HTB CWPE cheat sheet

Content discovery wordlists: raft-small-words (~11k), directory-list-2.3-medium (~220k); ffuf -w list -u https://t/FUZZ -mc 200,204,301,302,307,401,403 -fs removes soft-404 noise.

Virtual host discovery differs from directory brute force: send Host: FUZZ.target.com with ffuf -H and filter by response size/length; vhosts often resolve to a different app than the default backend.

Technology fingerprint order: HTTP response headers (Server, X-Powered-By), cookie names (PHPSESSID=PHP, JSESSIONID=Java, ASP.NET_SessionId), then body markers and /robots.txt, /sitemap.xml, /.well-known/ paths.

Extension fuzzing: ffuf -w wordlist -u https://t/FUZZ -e .php,.bak,.old,.txt,.zip reveals backups; also test index.php~ (vim swap residue) and .git/HEAD for exposed repositories.

Subdomain enumeration: certificate transparency via crt.sh, then DNS brute force (gobuster dns, dnsx) and permutation tools (alterx); resolve wildcards first or results are all false positives.

Parameter discovery: arjun or paramspider to find hidden GET/POST parameters; compare responses with and without parameters to detect reflected or processed input.

JavaScript analysis yields endpoints: grep downloaded JS bundles for path fragments, API base URLs, and fetch/axios calls; source maps (.js.map) reconstruct unminified source when exposed.

Wayback and archive mining (gau, waybackurls) surfaces historical endpoints and parameters that may still be live but unlinked; deduplicate before testing.

Username enumeration signals: differing status codes, response lengths, or timing between valid and invalid users on login and password-reset flows; a uniform error message does not guarantee uniformity elsewhere.

Password spraying uses one password across many accounts (e.g., Season+Year, Company123) to stay under lockout thresholds; credential stuffing replays breached username/password pairs and is defeated by MFA.

JWT structure is base64url(header).base64url(payload).signature; alg:none and HS256-with-public-key-confusion are the two classic forgery paths when the library accepts attacker-chosen algorithms.

JWT claims to attack: exp (expiry), iss/aud validation, kid (path traversal or SQLi if used in a lookup), jku/x5u (attacker-hosted key set) - verify server-side enforcement, not client display.

Session fixation: attacker sets a known session ID, victim authenticates, and the ID is not rotated; mitigation is regenerating the session identifier at login.

Cookie attribute checks: missing HttpOnly enables XSS-based theft; missing Secure allows transmission over HTTP; SameSite=None without Secure is rejected by modern browsers.

MFA bypass patterns: response manipulation (change {"mfa":false} to true), direct navigation to post-auth endpoints, OTP brute force when no attempt limit exists, and reuse of a validated OTP.

OAuth flaws: missing state parameter (CSRF on callback), redirect_uri allowlist bypass via path traversal or subdomain, and implicit-flow token leakage in the URL fragment or Referer header.

SQLi classification: in-band (UNION, error-based), inferential (boolean, time-based), out-of-band (DNS/HTTP exfil). UNION requires matching column count and compatible types - determine with ORDER BY n or UNION SELECT NULL,NULL,...

DBMS fingerprinting: MySQL comments -- and #, version @@version; MSSQL @@version and WAITFOR DELAY '0:0:5'; PostgreSQL version() and pg_sleep(5); Oracle v$version and dbms_pipe.receive_message.

NoSQLi (MongoDB): operator injection with {"username":{"$ne":null},"password":{"$ne":null}} or $regex for blind extraction; URL-encoded forms use username[$ne]=x. $where enables server-side JavaScript execution.

Command injection separators: ; | || & && newline and $() or backticks; blind confirmation via time delay (sleep 5, ping -c 5) or out-of-band DNS lookup rather than assuming echo output.

SSTI detection polyglot: ${77}, {{77}}, #{7*7}, <%= 7*7 %> - a rendered 49 confirms evaluation; then identify the engine before escalating.

Engine-to-exploit mapping: Jinja2 ({{config}}, {{''.class.mro}} chains to os), Twig ({{_self.env.registerUndefinedFilterCallback}}), Freemarker (<#assign ex="freemarker.template.utility.Execute"?new()>), ERB (<%= system('id') %>).

SQLi to file access: MySQL INTO OUTFILE / LOAD_FILE requires FILE privilege and secure_file_priv permitting the path; MSSQL xp_cmdshell requires sysadmin and is disabled by default.

Second-order injection stores payloads in the database that execute when later concatenated into a different query - test registration, profile, and admin review flows, not just the immediate response.

XSS types: reflected (payload in immediate response), stored (persisted and served to other users), DOM-based (sink executes source data - innerHTML, document.write, eval - without server reflection).

