HTB CWEE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Soft 404 detection

A server returns 200 for nonexistent paths. Detect by requesting random strings and comparing response length, word count, and content-type against real pages; filter fuzzing results by these deltas.

Vhost enumeration

Sending requests with different Host headers to the same IP. A response differing in length or status from the baseline Host reveals a virtual host not linked in DNS.

JavaScript bundle mining

Grepping minified JS for API base URLs, GraphQL operation names, feature flags, and hardcoded secrets. Bundles often disclose endpoints absent from visible HTML and sitemaps.

IDOR proof requirement

Demonstrating object access requires two accounts: request victim object A using attacker session B. A 200 containing victim data proves it; a 403 or empty body does not.

Mass assignment

Adding fields like role, isAdmin, or balance to JSON update bodies. If the server binds them without an allowlist, the privilege change persists and is confirmed by re-fetching the profile.

Session fixation

Attacker sets a known session cookie before victim login. If the server does not rotate the token after authentication, the attacker reuses the fixed value to hijack the session.

Boolean-based SQLi

Comparing responses for ' AND 1=1-- versus ' AND 1=2--. A consistent difference confirms injectability; ORDER BY n incremented to error reveals column count for UNION attacks.

NoSQL operator injection

Sending JSON like {"password":{"$ne":null}} to bypass MongoDB authentication. The operator changes query semantics; $where with JavaScript enables blind data extraction.

SSTI detection payloads

Submitting ${7*7}, {{7*7}}, <%= 7*7 %>, and #{7*7}. A reflected 49 confirms server-side template evaluation, and which syntax works fingerprints the engine.

Blind command injection confirmation

Using separators like ; | && $() with an out-of-band DNS or HTTP callback, or a sleep 5 delay. Callback or measured latency proves execution without visible output.

DOM-based XSS

A client-side source such as location.hash or postMessage flows into a sink like innerHTML or eval without server involvement. Server-side filtering cannot prevent it.

Prototype pollution

Injecting __proto__ or constructor.prototype keys through JSON merge operations to modify Object.prototype. Polluted properties affect every object, enabling logic bypass or RCE in Node.

DOM clobbering

HTML elements with id or name attributes become global variables, shadowing expected objects. An img named config can replace window.config and alter script behavior.

CSRF token validation

A per-request unpredictable token tied to the session, combined with SameSite cookies and Origin checks. A token present in the form but never validated server-side provides no protection.

SSRF via cloud metadata

Requesting 169.254.169.254 from the server to read IAM credentials. AWS uses /latest/meta-data/iam/security-credentials/, GCP requires the Metadata-Flavor: Google header.

Path traversal encodings

Variants of ../ including %2e%2e%2f, ..%2f, and %252e%252e%252f for double decoding. Filters often decode once, so double-encoded sequences bypass them and reach the filesystem.

LFI to RCE via logs

Writing PHP code into the User-Agent so it lands in access.log, then including that log through the LFI. Alternative targets are session files and /proc/self/environ.

Deserialization magic bytes

Java streams begin rO0AB in base64 or aced0005 in hex; PHP uses O:4:"User"; Python pickle starts 80 04; .NET uses AAEAAAD/////. These identify serialized input in requests.

JWT alg none attack

Setting the header algorithm to none and stripping the signature. If the library accepts unsigned tokens, arbitrary claims such as admin true are trusted by the application.

JWT key confusion

Signing an HS256 token with the server's RSA public key as the HMAC secret. Libraries that trust the header algorithm verify successfully, allowing forged tokens.

GraphQL introspection

Querying __schema returns all types, fields, and mutations. When disabled, field-suggestion error messages and wordlist tools reconstruct the schema incrementally.

Cross-site WebSocket hijacking

A WebSocket handshake lacking CSRF protection lets an attacker page open an authenticated socket using the victim's cookies, then read and send messages as that user.

OAuth state parameter

A random value bound to the user session and returned in the callback. Omitting or not validating it enables login CSRF, letting an attacker bind their account to the victim.

Exploit chain design

Sequencing primitives so each supplies the next input: SSRF reads cloud credentials, credentials reach an internal API, the API exposes a deserialization endpoint leading to RCE.

Linux privilege escalation triage

Checking sudo -l, SUID binaries against GTFOBins, cron jobs, file capabilities with getcap -r /, and writable service files before attempting kernel exploits.

Credential reuse pivoting

Testing harvested passwords against SSH, databases, admin panels, and cloud APIs. Reuse across services is common and often faster than exploiting a new vulnerability.

Egress-filtered reverse shells

When outbound TCP is blocked, use DNS-based callbacks or bind shells on allowed ports. Confirm which protocols leave the network before choosing a channel.

CVSS v3.1 base metrics

Eight metrics: attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability. Environmental adjustments are scored separately from the base.

Reproduction steps quality

Exact URLs, headers, payloads, and account roles so a developer replays the issue without guessing. Vague steps cause findings to be disputed or closed as not reproducible.

Actionable remediation guidance

Naming the specific control, such as parameterized queries, allowlist validation, or server-side authorization checks, rather than generic advice like sanitize all input.

Business impact statement

Translating a technical flaw into consequence: which data class is exposed, which accounts can be taken over, and which regulatory obligation is breached.

Retest evidence

Documenting the original finding, the fix applied, and a dated verification result. It closes the remediation loop and confirms the vulnerability is no longer exploitable.