HTB CWEE cheat sheet

Content discovery decision rule: if the target returns a uniform 200 for random paths (soft 404), filter by response length, status, and content-type deltas rather than status code alone.

Directory brute-force wordlists should be layered: small high-signal lists (common.txt, raft-small) first, then technology-specific lists keyed to detected stack (e.g., WordPress, Tomcat, Spring).

Fingerprinting signals: Server and X-Powered-By headers, cookie names (PHPSESSID, JSESSIONID, ASP.NET_SessionId), error page signatures, and default file paths such as /actuator, /server-status, /web.config.

Vhost and subdomain enumeration requires Host-header brute-force against a single IP; compare response body length and status against a baseline Host to detect virtual hosts.

JavaScript files are a primary recon source: grep bundled JS for endpoints, API base URLs, feature flags, hardcoded keys, and GraphQL operation names.

robots.txt, sitemap.xml, .well-known/, and security.txt disclose intended and unintended paths; 401/403 responses on discovered paths indicate authentication boundaries worth probing.

Parameter discovery via arjun or ffuf with GET/POST/JSON fuzzing reveals hidden parameters accepted by endpoints; parameters ignored by the app are filtered by response diffing.

Technology version mapping to CVE requires confirming the exact version from headers, static asset hashes, or error strings before attempting exploits; unconfirmed versions produce false positives.

IDOR test pattern: capture an object reference (numeric ID, UUID, filename), swap it for a value belonging to another account, and compare the response to the owner's baseline response.

Horizontal vs vertical: horizontal escalation accesses another user's resource at the same privilege; vertical escalation reaches higher-privilege functionality (admin endpoints, role fields).

Mass assignment: add fields such as role, isAdmin, verified, or balance to JSON bodies; if the server binds them without an allowlist, privilege changes persist.

JWT-less session pitfalls: predictable session tokens, tokens not rotated on login, tokens accepted after logout, and cookies missing HttpOnly/Secure/SameSite attributes.

Password reset logic flaws: host-header injection into reset links, reset tokens derived from predictable values (email, timestamp), token reuse, and missing token expiry.

Authorization must be enforced server-side per request; UI hiding of admin links is not a control. Test by replaying privileged requests with a low-privilege session.

OAuth/SSO account takeover vectors: missing state parameter (CSRF), redirect_uri wildcard or path traversal, and unverified email claims from the identity provider.

Forced browsing to /admin, /internal, /api/v1/admin after authentication often reveals missing role checks that the UI never links to.

SQLi detection: single quote causes error or behavioral change; boolean-based payloads (' AND 1=1-- vs ' AND 1=2--) produce differing responses; time-based (SLEEP(5), pg_sleep(5)) confirms blind injection.

UNION-based requires matching column count and compatible types; ORDER BY n incrementing until error reveals column count.

NoSQLi (MongoDB): operator injection via {"$ne": null} or {"$gt": ""} in JSON bodies bypasses auth; $where with JavaScript enables blind boolean extraction.

Command injection separators: ; | || & && ` $() newline. Blind confirmation via out-of-band DNS/HTTP callbacks (Burp Collaborator) or time delays (sleep 5).

SSTI detection: ${77}, {{77}}, <%= 77 %>, #{77} in input fields; reflected 49 confirms template evaluation. Engine fingerprint by payload syntax acceptance.

SSTI exploitation: Jinja2 uses {{config.class.init.globals['os'].popen('id').read()}}; Twig uses {{_self.env.registerUndefinedFilterCallback('system')}}.

LDAP injection: )(uid=))(|(uid=* manipulates filter logic; test with * and )( to detect filter breakage in login forms.

XPath injection: ' or '1'='1' -- in XPath expressions; error messages revealing XPath syntax confirm injectability.

XSS types: reflected (payload in immediate response), stored (persisted server-side), DOM-based (sink reached via client-side source such as location.hash or postMessage).

DOM sinks to grep: innerHTML, outerHTML, document.write, eval, setTimeout(string), location assignment, jQuery .html(), and Angular/Vue template bindings.

CSRF defense requirements: unpredictable per-request token tied to session, SameSite=Lax/Strict cookies, and Origin/Referer validation; token presence alone is insufficient if it is not validated.

Prototype pollution: JSON payloads with proto or constructor.prototype keys; sinks include Object.assign, lodash merge, jQuery $.extend(true, ...), and library config parsing.

Prototype pollution to RCE in Node: pollute Object.prototype with shell/env options consumed by child_process.spawn or EJS/Pug render options.

DOM clobbering: HTML elements with id/name create global variables; can shadow window.config and bypass scripts expecting configuration objects.

postMessage handlers must validate event.origin and event.source; missing checks allow cross-origin data injection into privileged frames.

CSP bypass considerations: JSONP endpoints on allowlisted domains, AngularJS on allowlist with ng-app, base-uri missing allowing tag hijack, and dangling markup injection.

SSRF confirmation: point a URL parameter at a Collaborator host and observe the callback; blind SSRF is proven by DNS/HTTP interaction from the server.

SSRF filter bypasses: decimal/octal/hex IP encoding (2130706433, 0177.0.0.1, 0x7f000001), IPv6 ::1, DNS rebinding, and redirects from an allowlisted host.

Cloud metadata endpoints: AWS http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP requires header Metadata-Flavor: Google, Azure uses /metadata/instance?api-version=.

Path traversal: ../ and encoded variants (%2e%2e%2f, ..%2f, %252e%252e%252f for double decoding); test with /etc/passwd or win.ini and check for content reflection.

LFI to RCE chains: log poisoning (User-Agent into access.log), PHP session file inclusion, /proc/self/environ, and php://filter/convert.base64-encode/resource=index.php for source disclosure.

File upload bypass: extension blacklists defeated by .phtml/.php5/.phar, content-type and magic-byte spoofing (GIF89a header), .htaccess upload, and filename traversal in upload path.

Insecure deserialization signatures: Java rO0AB (base64) or aced0005 (hex), PHP O:4:"User", Python pickle 80 04, .NET AAEAAAD/////.

Deserialization exploitation requires a gadget chain on the classpath; ysoserial (Java), PHPGGC (PHP), and ysoserial.net generate payloads keyed to detected libraries.

JWT attacks: alg:none acceptance, HS256 key confusion using the public key as HMAC secret, weak secret cracking with hashcat -m 16500, and kid/jku header injection.