Context determines encoding: HTML body needs < > entity encoding; attribute contexts need quote handling; inside

CSP bypass checks: unsafe-inline, unsafe-eval, wildcard or CDN-hosted script-src with JSONP endpoints, and missing base-uri or object-src directives.

CSRF requires three conditions: a relevant action, cookie-based session handling, and no unpredictable parameter. Defenses are anti-CSRF tokens, SameSite=Lax/Strict cookies, and Origin/Referer validation.

SameSite=Lax sends cookies on top-level GET navigations, so state-changing GET endpoints remain CSRF-able; POST forms from cross-site contexts lose the cookie under Lax.

CORS misconfiguration test: send Origin: https://evil.com and inspect Access-Control-Allow-Origin and Access-Control-Allow-Credentials. ACAO reflecting the origin plus credentials:true is exploitable; a null origin is also abusable via sandboxed iframes.

CORS wildcard (*) with credentials is invalid per spec and browsers block it; the real bug is reflecting arbitrary origins alongside Allow-Credentials: true.

XSS impact escalation: session theft (if no HttpOnly), forced actions as the victim, keylogging on login forms, and chaining with CSRF token disclosure via same-origin fetch.

SSRF targets: 127.0.0.1, localhost, 169.254.169.254 (cloud metadata), 10.0.0.0/8, 192.168.0.0/16, and internal DNS names; AWS IMDSv1 returns credentials at /latest/meta-data/iam/security-credentials/.

Filter bypass encodings: decimal (2130706433), octal, hex, IPv6 (::1), shortened (127.1), DNS rebinding, and URL parsing tricks like http://[email protected].

Blind SSRF confirmation: use a collaborator/interactsh payload in a URL parameter and watch for DNS or HTTP callbacks; absence of a callback does not rule out SSRF if egress is filtered.

gopher:// enables arbitrary TCP payloads (useful against Redis, SMTP, FastCGI); dict:// and file:// extend reach when the wrapper is not disabled.

LFI vs RFI: LFI includes local files (path traversal ../../etc/passwd); RFI requires allow_url_include=On and lets an attacker host PHP code - rarer on modern PHP.

LFI-to-RCE paths: PHP filter chains (php://filter/convert.base64-encode), log poisoning (User-Agent into access.log), /proc/self/environ, session file inclusion, and php://input with POST body.

PHP wrappers: php://filter for source disclosure, data:// for inline code when allow_url_include is on, expect:// when the extension is present, and zip:// or phar:// for archive-based inclusion.

Path traversal encoding ladder: ../, ..%2f, %2e%2e%2f, double-encoded %252e%252e%252f, and null-byte truncation on legacy stacks - test each until normalization behavior is clear.

Language signatures in serialized data: Java starts with AC ED 00 05 (hex) or rO0AB (base64); PHP uses O:4:"User":2:{...}; Python pickle starts with \x80; .NET uses ObjectStateFormatter or BinaryFormatter markers; Ruby uses Marshal \x04\x08.

Java gadget chains rely on libraries on the classpath (CommonsCollections, Spring, Groovy); ysoserial generates payloads per chain, and detection often starts with a DNS lookup from a URLDNS gadget.

PHP object injection: PHPGGC builds chains for frameworks (Laravel, Symfony, Magento); magic methods __wakeup, __destruct, and __toString are the usual sinks.

Python pickle deserialization executes reduce on load - any untrusted pickle is equivalent to remote code execution; there is no safe mode.

Node.js deserialization: node-serialize's unserialize evaluates functions marked with $$ND_FUNC$$, giving RCE when user input reaches it.

.NET: BinaryFormatter and LosFormatter are dangerous; ysoserial.net generates payloads for types like ObjectDataProvider and TypeConfuseDelegate.

Template injection is distinct from deserialization: SSTI executes expressions in the template engine, while deserialization reconstructs objects and triggers magic methods.

Detection for expression injection in non-template contexts: OGNL (%{77} in Struts), SpEL (#{77} in Spring), and EL (${7*7} in JSP) each have distinct syntax and sandbox-escape requirements.

IDOR test pattern: capture a request for /api/user/1001, change the identifier to 1002, and compare responses; also test UUIDs, hashed IDs, and sequential numeric IDs in headers or JSON bodies.

Horizontal vs vertical: horizontal crosses between users of the same role; vertical crosses privilege levels (user to admin). Both can appear in the same endpoint via different parameters.

Mass assignment: add fields like role:admin, isAdmin:true, or verified:true to a profile update and check whether the server binds them; frameworks with allowlists resist this.

Forced browsing: request admin endpoints directly (/admin, /api/v1/admin/users) without the UI link; 200 with data indicates missing server-side authorization, not just hidden navigation.

HTTP method tampering: a GET blocked by a filter may succeed as POST, PUT, PATCH, or with X-HTTP-Method-Override; also test trailing slashes and case variations (/Admin vs /admin).

