HTB CWPE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Soft 404 filtering

A server returns 200 for nonexistent paths, producing false positives in content discovery. Compare response length, word count, or body hash against a known-missing baseline and filter matches with ffuf's -fs or -fw flags.

Virtual host enumeration

Sending different Host headers to one IP to reveal applications not served on the default vhost. Fuzz the Host header with a wordlist, filtering by response size, since the default backend usually answers all unknown names identically.

Certificate transparency recon

CT logs publicly record every issued TLS certificate. Querying crt.sh for a domain returns subdomains that had certificates, often including internal or staging hosts absent from DNS brute-force wordlists.

JavaScript source map exposure

When a .js.map file is deployed alongside minified bundles, browsers and attackers can reconstruct original source. It frequently reveals API routes, internal hostnames, and comments that were stripped during minification.

JWT algorithm confusion

If a library accepts the algorithm named in the token header, an attacker switches RS256 to HS256 and signs with the server's public key as an HMAC secret, or sets alg to none when that is accepted.

Session fixation

The attacker plants a known session identifier before the victim logs in. If the server does not issue a fresh identifier at authentication, the attacker's known ID becomes authenticated and grants access to the victim's account.

Password spraying

Trying a small set of common passwords against many usernames to avoid account lockout thresholds. It exploits weak passwords without triggering per-account failure counters, unlike brute forcing one account with many guesses.

SameSite cookie behavior

Strict withholds cookies on all cross-site requests. Lax sends them on top-level GET navigations only, so state-changing GET endpoints remain CSRF-able. None requires Secure and sends cookies cross-site.

UNION column enumeration

Before extracting data with UNION SELECT, determine the query's column count using ORDER BY incrementing until an error, or by adding NULL placeholders until the response renders normally.

NoSQL operator injection

MongoDB accepts query operators inside JSON. Supplying {"password":{"$ne":null}} matches any non-null value, bypassing authentication when the input is passed directly into the query document.

Blind command injection confirmation

When command output is not returned, inject a time delay such as sleep 5 or ping -c 5 127.0.0.1 and measure response latency, or trigger an out-of-band DNS lookup to a controlled listener.

SSTI detection polyglot

Submitting ${7*7}, {{7*7}}, #{7*7} and <%= 7*7 %> together reveals whether a template engine evaluates input: any rendered 49 confirms injection, and which syntax worked identifies the engine family.

DOM XSS sinks

Client-side functions that execute or render attacker data without server involvement. innerHTML, document.write, eval, setTimeout with strings, and location assignment are common sinks fed by sources like location.hash.

CORS origin reflection

The server copies the request Origin into Access-Control-Allow-Origin. Combined with Access-Control-Allow-Credentials: true, any attacker site can read authenticated responses from the victim's browser session.

CSRF token bypass patterns

Tokens fail to protect when they are not tied to the user session, are accepted from any value, are validated only on POST, or are leaked in URLs and Referer headers. Verify binding, not just token presence.

CSP unsafe-inline

A Content-Security-Policy containing unsafe-inline permits inline script blocks and event handlers, so HTML injection escalates to script execution. Nonce or hash-based policies without it block that path.

Cloud metadata endpoint

169.254.169.254 serves instance credentials and configuration to any process on the host. Reaching it through SSRF often yields IAM credentials; AWS IMDSv2 requires a token obtained via PUT first.

SSRF localhost bypass encodings

Filters blocking the string 127.0.0.1 are bypassed with 2130706433, 0177.0.0.1, 0x7f000001, [::1], 127.1, or a DNS name resolving to loopback. Each encoding is parsed back to the same address.

PHP filter chain

php://filter/convert.base64-encode/resource=index.php returns a file's source base64-encoded, defeating PHP execution. Chained filters can also generate arbitrary content for inclusion-based RCE.

Log poisoning to RCE

An LFI that includes a log file becomes code execution when the attacker writes PHP into a logged field such as User-Agent, then includes the access log path through the vulnerable parameter.

Java serialization magic bytes

Serialized Java objects begin with hex AC ED 00 05, appearing as rO0AB in base64. Finding these bytes in a cookie or parameter indicates a deserialization sink worth testing with ysoserial gadgets.

PHP magic method sinks

Object injection exploits __wakeup, __destruct, and __toString, which run automatically during unserialize or object destruction. Chaining them through properties in a crafted payload yields file writes or code execution.

Python pickle danger

Unpickling data invokes the __reduce__ method defined in the payload, which can call any function such as os.system. There is no sandbox, so untrusted pickle input is equivalent to remote code execution.

OGNL and SpEL injection

Struts evaluates OGNL in %{7*7} syntax and Spring evaluates SpEL in #{7*7}. Both can reach runtime classes for command execution, but each needs a different sandbox-escape payload.

Mass assignment

Frameworks that bind request parameters directly to model fields accept extra properties. Adding role:admin or verified:true to a profile update can escalate privileges when no allowlist restricts bound fields.

Forced browsing

Requesting privileged endpoints directly rather than through the interface. A 200 response with data proves the server lacks authorization checks; hiding links in the UI is not access control.

Race condition exploitation

Sending parallel requests to a single-use operation such as coupon redemption or balance transfer can process several before the state updates, granting repeated benefit. Single-packet attack techniques improve timing.

BOLA in APIs

Broken object level authorization: an endpoint accepts an object identifier and returns it without verifying the caller owns it. Testing every ID-bearing endpoint with another user's identifier is the standard check.

GraphQL introspection

The {__schema{types{name}}} query returns every type and field when introspection is enabled, exposing hidden mutations and admin-only fields that are not used by the client application.

Server-side prototype pollution

Injecting __proto__ into JSON merged into objects pollutes Object.prototype in Node.js. If a gadget later reads the polluted property, it can lead to command execution or authentication bypass.

SSRF to cloud credential theft

Chaining SSRF with the metadata service: request the IAM role name, then fetch temporary credentials from the credentials path, and use them with the cloud CLI to enumerate permissions.

LFI to RCE chain

Combining local file inclusion with a write primitive: poison a log or session file with PHP code, then include it. Neither the file read nor the write alone yields execution.