JWT claims to inspect: iss, aud, exp, nbf, sub, and custom role/admin claims; missing aud or exp validation enables token reuse across services.

OAuth flow checks: authorization code replay, PKCE downgrade, redirect_uri path matching flaws, implicit flow token leakage in Referer, and scope escalation via modified scope parameter.

GraphQL introspection query __schema reveals types and mutations; if disabled, use field-suggestion errors and Clairvoyance-style wordlists to reconstruct the schema.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, mutation authorization gaps, and IDOR in node(id:) global ID lookups.

WebSocket testing: cross-site WebSocket hijacking occurs when the handshake lacks CSRF protection; Origin header is not an authorization control by itself.

Cloud-integrated services: presigned URL scope escalation, S3 bucket listing when ACLs allow, IMDSv1 credential theft, and Lambda/API Gateway authorizer bypass via path normalization.

API versioning gaps: /v1 may lack authorization checks present in /v2; always enumerate older versions and undocumented methods (PUT, PATCH, DELETE) on discovered endpoints.

Chain design rule: each primitive must supply the input the next requires (e.g., SSRF reads metadata credentials, credentials access internal API, API returns deserialization endpoint).

Pivot inventory: harvested credentials, cloud IAM keys, internal hostnames from error pages, and network ranges from /etc/hosts or cloud metadata before moving laterally.

Reverse shell reliability: prefer bind or scheduled callbacks when egress filtering blocks outbound; test both TCP and DNS-based channels.

Linux privilege escalation triage: sudo -l, SUID binaries (GTFOBins), cron jobs, capabilities (getcap -r /), and writable service files.

Credential reuse across services is common in lab and real environments; test harvested passwords against SSH, databases, admin panels, and cloud APIs before brute force.

Persistence and cleanup in authorized engagements require documented scope; out-of-scope pivots invalidate the report and may breach the rules of engagement.

Evidence collection: timestamped screenshots, raw request/response pairs, and command transcripts per finding, stored with hashes for integrity.

Finding structure: title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and references - each finding self-contained.

Severity scoring uses CVSS v3.1 base metrics (AV, AC, PR, UI, S, C, I, A); environmental and temporal adjustments are documented separately from the base score.

Reproduction steps must be exact: full URLs, headers, payloads, and account roles so a developer can replay without guessing.

Remediation guidance names the control (parameterized queries, allowlist validation, server-side authorization checks) rather than generic advice like "sanitize input".

Impact statements translate technical flaws into business consequence (data exposure, account takeover, regulatory breach) with the affected data class named.

Executive summary avoids jargon, states overall risk posture, counts findings by severity, and highlights the top exploitable chains.

Retest evidence closes the loop: state the original finding, the fix applied, and the verification result with a date.

Communication norms: agree disclosure timelines and contact channels before testing; escalate critical findings immediately rather than waiting for the final report.

Soft-404 filtering compares response length, word count, and content-type against a random-path baseline; status code alone is unreliable on custom error handlers.

Vhost discovery sends requests with varying Host headers to one IP; a differing body length or status versus the baseline Host indicates a distinct virtual host.

JS bundle review yields API base paths, GraphQL operation names, feature flags, and sometimes embedded credentials; treat minified bundles as primary source, not noise.

Default admin surfaces worth checking: /actuator/env (Spring), /server-status (Apache), /console (H2), /_debug_toolbar (Django), and /elmah.axd (.NET).

Technology-specific wordlists outperform generic lists once the stack is fingerprinted; run generic first, then stack-keyed lists.

Parameter fuzzing with arjun or ffuf reveals accepted-but-undocumented parameters; diff responses to discard parameters the app ignores.

Confirm exact software versions before mapping CVEs; header-only version strings can be spoofed or stripped by proxies, so corroborate with error pages or asset hashes.

IDOR confirmation requires two accounts: request object A with session B and compare against the legitimate owner's response; a 200 with data is proof, a 403 is not.

Mass assignment test: append role, isAdmin, verified, or balance fields to profile-update JSON and re-fetch the profile to see if the change persisted.

Session fixation test: set a known session cookie before login; if the server does not issue a new token after authentication, fixation is possible.

Password reset flaws to test: Host-header poisoning of reset links, token predictability, token reuse after use, and no expiry window.

JWT session handling checks: token accepted after logout, token not rotated on privilege change, and missing HttpOnly/Secure/SameSite on the cookie.

OAuth account takeover: omit state (CSRF), manipulate redirect_uri with path traversal or wildcard, and test unverified email claims from the IdP.

Authorization is per-request server-side; replay privileged requests (admin endpoints, role changes) with a low-privilege session to prove missing checks.

Forced browsing to /admin, /internal, /api/v1/admin after login often surfaces endpoints the UI never links to but the server never protects.

SQLi boolean test: ' AND 1=1-- versus ' AND 1=2--; differing responses confirm injectability, and ORDER BY n until error reveals column count for UNION.

Blind SQLi timing: SLEEP(5) on MySQL, pg_sleep(5) on PostgreSQL, WAITFOR DELAY '0:0:5' on MSSQL; measure baseline latency first to avoid false positives.

NoSQLi operator injection: {"username":{"$ne":null},"password":{"$ne":null}} bypasses naive MongoDB auth; $where with JavaScript enables blind extraction.

Command injection separators: ; | || & && ` $() and newline; blind confirmation via Collaborator DNS callback or sleep 5 in the injected command.

SSTI detection payloads: ${77}, {{77}}, <%= 77 %>, #{77}; a reflected 49 confirms template evaluation and narrows the engine.

SSTI exploitation: Jinja2 {{config.class.init.globals['os'].popen('id').read()}}; Twig {{_self.env.registerUndefinedFilterCallback('system')}}.

LDAP injection: )(uid=))(|(uid=* manipulates filter logic; a lone * or )( in login fields causing filter errors confirms injectability.

XPath injection: ' or '1'='1' -- inside XPath expressions; verbose XPath errors confirm the injection point.

XSS classification: reflected (payload in immediate response), stored (persisted server-side), DOM-based (source to sink entirely client-side, e.g., location.hash into innerHTML).

DOM sinks to grep: innerHTML, outerHTML, document.write, eval, setTimeout(string), location assignment, jQuery .html(), and Angular/Vue template bindings.

CSRF defense requires an unpredictable per-request token tied to the session, SameSite=Lax/Strict cookies, and Origin/Referer validation; a token that is not validated is not a control.