Business logic flaws: negative quantities, price parameter tampering, coupon reuse, race conditions on redemption (send parallel requests), and step-skipping in multi-stage checkout flows.

JWT/claim-based authorization: changing a role claim in a signed token fails signature checks, but changing it in an unsigned cookie or a server-trusted header (X-User-Role) often succeeds.

Reference-based access control: object references in GraphQL (node(id:...)) and REST nested routes (/orgs/1/users/2) frequently lack ownership checks at the nested level.

REST discovery: /api, /api/v1, /swagger.json, /openapi.json, /api-docs, and GraphQL at /graphql; introspection query {__schema{types{name}}} reveals the full schema when enabled.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, field-level authorization gaps (query admin-only fields as a normal user), and mutations lacking ownership checks.

API auth weaknesses: missing rate limits on OTP/login, tokens in URLs (logged in proxies), long-lived JWTs without revocation, and API keys embedded in client-side JavaScript.

BOLA (broken object level authorization) is the top API risk: every endpoint taking an object ID must be tested with another user's ID; BFLA is the function-level equivalent for admin-only operations.

WebSocket testing: check Origin validation during the handshake, then send unauthorized messages after connecting; tools like Burp or websocat replay frames.

Server-side prototype pollution in Node.js: inject proto or constructor.prototype via JSON merge endpoints, then look for gadgets (child_process, EJS options) that turn it into RCE.

GraphQL and REST versioning: older versions (/api/v1) often lack the authorization added to /api/v2 - enumerate version prefixes rather than assuming one.

Modern stack fingerprints: Next.js (_next/static), React (root div), Spring Boot (/actuator, /error JSON shape), and Laravel (XSRF-TOKEN cookie) each point to distinct attack surfaces like actuator/env exposure.

Chain logic: low-impact bugs compose into high impact - open redirect plus SSRF filter bypass, XSS plus CSRF token theft, LFI plus log poisoning to RCE, IDOR plus information disclosure to account takeover.

SSRF to cloud takeover: retrieve IMDS credentials, then use them with the cloud CLI (aws s3 ls, aws sts get-caller-identity) to enumerate permissions before acting.

File read to credential harvest: /etc/passwd, app config files (.env, config.php, application.properties), SSH keys, and cloud credential files are the highest-value LFI targets.

XSS to session takeover: exfiltrate document.cookie when HttpOnly is absent, or use fetch to same-origin admin endpoints to perform actions and read responses with the victim's session.

Deserialization chain: find a sink (cookie, hidden field, view state), identify the library, generate a gadget with ysoserial or PHPGGC, and validate with an out-of-band DNS callback first.

Post-exploitation enumeration on a web host: id, sudo -l, SUID binaries, cron jobs, and writable service configs; web shells often run as www-data with limited but useful file access.

Persistence and pivoting: SSH keys in ~/.ssh, cron entries, and database user creation; internal services reachable from the web host (databases, Redis, admin panels) become the pivot targets.

Evidence and reporting: record the exact request/response for each step, the privilege level at each stage, and the business impact - chains are judged by the final impact, not the individual bugs.

Content discovery wordlists: raft-small-words (~11k), directory-list-2.3-medium (~220k); ffuf -w list -u https://t/FUZZ -mc 200,204,301,302,307,401,403 -fs removes soft-404 noise.

Virtual host discovery differs from directory brute force: send Host: FUZZ.target.com with ffuf -H and filter by response size/length; vhosts often resolve to a different app than the default backend.

Technology fingerprint order: HTTP response headers (Server, X-Powered-By), cookie names (PHPSESSID=PHP, JSESSIONID=Java, ASP.NET_SessionId), then body markers and /robots.txt, /sitemap.xml, /.well-known/ paths.

Extension fuzzing: ffuf -w wordlist -u https://t/FUZZ -e .php,.bak,.old,.txt,.zip reveals backups; also test index.php~ (vim swap residue) and .git/HEAD for exposed repositories.

Subdomain enumeration: certificate transparency via crt.sh, then DNS brute force (gobuster dns, dnsx) and permutation tools (alterx); resolve wildcards first or results are all false positives.

Parameter discovery: arjun or paramspider to find hidden GET/POST parameters; compare responses with and without parameters to detect reflected or processed input.

JavaScript analysis yields endpoints: grep downloaded JS bundles for path fragments, API base URLs, and fetch/axios calls; source maps (.js.map) reconstruct unminified source when exposed.

Wayback and archive mining (gau, waybackurls) surfaces historical endpoints and parameters that may still be live but unlinked; deduplicate before testing.

Username enumeration signals: differing status codes, response lengths, or timing between valid and invalid users on login and password-reset flows; a uniform error message does not guarantee uniformity elsewhere.

