eWPTX cheat sheet

SQL injection UNION extraction requires matching column count and compatible data types; determine count with ORDER BY incrementing until error, or NULL-padding.

Boolean-based blind SQLi differs from time-based: the former infers truth from response content/length changes, the latter from deliberate delay functions (SLEEP, pg_sleep, WAITFOR DELAY).

Second-order SQL injection stores the payload in the database and triggers it on a later query; input validation at the entry point does not protect the sink.

NoSQL injection operators ($ne, $gt, $regex, $where) can bypass authentication when user input is passed unsanitized into query objects; test with JSON bodies, not just query strings.

Server-Side Template Injection is confirmed by injecting arithmetic like {{77}} and observing 49; engine fingerprinting proceeds via distinct syntax (${77}, <%= 77 %>, #{77}).

Command injection blind detection uses out-of-band channels (DNS/HTTP callbacks) or time delays; semicolon, pipe, backtick, and $() are common separators.

XXE requires an XML parser with external entity resolution enabled; test with a DOCTYPE declaring an entity pointing to file:///etc/passwd or an external DTD for OOB exfiltration.

Deserialization flaws (Java, PHP, Python pickle, .NET) allow gadget-chain RCE; identify magic methods (__wakeup, readObject) and known library gadget chains.

SSRF is validated by pointing the server at an internal address (127.0.0.1, 169.254.169.254) or a collaborator listener; filter bypasses include decimal/octal IP encodings and DNS rebinding.

Engagement scoping defines in-scope hosts, testing windows, and prohibited actions (e.g., DoS, social engineering); out-of-scope discoveries are documented, not exploited.

Rules of engagement should specify emergency stop contact, data handling for exfiltrated evidence, and whether production data may be accessed.

Reconnaissance order: passive OSINT (certificate transparency, DNS records, Shodan) precedes active scanning to minimize detection and footprint.

Findings are rated by likelihood and impact (CVSS as a reference, not a verdict); business context can raise or lower severity above the raw score.

Proof-of-concept evidence should demonstrate the minimum impact needed to prove the finding (e.g., read one file, not the whole database).

A retest verifies remediation of reported findings; unchanged findings are re-reported with updated evidence and status.

Chain-of-custody and timestamped logs of every action support the report's credibility and any later legal or audit use.

Reporting structure: executive summary (risk in business terms), technical findings (reproduction steps, evidence, remediation), and appendices (tool output, scope).

Cleanup after testing includes removing uploaded webshells, test accounts, and scheduled tasks, and confirming the target is in its original state.