Prototype pollution payloads use proto or constructor.prototype; sinks include Object.assign, lodash merge, jQuery $.extend(true, ...), and library config parsing.

Prototype pollution to RCE in Node: pollute Object.prototype with shell/env options consumed by child_process.spawn or EJS/Pug render options.

DOM clobbering: elements with id/name create globals; can shadow window.config and bypass scripts expecting configuration objects.

postMessage handlers must validate event.origin and event.source; missing checks allow cross-origin data injection into privileged frames.

CSP bypass routes: JSONP endpoints on allowlisted domains, AngularJS ng-app on allowlist, missing base-uri allowing hijack, and dangling markup injection.

SSRF confirmation: point a URL parameter at a Collaborator host and observe the callback; blind SSRF is proven by DNS/HTTP interaction from the server.

SSRF filter bypasses: decimal/octal/hex IP encoding (2130706433, 0177.0.0.1, 0x7f000001), IPv6 ::1, DNS rebinding, and redirects from an allowlisted host.

Cloud metadata: AWS http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP requires Metadata-Flavor: Google, Azure uses /metadata/instance?api-version=.

Path traversal encoding: ../, %2e%2e%2f, ..%2f, and %252e%252e%252f for double decoding; verify by reading /etc/passwd or win.ini.

LFI to RCE chains: log poisoning (User-Agent into access.log), PHP session file inclusion, /proc/self/environ, and php://filter/convert.base64-encode/resource=index.php for source disclosure.

File upload bypass: .phtml/.php5/.phar against blacklists, content-type and magic-byte spoofing (GIF89a header), .htaccess upload, and filename traversal in the upload path.

Deserialization signatures: Java rO0AB (base64) or aced0005 (hex), PHP O:4:"User", Python pickle 80 04, .NET AAEAAAD/////.

Gadget chain generators: ysoserial (Java), PHPGGC (PHP), ysoserial.net (.NET); select the chain by libraries detected on the target classpath.

JWT attacks: alg:none acceptance, HS256 key confusion using the public key as HMAC secret, weak secret cracking with hashcat -m 16500, and kid/jku header injection.

JWT claims to inspect: iss, aud, exp, nbf, sub, and custom role/admin claims; missing aud or exp validation enables token reuse across services.

OAuth flow checks: authorization code replay, PKCE downgrade, redirect_uri path matching flaws, implicit flow token leakage in Referer, and scope escalation via modified scope parameter.

GraphQL introspection query __schema reveals types and mutations; if disabled, use field-suggestion errors and Clairvoyance-style wordlists to reconstruct the schema.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, mutation authorization gaps, and IDOR in node(id:) global ID lookups.

Cross-site WebSocket hijacking occurs when the handshake lacks CSRF protection; the Origin header is not an authorization control by itself.

Cloud-integrated services: presigned URL scope escalation, S3 bucket listing when ACLs allow, IMDSv1 credential theft, and Lambda/API Gateway authorizer bypass via path normalization.

API versioning gaps: /v1 may lack authorization checks present in /v2; enumerate older versions and undocumented methods (PUT, PATCH, DELETE) on discovered endpoints.

Chain design rule: each primitive must supply the input the next requires (SSRF reads metadata credentials, credentials access internal API, API exposes deserialization endpoint).

Pivot inventory before lateral movement: harvested credentials, cloud IAM keys, internal hostnames from error pages, and network ranges from /etc/hosts or cloud metadata.

Reverse shell reliability: prefer bind or scheduled callbacks when egress filtering blocks outbound; test both TCP and DNS-based channels.

Linux privilege escalation triage: sudo -l, SUID binaries (GTFOBins), cron jobs, capabilities (getcap -r /), and writable service files.

Credential reuse across services is common; test harvested passwords against SSH, databases, admin panels, and cloud APIs before brute force.

Persistence and cleanup require documented scope; out-of-scope pivots invalidate the report and may breach the rules of engagement.

Evidence collection: timestamped screenshots, raw request/response pairs, and command transcripts per finding, stored with hashes for integrity.

Finding structure: title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and references - each finding self-contained.

Severity scoring uses CVSS v3.1 base metrics (AV, AC, PR, UI, S, C, I, A); environmental and temporal adjustments are documented separately from the base score.

Reproduction steps must be exact: full URLs, headers, payloads, and account roles so a developer can replay without guessing.

Remediation guidance names the control (parameterized queries, allowlist validation, server-side authorization checks) rather than generic advice like "sanitize input".

Impact statements translate technical flaws into business consequence (data exposure, account takeover, regulatory breach) with the affected data class named.

Executive summary avoids jargon, states overall risk posture, counts findings by severity, and highlights the top exploitable chains.

Retest evidence closes the loop: state the original finding, the fix applied, and the verification result with a date.

Communication norms: agree disclosure timelines and contact channels before testing; escalate critical findings immediately rather than waiting for the final report.

Soft-404 filtering compares response length, word count, and content-type against a random-path baseline; status code alone is unreliable on custom error handlers.

Vhost discovery sends requests with varying Host headers to one IP; a differing body length or status versus the baseline Host indicates a distinct virtual host.

JS bundle review yields API base paths, GraphQL operation names, feature flags, and sometimes embedded credentials; treat minified bundles as primary source, not noise.

Default admin surfaces worth checking: /actuator/env (Spring), /server-status (Apache), /console (H2), /_debug_toolbar (Django), and /elmah.axd (.NET).

Technology-specific wordlists outperform generic lists once the stack is fingerprinted; run generic first, then stack-keyed lists.

Parameter fuzzing with arjun or ffuf reveals accepted-but-undocumented parameters; diff responses to discard parameters the app ignores.

Confirm exact software versions before mapping CVEs; header-only version strings can be spoofed or stripped by proxies, so corroborate with error pages or asset hashes.

IDOR confirmation requires two accounts: request object A with session B and compare against the legitimate owner's response; a 200 with data is proof, a 403 is not.

Mass assignment test: append role, isAdmin, verified, or balance fields to profile-update JSON and re-fetch the profile to see if the change persisted.

Session fixation test: set a known session cookie before login; if the server does not issue a new token after authentication, fixation is possible.

Password reset flaws to test: Host-header poisoning of reset links, token predictability, token reuse after use, and no expiry window.

JWT session handling checks: token accepted after logout, token not rotated on privilege change, and missing HttpOnly/Secure/SameSite on the cookie.

OAuth account takeover: omit state (CSRF), manipulate redirect_uri with path traversal or wildcard, and test unverified email claims from the IdP.