Password spraying uses one password across many accounts (e.g., Season+Year, Company123) to stay under lockout thresholds; credential stuffing replays breached username/password pairs and is defeated by MFA.

JWT structure is base64url(header).base64url(payload).signature; alg:none and HS256-with-public-key-confusion are the two classic forgery paths when the library accepts attacker-chosen algorithms.

JWT claims to attack: exp (expiry), iss/aud validation, kid (path traversal or SQLi if used in a lookup), jku/x5u (attacker-hosted key set) - verify server-side enforcement, not client display.

Session fixation: attacker sets a known session ID, victim authenticates, and the ID is not rotated; mitigation is regenerating the session identifier at login.

Cookie attribute checks: missing HttpOnly enables XSS-based theft; missing Secure allows transmission over HTTP; SameSite=None without Secure is rejected by modern browsers.

MFA bypass patterns: response manipulation (change {"mfa":false} to true), direct navigation to post-auth endpoints, OTP brute force when no attempt limit exists, and reuse of a validated OTP.

OAuth flaws: missing state parameter (CSRF on callback), redirect_uri allowlist bypass via path traversal or subdomain, and implicit-flow token leakage in the URL fragment or Referer header.

SQLi classification: in-band (UNION, error-based), inferential (boolean, time-based), out-of-band (DNS/HTTP exfil). UNION requires matching column count and compatible types - determine with ORDER BY n or UNION SELECT NULL,NULL,...

DBMS fingerprinting: MySQL comments -- and #, version @@version; MSSQL @@version and WAITFOR DELAY '0:0:5'; PostgreSQL version() and pg_sleep(5); Oracle v$version and dbms_pipe.receive_message.

NoSQLi (MongoDB): operator injection with {"username":{"$ne":null},"password":{"$ne":null}} or $regex for blind extraction; URL-encoded forms use username[$ne]=x. $where enables server-side JavaScript execution.

Command injection separators: ; | || & && newline and $() or backticks; blind confirmation via time delay (sleep 5, ping -c 5) or out-of-band DNS lookup rather than assuming echo output.

SSTI detection polyglot: ${77}, {{77}}, #{7*7}, <%= 7*7 %> - a rendered 49 confirms evaluation; then identify the engine before escalating.

Engine-to-exploit mapping: Jinja2 ({{config}}, {{''.class.mro}} chains to os), Twig ({{_self.env.registerUndefinedFilterCallback}}), Freemarker (<#assign ex="freemarker.template.utility.Execute"?new()>), ERB (<%= system('id') %>).

SQLi to file access: MySQL INTO OUTFILE / LOAD_FILE requires FILE privilege and secure_file_priv permitting the path; MSSQL xp_cmdshell requires sysadmin and is disabled by default.

Second-order injection stores payloads in the database that execute when later concatenated into a different query - test registration, profile, and admin review flows, not just the immediate response.

XSS types: reflected (payload in immediate response), stored (persisted and served to other users), DOM-based (sink executes source data - innerHTML, document.write, eval - without server reflection).

Context determines encoding: HTML body needs < > entity encoding; attribute contexts need quote handling; inside

CSP bypass checks: unsafe-inline, unsafe-eval, wildcard or CDN-hosted script-src with JSONP endpoints, and missing base-uri or object-src directives.

CSRF requires three conditions: a relevant action, cookie-based session handling, and no unpredictable parameter. Defenses are anti-CSRF tokens, SameSite=Lax/Strict cookies, and Origin/Referer validation.

SameSite=Lax sends cookies on top-level GET navigations, so state-changing GET endpoints remain CSRF-able; POST forms from cross-site contexts lose the cookie under Lax.

CORS misconfiguration test: send Origin: https://evil.com and inspect Access-Control-Allow-Origin and Access-Control-Allow-Credentials. ACAO reflecting the origin plus credentials:true is exploitable; a null origin is also abusable via sandboxed iframes.

CORS wildcard (*) with credentials is invalid per spec and browsers block it; the real bug is reflecting arbitrary origins alongside Allow-Credentials: true.

XSS impact escalation: session theft (if no HttpOnly), forced actions as the victim, keylogging on login forms, and chaining with CSRF token disclosure via same-origin fetch.

SSRF targets: 127.0.0.1, localhost, 169.254.169.254 (cloud metadata), 10.0.0.0/8, 192.168.0.0/16, and internal DNS names; AWS IMDSv1 returns credentials at /latest/meta-data/iam/security-credentials/.

Filter bypass encodings: decimal (2130706433), octal, hex, IPv6 (::1), shortened (127.1), DNS rebinding, and URL parsing tricks like http://[email protected].

