristic filter, not a fix; the underlying vulnerability remains and must be remediated in code.

WAF deployment modes: inline (blocking), out-of-band (monitoring only), and reverse-proxy vs. cloud-hosted; each affects what traffic is inspected.

Evasion levers: encoding (URL, double URL, Unicode, HTML entities), case variation, comment insertion, whitespace alternatives, and payload splitting across parameters.

Signature bypass works because filters match known patterns; semantically equivalent payloads that the parser accepts but the filter misses are the test.

Rate limiting and IP reputation are WAF functions; testing should distinguish a block (403, challenge page) from a rate-limit response (429).

False positives are a WAF risk: overly strict rules break legitimate input, so tuning and exception lists are part of operation.

Client-side filtering (JavaScript validation) is bypassed by sending requests directly with a proxy; server-side validation is the only control that counts.

Logging and alerting matter: a WAF that blocks but does not log gives no detection signal for incident response.

A finding states: title, severity, affected asset, reproduction steps, evidence, impact, and remediation; missing reproduction steps makes a report unactionable.

Severity frameworks (CVSS base score, or impact x likelihood) give consistent triage; CVSS 9.0-10.0 critical, 7.0-8.9 high, 4.0-6.9 medium, 0.1-3.9 low.

Remediation advice is specific and structural: parameterized queries, output encoding by context, server-side authorization, patched dependencies.

Ethics: test only within written scope and authorization; stop at proof of concept, never exfiltrate real data, and report findings to the client first.

Responsible disclosure gives the vendor time to fix before public detail; coordinated disclosure is the default professional norm.

Never test production data destructively; use the least intrusive proof and document any side effects.

Retest verifies the fix; a closed ticket without retest is not a confirmed remediation.

Reports separate confirmed findings from observations and note testing limitations so readers do not over-trust coverage.