BSCP cheat sheet

SQL injection decision rule: if input reaches a query string, test quote, numeric, and boolean payloads first; error-based, union-based, blind boolean, and time-based are ranked by feedback channel, not by severity.

XSS has three contexts: reflected (payload in current response), stored (payload persisted server-side), and DOM-based (sink reached via client-side JavaScript such as innerHTML or eval without server reflection).

XSS context determines encoding: HTML body needs entity encoding of < > & " '; attribute values need quoting plus encoding; JavaScript string contexts need \x escapes, not HTML entities; URL context needs percent-encoding.

CSRF requires three conditions simultaneously: a state-changing action, cookie-based session authentication, and no unpredictable token or SameSite protection; missing all three means no CSRF, only a logic issue.

Path traversal: ../ sequences are decoded by the server after the framework normalizes, so test single-encoded, double-encoded (%252e%252e%252f), and overlong UTF-8 variants; null byte (%00) truncation only applies to legacy runtimes.

SSRF classification: full response SSRF returns fetched content to attacker; blind SSRF only confirms outbound connection via timing or collaborator DNS/HTTP hit; cloud metadata endpoints (169.254.169.254) are the highest-impact target.

Access control failures split into vertical (lower privilege reaches higher-privilege function) and horizontal (same role reaches another user's object, IDOR); test by replaying requests with swapped identifiers and removed role parameters.

Insecure deserialization is exploitable when attacker-controlled bytes reach a native deserializer (Java ObjectInputStream, PHP unserialize, .NET BinaryFormatter, Python pickle); gadget chains turn object graph control into code execution.

File upload bypass decision rule: check extension blacklist vs whitelist, content-type header trust, magic bytes, and path normalization; a whitelist enforced server-side with random rename and non-executable storage defeats most bypasses.

Proxy scope rule: set target scope before browsing so Proxy history, Repeater, and Scanner traffic are filtered; out-of-scope items are excluded from automatic scanning and from Logger views when filtering is enabled.

Repeater is for manual single-request iteration; Intruder is for automated payload placement across positions; Scanner is for automated detection; using Intruder for fuzzing detection wastes requests because it lacks response-diff analysis.

Intruder attack types: Sniper (one payload set, one position at a time), Battering ram (same payload in all positions), Pitchfork (parallel distinct payload sets), Cluster bomb (cartesian product of payload sets).

Intruder payload processing rules apply sequentially per payload (e.g., add prefix, hash, URL-encode); grep-match and grep-extract rules flag response strings or capture tokens for chaining.

Match and replace rules in Proxy options rewrite requests/responses in flight (headers, body, regex); they do not affect Repeater unless the same rule set is enabled there, and they are the standard way to add auth headers globally.

Scanner audit vs crawl: crawl maps the site and discovers insertion points; audit sends attack payloads to those points; scan configuration controls audit speed, which trades request rate against server stability and detection accuracy.

Collaborator is an out-of-band interaction server used to confirm blind SSRF, blind XSS, and blind injection; generate a unique subdomain per test and poll interactions to attribute hits to specific payloads.

Repeater and Proxy history support 'Send to Comparer' for byte-level or word-level diffing of responses; diffing reveals boolean-based blind injection and access-control differences that single-response inspection misses.

Session handling rules and macros: a macro is a recorded request sequence replayed to obtain fresh tokens or CSRF values; session handling rules invoke macros on 401/403 responses or before requests, enabling automated re-authentication during scans.