Advanced SQL Injection, XSS, LFI and RFI Techniques
Domain 2 tests detection and exploitation depth across four web vulnerability classes. You are expected to justify each payload by the parser context it targets, prove impact with the least harmful action possible, and separate confirmed exploitation from scanner noise.
SQL injection: pick the technique by feedback channel
In-band attacks need the right column count - increment ORDER BY n until the query errors. Blind boolean attacks compare differentials such as ' AND '1'='1 against ' AND '1'='2, measuring response length, hash or status. Time-based attacks use SLEEP(5) on MySQL, pg_sleep(5) on PostgreSQL, and WAITFOR DELAY '0:0:5' on MSSQL when no other channel exists. Out-of-band extraction uses DNS or HTTP callbacks when output is suppressed entirely. Second-order injection executes in a later query after the payload is stored. sqlmap automation should be aimed, not sprayed: --technique=BEUST, --dbms, --level=5 --risk=2, and a --tamper script chosen for the specific WAF.
XSS: the sink defines the payload
Reflected, stored and DOM-based XSS each need a context-matched payload: <script> in HTML body, an attribute breakout such as " onmouseover=, a string escape like '-alert(1)-' inside JavaScript, or javascript: in a URL sink. HttpOnly blocks cookie theft, not the XSS itself. CSP may block inline script - look for JSONP endpoints or dangling markup instead.
LFI and RFI
Local file inclusion starts with traversal such as ../../../../etc/passwd, testing depth and encodings (%2e%2e%2f, double encoding). PHP wrappers extend it: php://filter/convert.base64-encode/resource=index.php reads source code, php://input turns a POST body into a script, and log poisoning writes a payload into the User-Agent field then includes the access log. Remote file inclusion only works when allow_url_include is enabled; host a benign file and confirm it executes.
Worked example
The parameter ?id=1 returns a product page. Appending a single quote yields a 500 error, suggesting an unhandled quote. 1' AND '1'='1 returns the normal page while 1' AND '1'='2 returns empty content - boolean blind injection confirmed. 1' AND SLEEP(5)-- - produces a five-second delay, giving a stable extraction channel for automation. The report includes the raw request, response length deltas and timing evidence.
Traps that cost marks
- Reporting a WAF block page as a vulnerability.
- Confusing LFI with plain traversal of a static file that never reaches an interpreter.
- Sending
alert(1)everywhere without context breakout. - Testing only GET parameters and ignoring headers, cookies and JSON bodies.