Blind SSRF confirmation: use a collaborator/interactsh payload in a URL parameter and watch for DNS or HTTP callbacks; absence of a callback does not rule out SSRF if egress is filtered.

gopher:// enables arbitrary TCP payloads (useful against Redis, SMTP, FastCGI); dict:// and file:// extend reach when the wrapper is not disabled.

LFI vs RFI: LFI includes local files (path traversal ../../etc/passwd); RFI requires allow_url_include=On and lets an attacker host PHP code - rarer on modern PHP.

LFI-to-RCE paths: PHP filter chains (php://filter/convert.base64-encode), log poisoning (User-Agent into access.log), /proc/self/environ, session file inclusion, and php://input with POST body.

PHP wrappers: php://filter for source disclosure, data:// for inline code when allow_url_include is on, expect:// when the extension is present, and zip:// or phar:// for archive-based inclusion.

Path traversal encoding ladder: ../, ..%2f, %2e%2e%2f, double-encoded %252e%252e%252f, and null-byte truncation on legacy stacks - test each until normalization behavior is clear.

Language signatures in serialized data: Java starts with AC ED 00 05 (hex) or rO0AB (base64); PHP uses O:4:"User":2:{...}; Python pickle starts with \x80; .NET uses ObjectStateFormatter or BinaryFormatter markers; Ruby uses Marshal \x04\x08.

Java gadget chains rely on libraries on the classpath (CommonsCollections, Spring, Groovy); ysoserial generates payloads per chain, and detection often starts with a DNS lookup from a URLDNS gadget.

PHP object injection: PHPGGC builds chains for frameworks (Laravel, Symfony, Magento); magic methods __wakeup, __destruct, and __toString are the usual sinks.

Python pickle deserialization executes reduce on load - any untrusted pickle is equivalent to remote code execution; there is no safe mode.

Node.js deserialization: node-serialize's unserialize evaluates functions marked with $$ND_FUNC$$, giving RCE when user input reaches it.

.NET: BinaryFormatter and LosFormatter are dangerous; ysoserial.net generates payloads for types like ObjectDataProvider and TypeConfuseDelegate.

Template injection is distinct from deserialization: SSTI executes expressions in the template engine, while deserialization reconstructs objects and triggers magic methods.

Detection for expression injection in non-template contexts: OGNL (%{77} in Struts), SpEL (#{77} in Spring), and EL (${7*7} in JSP) each have distinct syntax and sandbox-escape requirements.

IDOR test pattern: capture a request for /api/user/1001, change the identifier to 1002, and compare responses; also test UUIDs, hashed IDs, and sequential numeric IDs in headers or JSON bodies.

Horizontal vs vertical: horizontal crosses between users of the same role; vertical crosses privilege levels (user to admin). Both can appear in the same endpoint via different parameters.

Mass assignment: add fields like role:admin, isAdmin:true, or verified:true to a profile update and check whether the server binds them; frameworks with allowlists resist this.

Forced browsing: request admin endpoints directly (/admin, /api/v1/admin/users) without the UI link; 200 with data indicates missing server-side authorization, not just hidden navigation.

HTTP method tampering: a GET blocked by a filter may succeed as POST, PUT, PATCH, or with X-HTTP-Method-Override; also test trailing slashes and case variations (/Admin vs /admin).

Business logic flaws: negative quantities, price parameter tampering, coupon reuse, race conditions on redemption (send parallel requests), and step-skipping in multi-stage checkout flows.

JWT/claim-based authorization: changing a role claim in a signed token fails signature checks, but changing it in an unsigned cookie or a server-trusted header (X-User-Role) often succeeds.

Reference-based access control: object references in GraphQL (node(id:...)) and REST nested routes (/orgs/1/users/2) frequently lack ownership checks at the nested level.

REST discovery: /api, /api/v1, /swagger.json, /openapi.json, /api-docs, and GraphQL at /graphql; introspection query {__schema{types{name}}} reveals the full schema when enabled.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, field-level authorization gaps (query admin-only fields as a normal user), and mutations lacking ownership checks.

API auth weaknesses: missing rate limits on OTP/login, tokens in URLs (logged in proxies), long-lived JWTs without revocation, and API keys embedded in client-side JavaScript.

BOLA (broken object level authorization) is the top API risk: every endpoint taking an object ID must be tested with another user's ID; BFLA is the function-level equivalent for admin-only operations.

WebSocket testing: check Origin validation during the handshake, then send unauthorized messages after connecting; tools like Burp or websocat replay frames.

Server-side prototype pollution in Node.js: inject proto or constructor.prototype via JSON merge endpoints, then look for gadgets (child_process, EJS options) that turn it into RCE.

GraphQL and REST versioning: older versions (/api/v1) often lack the authorization added to /api/v2 - enumerate version prefixes rather than assuming one.