Authorization is per-request server-side; replay privileged requests (admin endpoints, role changes) with a low-privilege session to prove missing checks.

Forced browsing to /admin, /internal, /api/v1/admin after login often surfaces endpoints the UI never links to but the server never protects.

SQLi boolean test: ' AND 1=1-- versus ' AND 1=2--; differing responses confirm injectability, and ORDER BY n until error reveals column count for UNION.

Blind SQLi timing: SLEEP(5) on MySQL, pg_sleep(5) on PostgreSQL, WAITFOR DELAY '0:0:5' on MSSQL; measure baseline latency first to avoid false positives.

NoSQLi operator injection: {"username":{"$ne":null},"password":{"$ne":null}} bypasses naive MongoDB auth; $where with JavaScript enables blind extraction.

Command injection separators: ; | || & && ` $() and newline; blind confirmation via Collaborator DNS callback or sleep 5 in the injected command.

SSTI detection payloads: ${77}, {{77}}, <%= 77 %>, #{77}; a reflected 49 confirms template evaluation and narrows the engine.

SSTI exploitation: Jinja2 {{config.class.init.globals['os'].popen('id').read()}}; Twig {{_self.env.registerUndefinedFilterCallback('system')}}.

LDAP injection: )(uid=))(|(uid=* manipulates filter logic; a lone * or )( in login fields causing filter errors confirms injectability.

XPath injection: ' or '1'='1' -- inside XPath expressions; verbose XPath errors confirm the injection point.

XSS classification: reflected (payload in immediate response), stored (persisted server-side), DOM-based (source to sink entirely client-side, e.g., location.hash into innerHTML).

DOM sinks to grep: innerHTML, outerHTML, document.write, eval, setTimeout(string), location assignment, jQuery .html(), and Angular/Vue template bindings.

CSRF defense requires an unpredictable per-request token tied to the session, SameSite=Lax/Strict cookies, and Origin/Referer validation; a token that is not validated is not a control.

Prototype pollution payloads use proto or constructor.prototype; sinks include Object.assign, lodash merge, jQuery $.extend(true, ...), and library config parsing.

Prototype pollution to RCE in Node: pollute Object.prototype with shell/env options consumed by child_process.spawn or EJS/Pug render options.

DOM clobbering: elements with id/name create globals; can shadow window.config and bypass scripts expecting configuration objects.

postMessage handlers must validate event.origin and event.source; missing checks allow cross-origin data injection into privileged frames.

CSP bypass routes: JSONP endpoints on allowlisted domains, AngularJS ng-app on allowlist, missing base-uri allowing hijack, and dangling markup injection.

SSRF confirmation: point a URL parameter at a Collaborator host and observe the callback; blind SSRF is proven by DNS/HTTP interaction from the server.

SSRF filter bypasses: decimal/octal/hex IP encoding (2130706433, 0177.0.0.1, 0x7f000001), IPv6 ::1, DNS rebinding, and redirects from an allowlisted host.

Cloud metadata: AWS http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP requires Metadata-Flavor: Google, Azure uses /metadata/instance?api-version=.

Path traversal encoding: ../, %2e%2e%2f, ..%2f, and %252e%252e%252f for double decoding; verify by reading /etc/passwd or win.ini.

LFI to RCE chains: log poisoning (User-Agent into access.log), PHP session file inclusion, /proc/self/environ, and php://filter/convert.base64-encode/resource=index.php for source disclosure.

File upload bypass: .phtml/.php5/.phar against blacklists, content-type and magic-byte spoofing (GIF89a header), .htaccess upload, and filename traversal in the upload path.

Deserialization signatures: Java rO0AB (base64) or aced0005 (hex), PHP O:4:"User", Python pickle 80 04, .NET AAEAAAD/////.

Gadget chain generators: ysoserial (Java), PHPGGC (PHP), ysoserial.net (.NET); select the chain by libraries detected on the target classpath.

JWT attacks: alg:none acceptance, HS256 key confusion using the public key as HMAC secret, weak secret cracking with hashcat -m 16500, and kid/jku header injection.

JWT claims to inspect: iss, aud, exp, nbf, sub, and custom role/admin claims; missing aud or exp validation enables token reuse across services.

OAuth flow checks: authorization code replay, PKCE downgrade, redirect_uri path matching flaws, implicit flow token leakage in Referer, and scope escalation via modified scope parameter.

GraphQL introspection query __schema reveals types and mutations; if disabled, use field-suggestion errors and Clairvoyance-style wordlists to reconstruct the schema.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, mutation authorization gaps, and IDOR in node(id:) global ID lookups.

Cross-site WebSocket hijacking occurs when the handshake lacks CSRF protection; the Origin header is not an authorization control by itself.

Cloud-integrated services: presigned URL scope escalation, S3 bucket listing when ACLs allow, IMDSv1 credential theft, and Lambda/API Gateway authorizer bypass via path normalization.

API versioning gaps: /v1 may lack authorization checks present in /v2; enumerate older versions and undocumented methods (PUT, PATCH, DELETE) on discovered endpoints.

Chain design rule: each primitive must supply the input the next requires (SSRF reads metadata credentials, credentials access internal API, API exposes deserialization endpoint).

Pivot inventory before lateral movement: harvested credentials, cloud IAM keys, internal hostnames from error pages, and network ranges from /etc/hosts or cloud metadata.

Reverse shell reliability: prefer bind or scheduled callbacks when egress filtering blocks outbound; test both TCP and DNS-based channels.

Linux privilege escalation triage: sudo -l, SUID binaries (GTFOBins), cron jobs, capabilities (getcap -r /), and writable service files.

Credential reuse across services is common; test harvested passwords against SSH, databases, admin panels, and cloud APIs before brute force.

Persistence and cleanup require documented scope; out-of-scope pivots invalidate the report and may breach the rules of engagement.

Evidence collection: timestamped screenshots, raw request/response pairs, and command transcripts per finding, stored with hashes for integrity.

Finding structure: title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and references - each finding self-contained.

Severity scoring uses CVSS v3.1 base metrics (AV, AC, PR, UI, S, C, I, A); environmental and temporal adjustments are documented separately from the base score.

Reproduction steps must be exact: full URLs, headers, payloads, and account roles so a developer can replay without guessing.

Remediation guidance names the control (parameterized queries, allowlist validation, server-side authorization checks) rather than generic advice like "sanitize input".

