OSWE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Taint source

A point where untrusted data enters the application, such as query strings, POST bodies, cookies, HTTP headers, uploaded filenames, or database values re-read later.

Taint sink

A function that performs a dangerous operation with its input, such as eval, system, include, unserialize, or an SQL query string, making exploitation possible if tainted data reaches it.

.git directory exposure

A web-accessible /.git/ folder leaks repository objects; requesting /.git/config confirms it, after which the source tree can be dumped and secrets read.

Session fixation test

If the Set-Cookie session identifier issued before login is still accepted afterwards, an attacker who planted that value can hijack the authenticated session.

JWT algorithm confusion

When a server verifies RS256 tokens but also accepts HS256, sign a token using the published public key as the HMAC secret to forge arbitrary claims such as admin=true.

IDOR test method

Swap object identifiers to values belonging to another user, and also try method changes, parameter duplication, and sequential or leaked UUIDs to detect missing ownership checks.

PHP loose comparison bypass

Loose equality treats strings like '0e12345' as numeric zero, so two distinct magic-hash values compare equal; array injection via param[]= also bypasses string comparisons.

UNION column enumeration

Increment ORDER BY n until an error occurs to learn the query's column count, then craft a UNION SELECT with matching column types to extract data.

Time-based blind SQLi

Inject a database-specific delay function such as SLEEP, pg_sleep, or WAITFOR DELAY and infer each byte of data from whether the response arrives late.

NoSQL operator injection

Submitting {$ne:null} or {$gt:""} instead of a string makes MongoDB match any value, bypassing authentication or extracting data through operator-based queries.

LDAP filter injection

Unescaped characters such as asterisk, parenthesis and backslash in a search filter let an attacker alter the query, for example appending *)(uid=*))(|(uid=* to match any entry.

DOM XSS sinks

JavaScript properties and functions such as innerHTML, document.write, eval and location assignments render attacker-controlled strings as markup, producing client-side execution without any server involvement.

CSP JSONP bypass

A policy allowing a host that serves JSONP callbacks is bypassed by loading that endpoint with a callback parameter containing script, since the response is treated as whitelisted code.

HttpOnly cookie limitation

HttpOnly blocks document.cookie access but does not stop injected script from issuing authenticated requests, reading CSRF tokens from the DOM, or acting as the victim.

Stored XSS impact

Persisted script runs for every viewer, letting an attacker hijack admin sessions, perform privileged actions, install keyloggers, or pivot into internal interfaces; chaining supplies the real value.

PHP filter wrapper

php://filter/convert.base64-encode/resource=index.php returns base64-encoded source of a local file, disclosing code without executing it during local file inclusion.

Upload extension bypass

Blacklist filters are evaded with alternate executable extensions (.phtml, .php5, .phar), double extensions, trailing dots or spaces on Windows, or an uploaded .htaccess remapping extensions.

Zip slip

An archive entry named ../../etc/cron.d/x is written outside the intended extraction directory when the extractor concatenates entry names without canonicalizing the resolved path.

Log poisoning to RCE

Injecting PHP code into a User-Agent so it lands in the access log, then including that log via LFI, converts file inclusion into remote code execution.

PHP POP chain

A chain of magic methods such as __destruct calling __toString across loaded classes that an attacker assembles inside a serialized object to reach a dangerous function.

Python pickle RCE

pickle.loads on untrusted data executes arbitrary code through __reduce__, which can return os.system as the callable together with the command argument to run.

SSTI detection polyglot

The payload ${{<%[%'"}}%\ makes template engines error differently, while simpler probes such as ${7*7} returning 49 confirm server-side expression evaluation.

Jinja2 subclass exploitation

Access __class__.__mro__[1].__subclasses__() from a template to locate subprocess.Popen or an os wrapper, then run commands through that object's globals.

Cloud metadata endpoint

169.254.169.254 serves instance credentials; on AWS request /latest/meta-data/iam/security-credentials/ and on GCP send the Metadata-Flavor: Google header.

SSRF IP encoding bypass

Blacklists for 127.0.0.1 are bypassed with decimal 2130706433, octal 0177.0.0.1, hexadecimal 0x7f000001, IPv6 [::1], or a DNS name resolving to loopback.

Blind XXE out-of-band

An external parameter entity pointing to an attacker-hosted DTD exfiltrates file contents through a crafted URL request, revealing data even when responses are never reflected.

Mass assignment

Adding fields like role=admin or isVerified=true to a JSON request body succeeds when the server binds request parameters directly to model attributes without an allowlist.

Race condition exploitation

Sending many identical requests in parallel before state is committed lets a coupon, balance, or one-time token be redeemed multiple times; HTTP/2 single-packet attacks maximize the overlap.

Verification response tampering

When verification status is decided client-side, editing the JSON body or status code from {"verified":false} to true, or changing the email after verification, grants a verified account.

requests.Session persistence

A Session object keeps cookies and connection state across calls, so an authenticated session established once can drive a multi-step exploit chain without manual header handling.

Threading for race windows

A ThreadPoolExecutor with a barrier releasing all workers at once maximizes concurrency, narrowing the gap between requests to exploit check-then-act logic flaws.

Out-of-band interaction polling

Exploit scripts poll an interactsh or Collaborator host for DNS and HTTP callbacks to confirm blind SSRF, XXE, or command injection when no output returns inline.