Modern stack fingerprints: Next.js (_next/static), React (root div), Spring Boot (/actuator, /error JSON shape), and Laravel (XSRF-TOKEN cookie) each point to distinct attack surfaces like actuator/env exposure.

Chain logic: low-impact bugs compose into high impact - open redirect plus SSRF filter bypass, XSS plus CSRF token theft, LFI plus log poisoning to RCE, IDOR plus information disclosure to account takeover.

SSRF to cloud takeover: retrieve IMDS credentials, then use them with the cloud CLI (aws s3 ls, aws sts get-caller-identity) to enumerate permissions before acting.

File read to credential harvest: /etc/passwd, app config files (.env, config.php, application.properties), SSH keys, and cloud credential files are the highest-value LFI targets.

XSS to session takeover: exfiltrate document.cookie when HttpOnly is absent, or use fetch to same-origin admin endpoints to perform actions and read responses with the victim's session.

Deserialization chain: find a sink (cookie, hidden field, view state), identify the library, generate a gadget with ysoserial or PHPGGC, and validate with an out-of-band DNS callback first.

Post-exploitation enumeration on a web host: id, sudo -l, SUID binaries, cron jobs, and writable service configs; web shells often run as www-data with limited but useful file access.

Persistence and pivoting: SSH keys in ~/.ssh, cron entries, and database user creation; internal services reachable from the web host (databases, Redis, admin panels) become the pivot targets.

Evidence and reporting: record the exact request/response for each step, the privilege level at each stage, and the business impact - chains are judged by the final impact, not the individual bugs.

Content discovery wordlists: raft-small-words (~11k), directory-list-2.3-medium (~220k); ffuf -w list -u https://t/FUZZ -mc 200,204,301,302,307,401,403 -fs removes soft-404 noise.

Virtual host discovery differs from directory brute force: send Host: FUZZ.target.com with ffuf -H and filter by response size/length; vhosts often resolve to a different app than the default backend.

Technology fingerprint order: HTTP response headers (Server, X-Powered-By), cookie names (PHPSESSID=PHP, JSESSIONID=Java, ASP.NET_SessionId), then body markers and /robots.txt, /sitemap.xml, /.well-known/ paths.

Extension fuzzing: ffuf -w wordlist -u https://t/FUZZ -e .php,.bak,.old,.txt,.zip reveals backups; also test index.php~ (vim swap residue) and .git/HEAD for exposed repositories.

Subdomain enumeration: certificate transparency via crt.sh, then DNS brute force (gobuster dns, dnsx) and permutation tools (alterx); resolve wildcards first or results are all false positives.

Parameter discovery: arjun or paramspider to find hidden GET/POST parameters; compare responses with and without parameters to detect reflected or processed input.

JavaScript analysis yields endpoints: grep downloaded JS bundles for path fragments, API base URLs, and fetch/axios calls; source maps (.js.map) reconstruct unminified source when exposed.

Wayback and archive mining (gau, waybackurls) surfaces historical endpoints and parameters that may still be live but unlinked; deduplicate before testing.

Username enumeration signals: differing status codes, response lengths, or timing between valid and invalid users on login and password-reset flows; a uniform error message does not guarantee uniformity elsewhere.

Password spraying uses one password across many accounts (e.g., Season+Year, Company123) to stay under lockout thresholds; credential stuffing replays breached username/password pairs and is defeated by MFA.

JWT structure is base64url(header).base64url(payload).signature; alg:none and HS256-with-public-key-confusion are the two classic forgery paths when the library accepts attacker-chosen algorithms.

JWT claims to attack: exp (expiry), iss/aud validation, kid (path traversal or SQLi if used in a lookup), jku/x5u (attacker-hosted key set) - verify server-side enforcement, not client display.

Session fixation: attacker sets a known session ID, victim authenticates, and the ID is not rotated; mitigation is regenerating the session identifier at login.

Cookie attribute checks: missing HttpOnly enables XSS-based theft; missing Secure allows transmission over HTTP; SameSite=None without Secure is rejected by modern browsers.

MFA bypass patterns: response manipulation (change {"mfa":false} to true), direct navigation to post-auth endpoints, OTP brute force when no attempt limit exists, and reuse of a validated OTP.

OAuth flaws: missing state parameter (CSRF on callback), redirect_uri allowlist bypass via path traversal or subdomain, and implicit-flow token leakage in the URL fragment or Referer header.

SQLi classification: in-band (UNION, error-based), inferential (boolean, time-based), out-of-band (DNS/HTTP exfil). UNION requires matching column count and compatible types - determine with ORDER BY n or UNION SELECT NULL,NULL,...

DBMS fingerprinting: MySQL comments -- and #, version @@version; MSSQL @@version and WAITFOR DELAY '0:0:5'; PostgreSQL version() and pg_sleep(5); Oracle v$version and dbms_pipe.receive_message.