Impact statements translate technical flaws into business consequence (data exposure, account takeover, regulatory breach) with the affected data class named.

Executive summary avoids jargon, states overall risk posture, counts findings by severity, and highlights the top exploitable chains.

Retest evidence closes the loop: state the original finding, the fix applied, and the verification result with a date.

Communication norms: agree disclosure timelines and contact channels before testing; escalate critical findings immediately rather than waiting for the final report.

Soft-404 filtering compares response length, word count, and content-type against a random-path baseline; status code alone is unreliable on custom error handlers.

Vhost discovery sends requests with varying Host headers to one IP; a differing body length or status versus the baseline Host indicates a distinct virtual host.

JS bundle review yields API base paths, GraphQL operation names, feature flags, and sometimes embedded credentials; treat minified bundles as primary source, not noise.

Default admin surfaces worth checking: /actuator/env (Spring), /server-status (Apache), /console (H2), /_debug_toolbar (Django), and /elmah.axd (.NET).

Technology-specific wordlists outperform generic lists once the stack is fingerprinted; run generic first, then stack-keyed lists.

Parameter fuzzing with arjun or ffuf reveals accepted-but-undocumented parameters; diff responses to discard parameters the app ignores.

Confirm exact software versions before mapping CVEs; header-only version strings can be spoofed or stripped by proxies, so corroborate with error pages or asset hashes.

IDOR confirmation requires two accounts: request object A with session B and compare against the legitimate owner's response; a 200 with data is proof, a 403 is not.

Mass assignment test: append role, isAdmin, verified, or balance fields to profile-update JSON and re-fetch the profile to see if the change persisted.

Session fixation test: set a known session cookie before login; if the server does not issue a new token after authentication, fixation is possible.

Password reset flaws to test: Host-header poisoning of reset links, token predictability, token reuse after use, and no expiry window.

JWT session handling checks: token accepted after logout, token not rotated on privilege change, and missing HttpOnly/Secure/SameSite on the cookie.

OAuth account takeover: omit state (CSRF), manipulate redirect_uri with path traversal or wildcard, and test unverified email claims from the IdP.

Authorization is per-request server-side; replay privileged requests (admin endpoints, role changes) with a low-privilege session to prove missing checks.

Forced browsing to /admin, /internal, /api/v1/admin after login often surfaces endpoints the UI never links to but the server never protects.

SQLi boolean test: ' AND 1=1-- versus ' AND 1=2--; differing responses confirm injectability, and ORDER BY n until error reveals column count for UNION.

Blind SQLi timing: SLEEP(5) on MySQL, pg_sleep(5) on PostgreSQL, WAITFOR DELAY '0:0:5' on MSSQL; measure baseline latency first to avoid false positives.

NoSQLi operator injection: {"username":{"$ne":null},"password":{"$ne":null}} bypasses naive MongoDB auth; $where with JavaScript enables blind extraction.

Command injection separators: ; | || & && ` $() and newline; blind confirmation via Collaborator DNS callback or sleep 5 in the injected command.

SSTI detection payloads: ${77}, {{77}}, <%= 77 %>, #{77}; a reflected 49 confirms template evaluation and narrows the engine.

SSTI exploitation: Jinja2 {{config.class.init.globals['os'].popen('id').read()}}; Twig {{_self.env.registerUndefinedFilterCallback('system')}}.

LDAP injection: )(uid=))(|(uid=* manipulates filter logic; a lone * or )( in login fields causing filter errors confirms injectability.

XPath injection: ' or '1'='1' -- inside XPath expressions; verbose XPath errors confirm the injection point.

XSS classification: reflected (payload in immediate response), stored (persisted server-side), DOM-based (source to sink entirely client-side, e.g., location.hash into innerHTML).

DOM sinks to grep: innerHTML, outerHTML, document.write, eval, setTimeout(string), location assignment, jQuery .html(), and Angular/Vue template bindings.

CSRF defense requires an unpredictable per-request token tied to the session, SameSite=Lax/Strict cookies, and Origin/Referer validation; a token that is not validated is not a control.

Prototype pollution payloads use proto or constructor.prototype; sinks include Object.assign, lodash merge, jQuery $.extend(true, ...), and library config parsing.

Prototype pollution to RCE in Node: pollute Object.prototype with shell/env options consumed by child_process.spawn or EJS/Pug render options.

DOM clobbering: elements with id/name create globals; can shadow window.config and bypass scripts expecting configuration objects.

postMessage handlers must validate event.origin and event.source; missing checks allow cross-origin data injection into privileged frames.

CSP bypass routes: JSONP endpoints on allowlisted domains, AngularJS ng-app on allowlist, missing base-uri allowing hijack, and dangling markup injection.

SSRF confirmation: point a URL parameter at a Collaborator host and observe the callback; blind SSRF is proven by DNS/HTTP interaction from the server.

SSRF filter bypasses: decimal/octal/hex IP encoding (2130706433, 0177.0.0.1, 0x7f000001), IPv6 ::1, DNS rebinding, and redirects from an allowlisted host.

Cloud metadata: AWS http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP requires Metadata-Flavor: Google, Azure uses /metadata/instance?api-version=.

Path traversal encoding: ../, %2e%2e%2f, ..%2f, and %252e%252e%252f for double decoding; verify by reading /etc/passwd or win.ini.

LFI to RCE chains: log poisoning (User-Agent into access.log), PHP session file inclusion, /proc/self/environ, and php://filter/convert.base64-encode/resource=index.php for source disclosure.

File upload bypass: .phtml/.php5/.phar against blacklists, content-type and magic-byte spoofing (GIF89a header), .htaccess upload, and filename traversal in the upload path.

Deserialization signatures: Java rO0AB (base64) or aced0005 (hex), PHP O:4:"User", Python pickle 80 04, .NET AAEAAAD/////.

Gadget chain generators: ysoserial (Java), PHPGGC (PHP), ysoserial.net (.NET); select the chain by libraries detected on the target classpath.

JWT attacks: alg:none acceptance, HS256 key confusion using the public key as HMAC secret, weak secret cracking with hashcat -m 16500, and kid/jku header injection.

JWT claims to inspect: iss, aud, exp, nbf, sub, and custom role/admin claims; missing aud or exp validation enables token reuse across services.

OAuth flow checks: authorization code replay, PKCE downgrade, redirect_uri path matching flaws, implicit flow token leakage in Referer, and scope escalation via modified scope parameter.

