HTB CWES flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Soft 404 detection

A server returning status 200 with an identical body length for nonexistent paths. Compare response length and hash across random requests before trusting directory brute-force results.

Virtual host enumeration

Sending the same IP address with different Host headers and comparing status, length, and body hash to discover applications that share one server but are not in DNS.

Git directory exposure

A reachable /.git/HEAD lets an attacker reconstruct full source with git-dumper, revealing hardcoded credentials, hidden endpoints, and logic flaws not visible in the deployed app.

GraphQL introspection

A built-in query returning the full schema: types, fields, arguments, and mutations. When enabled in production it maps the entire API surface without guessing endpoint names.

UNION column count discovery

Increment ORDER BY n until an error occurs, or add NULL columns to UNION SELECT until the page renders normally. The working count equals the original query's column total.

Time-based blind SQLi

Inferring boolean truth from response delay: SLEEP(5) in MySQL, pg_sleep(5) in PostgreSQL, WAITFOR DELAY in MSSQL. Baseline normal latency first to avoid false positives.

SSTI engine fingerprint

Injecting {{7*'7'}} distinguishes engines: Twig renders 49, Jinja2 renders 7777777. The arithmetic probe ${7*7} and <%= 7*7 %> confirm evaluation generally.

LDAP filter injection

Supplying characters like *)(uid=*))(|(uid=* to break out of an LDAP filter and force a true condition, often bypassing authentication or enumerating directory entries.

XSS context breakout

The closing syntax required by the injection point: a double quote for attributes, </script> for script blocks, or a new statement for JavaScript strings. Context dictates the payload.

DOM clobbering

Markup with id or name attributes creates or overwrites global variables, letting injected HTML shadow script variables such as config objects and redirect the application's logic.

Prototype pollution sink

A recursive merge or assignment that accepts __proto__ or constructor.prototype keys, modifying Object.prototype so every object inherits attacker-controlled properties.

SameSite cookie behavior

Lax sends cookies on top-level GET navigations but not cross-site POSTs; Strict sends none cross-site; None requires the Secure flag. Missing attributes default to Lax in modern browsers.

JWT algorithm confusion

Changing alg from RS256 to HS256 and signing with the server's public key, which the verifier wrongly uses as an HMAC secret. Prevention requires pinning the expected algorithm.

OAuth state parameter

A per-request random value bound to the user session. Its absence permits login CSRF, where an attacker's authorization code is bound to the victim's session.

IDOR verification method

Authenticate as two users of equal privilege, capture one user's object identifier, and replay it as the other. A successful cross-read confirms broken object-level authorization.

Session fixation

The session identifier does not rotate after authentication, so an attacker who plants a known cookie value obtains an authenticated session once the victim logs in.

PHP filter wrapper

php://filter/convert.base64-encode/resource=index.php returns source code as base64 through a file inclusion flaw, disclosing logic that the interpreter would otherwise execute.

Log poisoning to RCE

Writing PHP code into a log file through the User-Agent header, then including that log via LFI. Requires a known log path and inclusion of a file the attacker can write.

Upload extension bypass

Alternate executable extensions such as .phtml, .php5, or .phar evade blacklists; a .htaccess upload can map a benign extension to the PHP handler when overrides are allowed.

Cloud metadata SSRF

Requesting 169.254.169.254 to reach instance metadata. On AWS, /latest/meta-data/iam/security-credentials/ returns temporary IAM credentials when IMDSv1 is enabled.

SSRF IP representation bypass

Alternate encodings of 127.0.0.1 such as 2130706433, 0x7f000001, or 0177.0.0.1 evade string blocklists because the resolver normalizes them to loopback.

Java deserialization magic bytes

Serialized Java objects begin with AC ED 00 05, visible as rO0AB in base64. Finding this in a cookie or parameter indicates a native deserialization sink worth testing.

ysoserial gadget chains

A tool that builds serialized payloads from library-specific chains such as CommonsCollections, URLDNS, and JRMPClient. The chain must match libraries present on the target classpath.

WordPress user enumeration

The REST route /wp-json/wp/v2/users and the ?author=1 redirect both disclose usernames, which feed password spraying against wp-login.php or XML-RPC.

Spring Boot Actuator exposure

Endpoints like /actuator/env and /actuator/heapdump leak configuration, credentials, and session tokens. Heapdump analysis with a memory tool recovers secrets directly.

Struts2 OGNL injection

Untrusted input evaluated as an OGNL expression, historically through the Content-Type header. Payloads reach the OGNL context and execute system commands.

Tomcat manager WAR deployment

Valid manager credentials at /manager/html allow uploading a WAR file, which Tomcat deploys as a web application and executes, yielding remote code execution.

Reverse shell egress selection

Choose the callback port and protocol by observed egress policy: 443 or 80 for filtered networks, DNS tunneling when only DNS resolves, and PowerShell IEX for Windows targets.

SSH dynamic port forwarding

ssh -D creates a local SOCKS proxy that routes traffic through the compromised host, letting proxychains-enabled tools reach internal networks without additional tooling.

SeImpersonate privilege abuse

A Windows token privilege enabling impersonation of higher-integrity tokens. Potato-family exploits convert it into SYSTEM when the account holds the privilege.

CVSS scope change

Set when a vulnerability in one component affects resources beyond its security authority, such as a web app flaw reaching the host OS. It raises the base score.

Reproducible finding evidence

A finding includes the exact request, the response, prerequisites, and step order so an independent tester reaches the same result. Missing steps make a finding unreportable.