NoSQLi (MongoDB): operator injection with {"username":{"$ne":null},"password":{"$ne":null}} or $regex for blind extraction; URL-encoded forms use username[$ne]=x. $where enables server-side JavaScript execution.

Command injection separators: ; | || & && newline and $() or backticks; blind confirmation via time delay (sleep 5, ping -c 5) or out-of-band DNS lookup rather than assuming echo output.

SSTI detection polyglot: ${77}, {{77}}, #{7*7}, <%= 7*7 %> - a rendered 49 confirms evaluation; then identify the engine before escalating.

Engine-to-exploit mapping: Jinja2 ({{config}}, {{''.class.mro}} chains to os), Twig ({{_self.env.registerUndefinedFilterCallback}}), Freemarker (<#assign ex="freemarker.template.utility.Execute"?new()>), ERB (<%= system('id') %>).

SQLi to file access: MySQL INTO OUTFILE / LOAD_FILE requires FILE privilege and secure_file_priv permitting the path; MSSQL xp_cmdshell requires sysadmin and is disabled by default.

Second-order injection stores payloads in the database that execute when later concatenated into a different query - test registration, profile, and admin review flows, not just the immediate response.

XSS types: reflected (payload in immediate response), stored (persisted and served to other users), DOM-based (sink executes source data - innerHTML, document.write, eval - without server reflection).

Context determines encoding: HTML body needs < > entity encoding; attribute contexts need quote handling; inside

CSP bypass checks: unsafe-inline, unsafe-eval, wildcard or CDN-hosted script-src with JSONP endpoints, and missing base-uri or object-src directives.

CSRF requires three conditions: a relevant action, cookie-based session handling, and no unpredictable parameter. Defenses are anti-CSRF tokens, SameSite=Lax/Strict cookies, and Origin/Referer validation.

SameSite=Lax sends cookies on top-level GET navigations, so state-changing GET endpoints remain CSRF-able; POST forms from cross-site contexts lose the cookie under Lax.

CORS misconfiguration test: send Origin: https://evil.com and inspect Access-Control-Allow-Origin and Access-Control-Allow-Credentials. ACAO reflecting the origin plus credentials:true is exploitable; a null origin is also abusable via sandboxed iframes.

CORS wildcard (*) with credentials is invalid per spec and browsers block it; the real bug is reflecting arbitrary origins alongside Allow-Credentials: true.

XSS impact escalation: session theft (if no HttpOnly), forced actions as the victim, keylogging on login forms, and chaining with CSRF token disclosure via same-origin fetch.

SSRF targets: 127.0.0.1, localhost, 169.254.169.254 (cloud metadata), 10.0.0.0/8, 192.168.0.0/16, and internal DNS names; AWS IMDSv1 returns credentials at /latest/meta-data/iam/security-credentials/.

Filter bypass encodings: decimal (2130706433), octal, hex, IPv6 (::1), shortened (127.1), DNS rebinding, and URL parsing tricks like http://[email protected].

Blind SSRF confirmation: use a collaborator/interactsh payload in a URL parameter and watch for DNS or HTTP callbacks; absence of a callback does not rule out SSRF if egress is filtered.

gopher:// enables arbitrary TCP payloads (useful against Redis, SMTP, FastCGI); dict:// and file:// extend reach when the wrapper is not disabled.

LFI vs RFI: LFI includes local files (path traversal ../../etc/passwd); RFI requires allow_url_include=On and lets an attacker host PHP code - rarer on modern PHP.

LFI-to-RCE paths: PHP filter chains (php://filter/convert.base64-encode), log poisoning (User-Agent into access.log), /proc/self/environ, session file inclusion, and php://input with POST body.

PHP wrappers: php://filter for source disclosure, data:// for inline code when allow_url_include is on, expect:// when the extension is present, and zip:// or phar:// for archive-based inclusion.

Path traversal encoding ladder: ../, ..%2f, %2e%2e%2f, double-encoded %252e%252e%252f, and null-byte truncation on legacy stacks - test each until normalization behavior is clear.

Language signatures in serialized data: Java starts with AC ED 00 05 (hex) or rO0AB (base64); PHP uses O:4:"User":2:{...}; Python pickle starts with \x80; .NET uses ObjectStateFormatter or BinaryFormatter markers; Ruby uses Marshal \x04\x08.

Java gadget chains rely on libraries on the classpath (CommonsCollections, Spring, Groovy); ysoserial generates payloads per chain, and detection often starts with a DNS lookup from a URLDNS gadget.

PHP object injection: PHPGGC builds chains for frameworks (Laravel, Symfony, Magento); magic methods __wakeup, __destruct, and __toString are the usual sinks.

