Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-06명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SKILL.md 표시 중
SOC 직업 분류 기준
| name | wstg-info-06 |
| description | Identify Application Entry Points |
| category | information-gathering |
| owasp_id | WSTG-INFO-06 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["wstg-inpv-05","wstg-inpv-09","wstg-conf-05"] |
| prerequisites | ["wstg-info-01"] |
| severity_boost | {} |
WSTG-INFO-06
Identify Application Entry Points
Entry points are the interfaces through which user-supplied data enters the application. Identifying all entry points is critical for mapping the application's attack surface before conducting targeted security tests. Entry points include URL parameters, POST body data, HTTP headers, cookies, file uploads, and any other mechanism that accepts user input. A comprehensive understanding of entry points allows penetration testers to systematically test each input vector for vulnerabilities such as injection, access control bypasses, and business logic flaws.
GET /app/search?query=test&category=all&page=1&sort=desc HTTP/1.1
Host: target.com
Cookie: session=abc123; preference=dark
User-Agent: Mozilla/5.0
Referer: https://target.com/home
X-Requested-With: XMLHttpRequest
| Location | Parameter | Value |
|---|---|---|
| Query String | query | test |
| Query String | category | all |
| Query String | page | 1 |
| Query String | sort | desc |
| Cookie | session | abc123 |
| Cookie | preference | dark |
| Header | User-Agent | Mozilla/5.0 |
| Header | Referer | https://... |
| Header | X-Requested-With | XMLHttpRequest |
POST /app/checkout HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123
product_id=100&quantity=2&price=50.00&discount_code=SAVE10&shipping=express
| Location | Parameter | Value | Notes |
|---|---|---|---|
| Body | product_id | 100 | Potential IDOR |
| Body | quantity | 2 | Integer manipulation |
| Body | price | 50.00 | Price tampering |
| Body | discount_code | SAVE10 | Brute-force target |
| Body | shipping | express | Business logic |
POST /api/v1/users HTTP/1.1
Host: target.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1...
X-API-Key: abcd1234
{
"username": "newuser",
"email": "user@example.com",
"role": "user",
"permissions": ["read", "write"],
"metadata": {
"source": "web",
"version": "2.0"
}
}
| Location | Parameter | Path | Type |
|---|---|---|---|
| Header | Authorization | - | JWT Token |
| Header | X-API-Key | - | API Key |
| Body | username | $.username | String |
| Body | |||
| Body | role | $.role | Enum |
| Body | permissions | $.permissions[] | Array |
| Body | source | $.metadata.source | Nested |
GET /api/users/123/orders/456/items
| Segment | Type | Description |
|---|---|---|
| users | Resource | User collection |
| 123 | ID Parameter | User ID (IDOR test) |
| orders | Resource | Orders collection |
| 456 | ID Parameter | Order ID (IDOR test) |
| items | Resource | Items sub-resource |
HTTP/1.1 200 OK
Server: nginx/1.18.0
Set-Cookie: session=newvalue; HttpOnly; Secure
Set-Cookie: tracking=xyz; Path=/
X-Request-ID: req-12345
X-Debug-Mode: enabled
Cache-Control: no-cache
Content-Type: application/json
| Header | Value | Security Note |
|---|---|---|
| Server | nginx/1.18.0 | Version disclosure |
| Set-Cookie | session=... | Session management |
| X-Debug-Mode | enabled | Debug info leak |
| X-Request-ID | req-12345 | Tracking identifier |
<form action="/checkout" method="POST">
<input type="hidden" name="csrf_token" value="abc123" />
<input type="hidden" name="user_id" value="500" />
<input type="hidden" name="base_price" value="100.00" />
<input type="hidden" name="is_admin" value="false" />
<input type="text" name="quantity" value="1" />
<button type="submit">Purchase</button>
</form>
| Field | Value | Risk |
|---|---|---|
| csrf_token | abc123 | Token strength |
| user_id | 500 | IDOR vulnerability |
| base_price | 100.00 | Price manipulation |
