HTB CWPE key terms

Discovering site names served by one IP by sending requests with different Host headers or reading certificate SANs, then comparing response size, status, and body to spot hidden applications.

Brute-forcing or wordlist-matching paths, files, and parameters to find endpoints not linked in the visible application, such as backups, admin panels, and API routes.

Requesting resources that exist but are unlinked, relying on missing authorization rather than hidden names; differs from guessing because the path is known from leaks, robots.txt, or JavaScript bundles.

Identifying frameworks, servers, and libraries from headers, cookies, error pages, and static asset hashes so you can select matching exploits and default credentials.

A deployed .map file or unminified bundle that reveals original JavaScript source, including hidden API endpoints, feature flags, and client-side validation logic.

Claiming a cloud or SaaS resource referenced by a dangling DNS record, letting you serve content under the victim's domain name.

Replaying username and password pairs leaked elsewhere against a login form, betting that users reused them; detected by high failure ratios from many source addresses.

Trying one or a few common passwords across many accounts to stay under lockout thresholds, exploiting weak policy rather than leaked credentials.

Distinguishing valid from invalid usernames through differing error text, response time, status codes, or registration and password-reset behavior.

Forcing a victim to authenticate with a session identifier you already know, so the server keeps that identifier after login and you inherit the authenticated session.

Abusing weak JWT verification by switching the header algorithm, for example to none or from RS256 to HS256 so the public key is used as an HMAC secret.

Editing payload claims such as role, sub, or tenant after signature verification is bypassed or the key is recovered, granting another user's privileges.

The unpredictability of a session identifier; low-entropy or sequential tokens can be guessed or brute-forced to hijack other users' sessions.

Appending a UNION SELECT to the original query so attacker-chosen columns appear in the result set, useful only when column count and types match.

Inferring query results from boolean differences, timing delays, or out-of-band callbacks when error messages and data are not returned directly.

Payload stored safely by one request but concatenated unsafely into a query later, such as in an admin report or profile update.

Supplying query operators such as $ne or $regex in place of a scalar value so the database matches unintended documents, often bypassing login checks.

Breaking out of a shell string built from user input using metacharacters like semicolons, pipes, or backticks, then executing arbitrary commands on the server.

Confirming command execution without seeing output, using time delays, DNS or HTTP callbacks, or file writes that are later retrieved.

Injecting template syntax into input that the engine evaluates, such as {{7*7}} returning 49, which can escalate from data disclosure to remote code execution.

Reaching dangerous objects or methods from inside a template context, for example via Python class hierarchies or Java class loaders, to run operating system commands.

Injecting into EL or SpEL expressions evaluated by frameworks, letting attackers call methods and instantiate classes when the expression is evaluated server-side.

Passing attacker-controlled serialized data to a language's deserializer, which can construct object graphs that trigger code execution or file writes during reconstruction.

A sequence of existing classes whose methods fire in order during deserialization, together producing a useful effect such as command execution without injecting new code.

Triggering implicit lifecycle hooks in PHP or Python objects, such as __wakeup, __destruct, or reduce, so behavior runs when an object is created or destroyed.

Persisting script in server data that later renders unescaped for other users, letting an attacker act with their session, including administrative sessions.

Client-side script sinks such as innerHTML or eval consuming attacker-controlled sources like location.hash, executing without the payload ever reaching the server.

Defeating CSP through overly permissive sources, JSONP endpoints, open redirects, or script gadgets so injected script still executes despite the policy.

Circumventing anti-CSRF defenses by removing the token, reusing a valid one, switching methods, or exploiting endpoints that never validate it.

Getting a cross-site request to carry cookies despite SameSite=Lax or Strict, using top-level GET navigations, client-side redirects, or sibling subdomains.

Reflecting arbitrary Origin values or trusting null with credentials enabled, letting any site read authenticated responses from the victim application.

Making the server issue requests to attacker-chosen destinations, reaching internal services, cloud metadata endpoints, or localhost-only admin interfaces.

Evading blocklists using alternate IP encodings, DNS rebinding, redirects, or URL parser quirks so a blocked internal address is still reached.

Using SSRF to query the instance metadata service for temporary credentials, user data, and role tokens that allow lateral movement into cloud accounts.

Manipulating a file path parameter to read server files, often chained with log poisoning or uploaded content to convert file read into code execution.

Using ../ sequences or encoded variants to escape a base directory and access files outside the intended location.

Using stream wrappers like php://filter, php://input, or data:// to read source, bypass filters, or supply executable content to an include.

Accessing another user's object by changing an identifier because the server checks authentication but not ownership of that specific record.

Sending extra object properties the API binds automatically, such as role or isAdmin, so the server updates fields the client was never meant to control.

Abusing legitimate workflow steps out of order or in unusual combinations, like negative quantities or skipped payment, to gain value the design did not intend.

Sending concurrent requests so a check and its update interleave, letting a coupon or balance be redeemed more times than allowed.

Querying the schema for types, fields, and mutations, revealing hidden operations and arguments that are not exposed through the normal UI.

Reaching older or internal API versions such as /v1 or /internal that lack the authorization and validation added to the current version.

APIs returning full objects and relying on the client to hide fields, leaking password hashes, tokens, or other users' details in responses.

Supplying duplicate or nested keys, or mixing JSON with form encoding, so different parsers pick different values and validation diverges from use.

Sending stolen data through DNS or HTTP requests to a server you control, used when blind injection returns no visible output.

Linking low-impact findings, such as SSRF plus metadata credentials plus an internal admin panel, into a path that reaches a high-impact objective.

Moving from a low-privileged account or shell to administrative access by abusing roles, tokens, misconfigured services, or local system weaknesses.

Using credentials, tokens, or trust relationships obtained from one compromised component to reach other hosts or services inside the environment.

Measuring small response-time differences to infer hidden values, such as valid usernames or byte-by-byte secret comparisons.

Vendor-supplied usernames and passwords left unchanged on admin panels, databases, or middleware, giving immediate authenticated access.

Intercepting and modifying requests so checks performed only in the browser, such as price, role, or file type, never apply on the server.