GraphQL introspection query __schema reveals types and mutations; if disabled, use field-suggestion errors and Clairvoyance-style wordlists to reconstruct the schema.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, mutation authorization gaps, and IDOR in node(id:) global ID lookups.

Cross-site WebSocket hijacking occurs when the handshake lacks CSRF protection; the Origin header is not an authorization control by itself.

Cloud-integrated services: presigned URL scope escalation, S3 bucket listing when ACLs allow, IMDSv1 credential theft, and Lambda/API Gateway authorizer bypass via path normalization.

API versioning gaps: /v1 may lack authorization checks present in /v2; enumerate older versions and undocumented methods (PUT, PATCH, DELETE) on discovered endpoints.

Chain design rule: each primitive must supply the input the next requires (SSRF reads metadata credentials, credentials access internal API, API exposes deserialization endpoint).

Pivot inventory before lateral movement: harvested credentials, cloud IAM keys, internal hostnames from error pages, and network ranges from /etc/hosts or cloud metadata.

Reverse shell reliability: prefer bind or scheduled callbacks when egress filtering blocks outbound; test both TCP and DNS-based channels.

Linux privilege escalation triage: sudo -l, SUID binaries (GTFOBins), cron jobs, capabilities (getcap -r /), and writable service files.

Credential reuse across services is common; test harvested passwords against SSH, databases, admin panels, and cloud APIs before brute force.

Persistence and cleanup require documented scope; out-of-scope pivots invalidate the report and may breach the rules of engagement.

Evidence collection: timestamped screenshots, raw request/response pairs, and command transcripts per finding, stored with hashes for integrity.

Finding structure: title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and references - each finding self-contained.

Severity scoring uses CVSS v3.1 base metrics (AV, AC, PR, UI, S, C, I, A); environmental and temporal adjustments are documented separately from the base score.

Reproduction steps must be exact: full URLs, headers, payloads, and account roles so a developer can replay without guessing.

Remediation guidance names the control (parameterized queries, allowlist validation, server-side authorization checks) rather than generic advice like "sanitize input".

Impact statements translate technical flaws into business consequence (data exposure, account takeover, regulatory breach) with the affected data class named.

Executive summary avoids jargon, states overall risk posture, counts findings by severity, and highlights the top exploitable chains.

Retest evidence closes the loop: state the original finding, the fix applied, and the verification result with a date.

Communication norms: agree disclosure timelines and contact channels before testing; escalate critical findings immediately rather than waiting for the final report.

Soft-404 filtering compares response length, word count, and content-type against a random-path baseline; status code alone is unreliable on custom error handlers.

Vhost discovery sends requests with varying Host headers to one IP; a differing body length or status versus the baseline Host indicates a distinct virtual host.

JS bundle review yields API base paths, GraphQL operation names, feature flags, and sometimes embedded credentials; treat minified bundles as primary source, not noise.

Default admin surfaces worth checking: /actuator/env (Spring), /server-status (Apache), /console (H2), /_debug_toolbar (Django), and /elmah.axd (.NET).

Technology-specific wordlists outperform generic lists once the stack is fingerprinted; run generic first, then stack-keyed lists.

Parameter fuzzing with arjun or ffuf reveals accepted-but-undocumented parameters; diff responses to discard parameters the app ignores.

Confirm exact software versions before mapping CVEs; header-only version strings can be spoofed or stripped by proxies, so corroborate with error pages or asset hashes.

IDOR confirmation requires two accounts: request object A with session B and compare against the legitimate owner's response; a 200 with data is proof, a 403 is not.

Mass assignment test: append role, isAdmin, verified, or balance fields to profile-update JSON and re-fetch the profile to see if the change persisted.

Session fixation test: set a known session cookie before login; if the server does not issue a new token after authentication, fixation is possible.

Password reset flaws to test: Host-header poisoning of reset links, token predictability, token reuse after use, and no expiry window.

JWT session handling checks: token accepted after logout, token not rotated on privilege change, and missing HttpOnly/Secure/SameSite on the cookie.

OAuth account takeover: omit state (CSRF), manipulate redirect_uri with path traversal or wildcard, and test unverified email claims from the IdP.

Authorization is per-request server-side; replay privileged requests (admin endpoints, role changes) with a low-privilege session to prove missing checks.

Forced browsing to /admin, /internal, /api/v1/admin after login often surfaces endpoints the UI never links to but the server never protects.

SQLi boolean test: ' AND 1=1-- versus ' AND 1=2--; differing responses confirm injectability, and ORDER BY n until error reveals column count for UNION.

Blind SQLi timing: SLEEP(5) on MySQL, pg_sleep(5) on PostgreSQL, WAITFOR DELAY '0:0:5' on MSSQL; measure baseline latency first to avoid false positives.

NoSQLi operator injection: {"username":{"$ne":null},"password":{"$ne":null}} bypasses naive MongoDB auth; $where with JavaScript enables blind extraction.

Command injection separators: ; | || & && ` $() and newline; blind confirmation via Collaborator DNS callback or sleep 5 in the injected command.

SSTI detection payloads: ${77}, {{77}}, <%= 77 %>, #{77}; a reflected 49 confirms template evaluation and narrows the engine.

SSTI exploitation: Jinja2 {{config.class.init.globals['os'].popen('id').read()}}; Twig {{_self.env.registerUndefinedFilterCallback('system')}}.

LDAP injection: )(uid=))(|(uid=* manipulates filter logic; a lone * or )( in login fields causing filter errors confirms injectability.

XPath injection: ' or '1'='1' -- inside XPath expressions; verbose XPath errors confirm the injection point.

XSS classification: reflected (payload in immediate response), stored (persisted server-side), DOM-based (source to sink entirely client-side, e.g., location.hash into innerHTML).

DOM sinks to grep: innerHTML, outerHTML, document.write, eval, setTimeout(string), location assignment, jQuery .html(), and Angular/Vue template bindings.

CSRF defense requires an unpredictable per-request token tied to the session, SameSite=Lax/Strict cookies, and Origin/Referer validation; a token that is not validated is not a control.

Prototype pollution payloads use proto or constructor.prototype; sinks include Object.assign, lodash merge, jQuery $.extend(true, ...), and library config parsing.

Prototype pollution to RCE in Node: pollute Object.prototype with shell/env options consumed by child_process.spawn or EJS/Pug render options.

DOM clobbering: elements with id/name create globals; can shadow window.config and bypass scripts expecting configuration objects.

postMessage handlers must validate event.origin and event.source; missing checks allow cross-origin data injection into privileged frames.

