OSWA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Certificate transparency recon

Public CT logs such as crt.sh record every issued TLS certificate. Querying them reveals subdomains and internal hostnames that never appear in DNS zone transfers or search engines, making them a primary passive enumeration source.

Virtual host enumeration

Sending identical requests with different Host headers to one IP address. Differences in response body length, status code, or redirect target reveal that distinct sites are served from the same server.

Subdomain takeover condition

A DNS CNAME points to a third-party service that is no longer provisioned. Because the provider serves a generic not-found page, an attacker can register the resource and serve content under the victim's hostname.

Content discovery 403 signal

A 403 response to a guessed path confirms the resource exists but access is denied. Pivot from directory guessing to file-extension and backup-file fuzzing, comparing response lengths rather than status codes alone.

Reflected XSS data flow

The payload travels in the current request and is echoed back in the response without persistent storage. Exploitation requires delivering a crafted link or form to the victim, so user interaction is mandatory.

DOM-based XSS

Attacker-controlled data flows from a browser source such as location.hash into an execution sink such as innerHTML. The payload may never reach the server, so server-side filtering cannot detect or block it.

Context-appropriate output encoding

HTML body and attribute contexts require entity encoding. JavaScript string contexts require backslash hex escaping. URL contexts require percent encoding. Using the wrong encoder leaves the break-out character intact.

CSP unsafe-inline absence

When a Content-Security-Policy omits 'unsafe-inline', inline event handlers and inline script blocks are blocked. Exploitation then depends on an allowlisted host that serves JSONP or a bypassable library.

CSRF token validation requirement

The server must compare a per-session or per-request unpredictable token on every state-changing request. Accepting a missing or empty token, or a token from another session, defeats the defense entirely.

SameSite Lax exposure

Lax sends cookies on top-level GET navigations. Any state-changing endpoint reachable by GET remains CSRF-exploitable under Lax, because a link or image request carries the session cookie.

JSON CSRF via text/plain

A text/plain form submission carrying a JSON body is a simple request with no preflight. A server that parses the body regardless of declared Content-Type accepts it, enabling cross-site state changes.

Referer check bypass condition

Origin or Referer validation fails as a defense when the server accepts requests with the header absent. The attacker suppresses the header via a meta referrer policy or a direct non-browser request.

UNION column count discovery

Increment ORDER BY n until an error occurs to learn the column count, or inject UNION SELECT NULL repeatedly until the response changes. The injected query must match both column count and compatible types.

Time-based blind SQLi payloads

Engine-specific delay functions confirm injection without visible output: SLEEP() in MySQL, pg_sleep() in PostgreSQL, WAITFOR DELAY in MSSQL, and DBMS_LOCK.SLEEP in Oracle. Repeat to rule out network jitter.

Second-order SQL injection

Input is stored safely in one context and later concatenated into a query in another, such as a username rendered in an admin report. Testing must follow stored data to its later use.

SQL comment syntax differences

MySQL accepts -- followed by a space and #. MSSQL and PostgreSQL accept --. Oracle accepts --. Getting the trailing comment wrong leaves the remainder of the original query intact and causes syntax errors.

AWS IMDSv2 SSRF obstacle

IMDSv2 requires a PUT request to the token endpoint before metadata can be read. A simple GET-only SSRF cannot obtain the token, so IMDSv2 materially reduces metadata credential theft.

Gopher SSRF pivot

The gopher:// scheme lets an SSRF send arbitrary bytes over TCP to internal services such as Redis or SMTP. It converts a URL-fetch flaw into protocol-level interaction with services that speak no HTTP.

SSRF IP encoding bypasses

Alternate representations of 127.0.0.1 defeat string blacklists: the decimal integer 2130706433, hexadecimal 0x7f000001, octal 0177.0.0.1, and DNS names such as 127.0.0.1.nip.io that resolve locally.

Blind SSRF confirmation methods

Use a listener or collaborator domain to observe the outbound callback. Compare connection-refused errors against timeouts to map open ports, and measure response-time differences for internal reachability.

XXE external entity declaration

A DOCTYPE declares an ENTITY with a SYSTEM identifier pointing to a file or URL, and the document body references it. The parser substitutes the resolved content into the output.

Blind XXE external DTD

A parameter entity loads an attacker-hosted DTD. That DTD defines a second parameter entity that embeds file content into an outbound URL, exfiltrating data without any response reflection.

XXE parser hardening

Disable DTD processing entirely where possible: disallow-doctype-decl in Java, resolve_entities set to false in Python lxml, and external entity loading disabled in libxml. This removes the attack primitive rather than filtering input.

XXE in file upload formats

SVG images, DOCX and XLSX archives, SAML assertions, and SOAP envelopes all contain XML. Any feature that parses uploaded or posted XML is a candidate XXE entry point, not just explicit XML APIs.

CORS reflected origin with credentials

When Access-Control-Allow-Origin echoes the request Origin and Access-Control-Allow-Credentials is true, any site can read authenticated responses. This is the highest-impact CORS misconfiguration.

CORS null origin trust

A policy allowing Access-Control-Allow-Origin: null can be satisfied by a sandboxed iframe or a file:// page. An attacker generates that null origin and reads credentialed responses.

CORS wildcard credential limit

Browsers reject Access-Control-Allow-Origin: * when Access-Control-Allow-Credentials is true. Exploitable credentialed CORS therefore requires a reflected or allowlisted specific origin, not a wildcard.

CORS prefix matching flaw

A server allowing origins that merely contain or start with a trusted string also allows attacker-example.com or example.com.evil.net. Test with lookalike domains to confirm the matching logic is not exact.

SSTI detection polyglot

Submitting ${7*7}{{7*7}}<%= 7*7 %>#{7*7} covers multiple engines in one request. A response containing 49 instead of the literal confirms server-side template evaluation.

Jinja2 versus Twig identification

{{7*7}} returning 49 fits both engines. {{7*'7'}} returning 7777777 indicates Jinja2 string multiplication, while returning 49 indicates Twig. This distinguishes Python from PHP templating.

Jinja2 subclass RCE path

Reach object internals through ''.__class__.__mro__[1].__subclasses__(), locate a class such as subprocess.Popen, and instantiate it. Built-in globals like cycler and lipsum offer a shorter route to os.

FreeMarker Execute gadget

In FreeMarker, assign an instance of freemarker.template.utility.Execute to a variable with the ?new() built-in, then invoke it with a command string. This yields direct remote command execution.