HTB CWES key terms

Discovering hostnames served by one IP by comparing responses for a known default page against candidate names, using DNS wordlists, certificate SANs, or brute force with tools like ffuf and gobuster.

Brute-forcing or deriving hidden paths, files, and parameters on a web server using wordlists, recursion, and response-code or size filtering to find unlinked functionality.

Public append-only logs of issued TLS certificates that can be queried to reveal subdomains and internal hostnames an organization never intended to advertise.

Extracting parameter names from JavaScript bundles, source maps, HTML comments, and archived responses to find inputs that are accepted but not visible in normal UI flows.

A deployed .map file that reconstructs original front-end source, exposing API endpoints, internal logic, comments, and sometimes secrets to anyone who requests it.

Appending a UNION SELECT statement to an injectable query so the attacker's rows are returned alongside legitimate results, requiring matching column counts and compatible data types.

Inferring database contents from boolean true/false response differences or time delays rather than returned data, typically automated with sqlmap or custom scripts.

Malicious input is stored safely on first write but later concatenated into a query elsewhere, so the injection triggers when another function reads or processes the stored value.

Coercing the database to emit error messages or function results that leak schema names, version strings, or query fragments, useful when query output is not displayed directly.

Passing shell metacharacters such as semicolons, pipes, backticks, or $() into input that reaches a system call, causing the application to execute attacker-chosen operating system commands.

Command execution where output is not returned to the attacker, confirmed and exploited through time delays, out-of-band DNS or HTTP callbacks, or file writes to a web-accessible path.

User input is concatenated into a template rendered on the server, letting the attacker inject template syntax that may escalate from data disclosure to remote code execution depending on the engine.

Breaking out of a restricted template or expression evaluation environment by abusing exposed objects, class hierarchies, or language features to reach dangerous functions and execute code.

Inserting filter metacharacters such as asterisks, parentheses, and pipes into directory queries so the search logic is altered, often bypassing authentication or widening result sets.

Manipulating XML path expressions through unsanitized input so the query always evaluates true or selects sibling nodes, commonly defeating XML-backed login checks.

Script is persisted server-side, in a comment, profile, or ticket, and executes in every victim's browser that later views the affected page, giving durable attacker reach.

Client-side JavaScript copies attacker-controlled data from a source such as location.hash into a dangerous sink like innerHTML, so the payload never reaches the server.

Injecting HTML elements with id or name attributes that overwrite global variables or object properties relied on by scripts, altering client-side logic without executing JavaScript directly.

Merging attacker-controlled keys such as proto into an object so properties are inherited by all objects, potentially enabling logic bypass, DOM XSS, or gadget-chain exploitation.

Defeating anti-CSRF protections by removing the token parameter, reusing a token tied to a session rather than a request, or exploiting endpoints that skip validation entirely.

A cookie attribute controlling whether the browser sends the cookie on cross-site requests: Strict blocks all, Lax allows top-level GET navigation, and None requires the Secure flag.

A malicious page causes a logged-in victim's browser to submit an authenticated state-changing request to another site, exploiting the automatic attachment of session credentials.

A JWT attack where the header's alg value is changed, for example to HS256 or none, so the verifier checks a signature with the wrong key type or skips verification entirely.

Embedding a self-generated public key in the JWT's jwk header so a vulnerable library verifies the token against the attacker's key instead of the server's trusted key.

Modifying claims such as sub, role, or email to escalate privileges, which succeeds only when the signature is unverified, weakly keyed, or trusted from an unvalidated source.

An endpoint accepts a user-supplied identifier and returns the matching object without checking ownership, letting an attacker enumerate other users' records by changing the value.

Requesting privileged URLs, API routes, or administrative pages directly, bypassing navigation restrictions that exist only in the interface rather than in server-side authorization checks.

Abusing loose redirect URI validation to send an authorization code or token to an attacker-controlled host, enabling account takeover through stolen authorization grants.

Capturing the one-time OAuth code via an open redirect, referer leakage, or a malicious app, then redeeming it at the token endpoint before the legitimate client does.

Manipulating a file path parameter to read server files outside the intended directory, often escalated to code execution by including logs, sessions, or uploaded content.

Using dot-dot-slash sequences, encoded variants, or absolute paths to escape a base directory and access files the application never intended to serve.

Writing PHP or other executable code into server logs via the User-Agent or request path, then including that log file through LFI so the code runs.

Appending an encoded null character so a string operation terminates early, bypassing appended file extensions in older runtimes that honor C-style string termination.

A file valid as two formats at once, such as a GIF header followed by PHP code, crafted to pass image validation while still being interpreted as executable server-side script.

Making the server issue requests to attacker-chosen destinations, reaching internal services, cloud metadata endpoints, or localhost-only admin interfaces that are not externally exposed.

Untrusted serialized data is reconstructed into objects, letting an attacker control properties and trigger magic methods that form a gadget chain ending in code execution.

A sequence of existing classes whose magic methods call each other when deserialized, converting a controlled object graph into arbitrary file writes or command execution without injecting code directly.

Confirming blind vulnerabilities by causing the target to make a DNS or HTTP request to an attacker-controlled listener, proving execution even when no output is returned.

A small uploaded script that accepts commands or file operations over HTTP, giving persistent interactive access to the web server under the application's user context.

A payload that makes the compromised host connect back to a listener the attacker controls, useful when inbound connections are blocked by firewalls or NAT.

Using a compromised host as a relay to reach internal networks unreachable from the attacker's machine, typically via port forwarding, SOCKS proxies, or tunneling tools.