Python pickle deserialization executes reduce on load - any untrusted pickle is equivalent to remote code execution; there is no safe mode.

Node.js deserialization: node-serialize's unserialize evaluates functions marked with $$ND_FUNC$$, giving RCE when user input reaches it.

.NET: BinaryFormatter and LosFormatter are dangerous; ysoserial.net generates payloads for types like ObjectDataProvider and TypeConfuseDelegate.

Template injection is distinct from deserialization: SSTI executes expressions in the template engine, while deserialization reconstructs objects and triggers magic methods.

Detection for expression injection in non-template contexts: OGNL (%{77} in Struts), SpEL (#{77} in Spring), and EL (${7*7} in JSP) each have distinct syntax and sandbox-escape requirements.

IDOR test pattern: capture a request for /api/user/1001, change the identifier to 1002, and compare responses; also test UUIDs, hashed IDs, and sequential numeric IDs in headers or JSON bodies.

Horizontal vs vertical: horizontal crosses between users of the same role; vertical crosses privilege levels (user to admin). Both can appear in the same endpoint via different parameters.

Mass assignment: add fields like role:admin, isAdmin:true, or verified:true to a profile update and check whether the server binds them; frameworks with allowlists resist this.

Forced browsing: request admin endpoints directly (/admin, /api/v1/admin/users) without the UI link; 200 with data indicates missing server-side authorization, not just hidden navigation.

HTTP method tampering: a GET blocked by a filter may succeed as POST, PUT, PATCH, or with X-HTTP-Method-Override; also test trailing slashes and case variations (/Admin vs /admin).

Business logic flaws: negative quantities, price parameter tampering, coupon reuse, race conditions on redemption (send parallel requests), and step-skipping in multi-stage checkout flows.

JWT/claim-based authorization: changing a role claim in a signed token fails signature checks, but changing it in an unsigned cookie or a server-trusted header (X-User-Role) often succeeds.

Reference-based access control: object references in GraphQL (node(id:...)) and REST nested routes (/orgs/1/users/2) frequently lack ownership checks at the nested level.

REST discovery: /api, /api/v1, /swagger.json, /openapi.json, /api-docs, and GraphQL at /graphql; introspection query {__schema{types{name}}} reveals the full schema when enabled.

GraphQL abuse: batching to bypass rate limits, deeply nested queries for DoS, field-level authorization gaps (query admin-only fields as a normal user), and mutations lacking ownership checks.

API auth weaknesses: missing rate limits on OTP/login, tokens in URLs (logged in proxies), long-lived JWTs without revocation, and API keys embedded in client-side JavaScript.

BOLA (broken object level authorization) is the top API risk: every endpoint taking an object ID must be tested with another user's ID; BFLA is the function-level equivalent for admin-only operations.

WebSocket testing: check Origin validation during the handshake, then send unauthorized messages after connecting; tools like Burp or websocat replay frames.

Server-side prototype pollution in Node.js: inject proto or constructor.prototype via JSON merge endpoints, then look for gadgets (child_process, EJS options) that turn it into RCE.

GraphQL and REST versioning: older versions (/api/v1) often lack the authorization added to /api/v2 - enumerate version prefixes rather than assuming one.

Modern stack fingerprints: Next.js (_next/static), React (root div), Spring Boot (/actuator, /error JSON shape), and Laravel (XSRF-TOKEN cookie) each point to distinct attack surfaces like actuator/env exposure.

Chain logic: low-impact bugs compose into high impact - open redirect plus SSRF filter bypass, XSS plus CSRF token theft, LFI plus log poisoning to RCE, IDOR plus information disclosure to account takeover.

SSRF to cloud takeover: retrieve IMDS credentials, then use them with the cloud CLI (aws s3 ls, aws sts get-caller-identity) to enumerate permissions before acting.

File read to credential harvest: /etc/passwd, app config files (.env, config.php, application.properties), SSH keys, and cloud credential files are the highest-value LFI targets.

XSS to session takeover: exfiltrate document.cookie when HttpOnly is absent, or use fetch to same-origin admin endpoints to perform actions and read responses with the victim's session.

Deserialization chain: find a sink (cookie, hidden field, view state), identify the library, generate a gadget with ysoserial or PHPGGC, and validate with an out-of-band DNS callback first.

Post-exploitation enumeration on a web host: id, sudo -l, SUID binaries, cron jobs, and writable service configs; web shells often run as www-data with limited but useful file access.

Persistence and pivoting: SSH keys in ~/.ssh, cron entries, and database user creation; internal services reachable from the web host (databases, Redis, admin panels) become the pivot targets.

Evidence and reporting: record the exact request/response for each step, the privilege level at each stage, and the business impact - chains are judged by the final impact, not the individual bugs.