CSP bypass routes: JSONP endpoints on allowlisted domains, AngularJS ng-app on allowlist, missing base-uri allowing hijack, and dangling markup injection.

SSRF confirmation: point a URL parameter at a Collaborator host and observe the callback; blind SSRF is proven by DNS/HTTP interaction from the server.

SSRF filter bypasses: decimal/octal/hex IP encoding (2130706433, 0177.0.0.1, 0x7f000001), IPv6 ::1, DNS rebinding, and redirects from an allowlisted host.

Cloud metadata: AWS http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP requires Metadata-Flavor: Google, Azure uses /metadata/instance?api-version=.

Path traversal encoding: ../, %2e%2e%2f, ..%2f, and %252e%252e%252f for double decoding; verify by reading /etc/passwd or win.ini.

LFI to RCE chains: log poisoning (User-Agent into access.log), PHP session file inclusion, /proc/self/environ, and php://filter/convert.base64-encode/resource=index.php for source disclosure.

File upload bypass: .phtml/.php5/.phar against blacklists, content-type and magic-byte spoofing (GIF89a header), .htaccess upload, and filename traversal in the upload path.

Deserialization signatures: Java rO0AB (base64) or aced0005 (hex), PHP O:4:"User", Python pickle 80 04, .NET AAEAAAD/////.

Gadget chain generators: ysoserial (Java), PHPGGC (PHP), ysoserial.net (.NET); select the chain by libraries detected on the target classpath.

JWT attacks: alg:none acceptance, HS256 key confusion using the public key as HMAC secret, weak secret cracking with hashcat -m 16500, and kid/jku header injection.

JWT claims to inspect: iss, aud, exp, nbf, sub, and custom role/admin claims; missing aud or exp validation enables token reuse across services.

OAuth flow checks: authorization code replay, PKCE downgrade, redirect_uri path matching flaws, implicit flow token leakage in Referer, and scope escalation via modified scope parameter.

GraphQL introspection query __schema reveals types and mutations; if disabled, use field-suggestion errors and Clairvoyance-style wordlists to reconstruct the schema.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, mutation authorization gaps, and IDOR in node(id:) global ID lookups.

Cross-site WebSocket hijacking occurs when the handshake lacks CSRF protection; the Origin header is not an authorization control by itself.

Cloud-integrated services: presigned URL scope escalation, S3 bucket listing when ACLs allow, IMDSv1 credential theft, and Lambda/API Gateway authorizer bypass via path normalization.

API versioning gaps: /v1 may lack authorization checks present in /v2; enumerate older versions and undocumented methods (PUT, PATCH, DELETE) on discovered endpoints.

Chain design rule: each primitive must supply the input the next requires (SSRF reads metadata credentials, credentials access internal API, API exposes deserialization endpoint).

Pivot inventory before lateral movement: harvested credentials, cloud IAM keys, internal hostnames from error pages, and network ranges from /etc/hosts or cloud metadata.

Reverse shell reliability: prefer bind or scheduled callbacks when egress filtering blocks outbound; test both TCP and DNS-based channels.

Linux privilege escalation triage: sudo -l, SUID binaries (GTFOBins), cron jobs, capabilities (getcap -r /), and writable service files.

Credential reuse across services is common; test harvested passwords against SSH, databases, admin panels, and cloud APIs before brute force.

Persistence and cleanup require documented scope; out-of-scope pivots invalidate the report and may breach the rules of engagement.

Evidence collection: timestamped screenshots, raw request/response pairs, and command transcripts per finding, stored with hashes for integrity.

Finding structure: title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and references - each finding self-contained.

Severity scoring uses CVSS v3.1 base metrics (AV, AC, PR, UI, S, C, I, A); environmental and temporal adjustments are documented separately from the base score.

Reproduction steps must be exact: full URLs, headers, payloads, and account roles so a developer can replay without guessing.

Remediation guidance names the control (parameterized queries, allowlist validation, server-side authorization checks) rather than generic advice like "sanitize input".

Impact statements translate technical flaws into business consequence (data exposure, account takeover, regulatory breach) with the affected data class named.

Executive summary avoids jargon, states overall risk posture, counts findings by severity, and highlights the top exploitable chains.

Retest evidence closes the loop: state the original finding, the fix applied, and the verification result with a date.

Communication norms: agree disclosure timelines and contact channels before testing; escalate critical findings immediately rather than waiting for the final report.

Soft-404 filtering compares response length, word count, and content-type against a random-path baseline; status code alone is unreliable on custom error handlers.

Vhost discovery sends requests with varying Host headers to one IP; a differing body length or status versus the baseline Host indicates a distinct virtual host.

JS bundle review yields API base paths, GraphQL operation names, feature flags, and sometimes embedded credentials; treat minified bundles as primary source, not noise.

Default admin surfaces worth checking: /actuator/env (Spring), /server-status (Apache), /console (H2), /_debug_toolbar (Django), and /elmah.axd (.NET).

Technology-specific wordlists outperform generic lists once the stack is fingerprinted; run generic first, then stack-keyed lists.

Parameter fuzzing with arjun or ffuf reveals accepted-but-undocumented parameters; diff responses to discard parameters the app ignores.

Confirm exact software versions before mapping CVEs; header-only version strings can be spoofed or stripped by proxies, so corroborate with error pages or asset hashes.

IDOR confirmation requires two accounts: request object A with session B and compare against the legitimate owner's response; a 200 with data is proof, a 403 is not.

Mass assignment test: append role, isAdmin, verified, or balance fields to profile-update JSON and re-fetch the profile to see if the change persisted.

Session fixation test: set a known session cookie before login; if the server does not issue a new token after authentication, fixation is possible.

Password reset flaws to test: Host-header poisoning of reset links, token predictability, token reuse after use, and no expiry window.

JWT session handling checks: token accepted after logout, token not rotated on privilege change, and missing HttpOnly/Secure/SameSite on the cookie.

OAuth account takeover: omit state (CSRF), manipulate redirect_uri with path traversal or wildcard, and test unverified email claims from the IdP.

Authorization is per-request server-side; replay privileged requests (admin endpoints, role changes) with a low-privilege session to prove missing checks.

Forced browsing to /admin, /internal, /api/v1/admin after login often surfaces endpoints the UI never links to but the server never protects.

SQLi boolean test: ' AND 1=1-- versus ' AND 1=2--; differing responses confirm injectability, and ORDER BY n until error reveals column count for UNION.

Blind SQLi timing: SLEEP(5) on MySQL, pg_sleep(5) on PostgreSQL, WAITFOR DELAY '0:0:5' on MSSQL; measure baseline latency first to avoid false positives.

NoSQLi operator injection: {"username":{"$ne":null},"password":{"$ne":null}} bypasses naive MongoDB auth; $where with JavaScript enables blind extraction.

Command injection separators: ; | || & && ` $() and newline; blind confirmation via Collaborator DNS callback or sleep 5 in the injected command.

SSTI detection payloads: ${77}, {{77}}, <%= 77 %>, #{77}; a reflected 49 confirms template evaluation and narrows the engine.

SSTI exploitation: Jinja2 {{config.class.init.globals['os'].popen('id').read()}}; Twig {{_self.env.registerUndefinedFilterCallback('system')}}.

LDAP injection: )(uid=))(|(uid=* manipulates filter logic; a lone * or )( in login fields causing filter errors confirms injectability.

XPath injection: ' or '1'='1' -- inside XPath expressions; verbose XPath errors confirm the injection point.

XSS classification: reflected (payload in immediate response), stored (persisted server-side), DOM-based (source to sink entirely client-side, e.g., location.hash into innerHTML).

DOM sinks to grep: innerHTML, outerHTML, document.write, eval, setTimeout(string), location assignment, jQuery .html(), and Angular/Vue template bindings.

CSRF defense requires an unpredictable per-request token tied to the session, SameSite=Lax/Strict cookies, and Origin/Referer validation; a token that is not validated is not a control.

Prototype pollution payloads use proto or constructor.prototype; sinks include Object.assign, lodash merge, jQuery $.extend(true, ...), and library config parsing.

Prototype pollution to RCE in Node: pollute Object.prototype with shell/env options consumed by child_process.spawn or EJS/Pug render options.

DOM clobbering: elements with id/name create globals; can shadow window.config and bypass scripts expecting configuration objects.

postMessage handlers must validate event.origin and event.source; missing checks allow cross-origin data injection into privileged frames.

CSP bypass routes: JSONP endpoints on allowlisted domains, AngularJS ng-app on allowlist, missing base-uri allowing hijack, and dangling markup injection.

SSRF confirmation: point a URL parameter at a Collaborator host and observe the callback; blind SSRF is proven by DNS/HTTP interaction from the server.

SSRF filter bypasses: decimal/octal/hex IP encoding (2130706433, 0177.0.0.1, 0x7f000001), IPv6 ::1, DNS rebinding, and redirects from an allowlisted host.

Cloud metadata: AWS http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP requires Metadata-Flavor: Google, Azure uses /metadata/instance?api-version=.

Path traversal encoding: ../, %2e%2e%2f, ..%2f, and %252e%252e%252f for double decoding; verify by reading /etc/passwd or win.ini.

LFI to RCE chains: log poisoning (User-Agent into access.log), PHP session file inclusion, /proc/self/environ, and php://filter/convert.base64-encode/resource=index.php for source disclosure.

File upload bypass: .phtml/.php5/.phar against blacklists, content-type and magic-byte spoofing (GIF89a header), .htaccess upload, and filename traversal in the upload path.

Deserialization signatures: Java rO0AB (base64) or aced0005 (hex), PHP O:4:"User", Python pickle 80 04, .NET AAEAAAD/////.

Gadget chain generators: ysoserial (Java), PHPGGC (PHP), ysoserial.net (.NET); select the chain by libraries detected on the target classpath.

JWT attacks: alg:none acceptance, HS256 key confusion using the public key as HMAC secret, weak secret cracking with hashcat -m 16500, and kid/jku header injection.

JWT claims to inspect: iss, aud, exp, nbf, sub, and custom role/admin claims; missing aud or exp validation enables token reuse across services.

OAuth flow checks: authorization code replay, PKCE downgrade, redirect_uri path matching flaws, implicit flow token leakage in Referer, and scope escalation via modified scope parameter.

GraphQL introspection query __schema reveals types and mutations; if disabled, use field-suggestion errors and Clairvoyance-style wordlists to reconstruct the schema.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, mutation authorization gaps, and IDOR in node(id:) global ID lookups.

Cross-site WebSocket hijacking occurs when the handshake lacks CSRF protection; the Origin header is not an authorization control by itself.

Cloud-integrated services: presigned URL scope escalation, S3 bucket listing when ACLs allow, IMDSv1 credential theft, and Lambda/API Gateway authorizer bypass via path normalization.

API versioning gaps: /v1 may lack authorization checks present in /v2; enumerate older versions and undocumented methods (PUT, PATCH, DELETE) on discovered endpoints.

Chain design rule: each primitive must supply the input the next requires (SSRF reads metadata credentials, credentials access internal API, API exposes deserialization endpoint).

Pivot inventory before lateral movement: harvested credentials, cloud IAM keys, internal hostnames from error pages, and network ranges from /etc/hosts or cloud metadata.

Reverse shell reliability: prefer bind or scheduled callbacks when egress filtering blocks outbound; test both TCP and DNS-based channels.

Linux privilege escalation triage: sudo -l, SUID binaries (GTFOBins), cron jobs, capabilities (getcap -r /), and writable service files.

Credential reuse across services is common; test harvested passwords against SSH, databases, admin panels, and cloud APIs before brute force.

Persistence and cleanup require documented scope; out-of-scope pivots invalidate the report and may breach the rules of engagement.

Evidence collection: timestamped screenshots, raw request/response pairs, and command transcripts per finding, stored with hashes for integrity.

Finding structure: title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and references - each finding self-contained.

Severity scoring uses CVSS v3.1 base metrics (AV, AC, PR, UI, S, C, I, A); environmental and temporal adjustments are documented separately from the base score.

Reproduction steps must be exact: full URLs, headers, payloads, and account roles so a developer can replay without guessing.

Remediation guidance names the control (parameterized queries, allowlist validation, server-side authorization checks) rather than generic advice like "sanitize input".

Impact statements translate technical flaws into business consequence (data exposure, account takeover, regulatory breach) with the affected data class named.

Executive summary avoids jargon, states overall risk posture, counts findings by severity, and highlights the top exploitable chains.

Retest evidence closes the loop: state the original finding, the fix applied, and the verification result with a date.

Communication norms: agree disclosure timelines and contact channels before testing; escalate critical findings immediately rather than waiting for the final report.