| is_admin | false | Privilege escalation |
Document workflows that require multiple requests:
1. GET /cart → View cart
2. POST /cart/apply-coupon → Apply discount
3. GET /checkout → Checkout page
4. POST /checkout/address → Submit address
5. POST /checkout/payment → Submit payment
6. POST /checkout/confirm → Confirm order
| Step | Method | Key Parameters | State |
|---|---|---|---|
| 1 | GET | - | Unauthenticated |
| 2 | POST | coupon_code | Cart active |
| 3 | GET | - | Authenticated |
| 4 | POST | address_id, new_address | Cart active |
| 5 | POST | card_token, save_card | Address set |
| 6 | POST | confirm_token | Payment ready |
// Browser DevTools > Network > WS
ws://target.com/socket
wss://target.com/secure-socket
// WebSocket message format
{"action": "subscribe", "channel": "orders", "user_id": 123}
# GraphQL query entry points
query {
user(id: 123) {
name
email
orders {
id
total
}
}
}
mutation {
updateUser(id: 123, role: "admin") {
success
}
}
| Tool | Description | Key Feature |
|---|---|---|
| Burp Suite | Web proxy | Site map, parameter extraction |
| OWASP ZAP | Open-source proxy | Automated spider, HUD |
| Fiddler | Traffic inspector | .NET integration |
| mitmproxy | CLI proxy | Scriptable interception |
| Charles Proxy | macOS proxy | SSL proxying |
| Tool | Description | Usage |
|---|---|---|
| Attack Surface Detector | Source code analysis | java -jar asd.jar <source> |
| Param Miner | Burp extension | Hidden parameter discovery |
| Arjun | Parameter finder | arjun -u https://target.com |
| x8 | Hidden parameter discovery | x8 -u https://target.com |
| ParamSpider | Parameter extraction | paramspider -d target.com |
| Tool | Description |
|---|---|
| Postman | API testing |
| Insomnia | REST/GraphQL client |
| GraphQL Voyager | Schema visualization |
| Swagger UI | OpenAPI testing |
# Install
pip3 install arjun
# Basic scan
arjun -u https://target.com/page
# With wordlist
arjun -u https://target.com/page -w params.txt
# JSON body parameters
arjun -u https://target.com/api -m POST -c 'Content-Type: application/json'
# Multiple URLs
arjun -i urls.txt -o results.json
# Install
git clone https://github.com/devanshbatham/paramspider
cd paramspider
pip3 install -r requirements.txt
# Basic usage
python3 paramspider.py -d target.com
# Exclude specific parameters
python3 paramspider.py -d target.com -e js,css,png
# Output to file
python3 paramspider.py -d target.com -o params.txt
# Install (Rust required)
cargo install x8
# Basic scan
x8 -u https://target.com/page -w params.txt
# With method and body
x8 -u https://target.com/api -X POST -b '{"test":"value"}'
#!/bin/bash
# Extract entry points from Burp Suite export
INPUT_FILE=$1
OUTPUT_FILE="entry_points.csv"
echo "URL,Method,Parameter,Location,Type" > $OUTPUT_FILE
# Parse URLs for GET parameters
grep -oP 'https?://[^\s]+' $INPUT_FILE | while read url; do
# Extract query parameters
echo "$url" | grep -oP '\?[^#]+' | tr '&' '\n' | while read param; do
name=$(echo $param | cut -d= -f1 | tr -d '?')
echo "$url,GET,$name,Query String,Unknown" >> $OUTPUT_FILE
done
done
echo "Entry points saved to $OUTPUT_FILE"
## Endpoint: /api/users/{id}
### Request
- **Method**: PUT
- **Authentication**: Required (Bearer token)
- **Content-Type**: application/json
### Parameters
| Name | Location | Type | Required | Description |
| ------------- | -------- | ------- | -------- | ------------- |
| id | URL Path | Integer | Yes | User ID |
| Authorization | Header | String | Yes | JWT Token |
| name | Body | String | No | Display name |
| email | Body | String | No | Email address |
| role | Body | Enum | No | user/admin |
### Example Request
```json
PUT /api/users/123
Authorization: Bearer eyJ...
Content-Type: application/json
{
"name": "John Doe",
"email": "john@example.com",
"role": "user"
}
```
---
## Remediation Guide
### 1. Input Validation
```python
# Server-side validation example
def validate_user_input(data):
schema = {
'username': {'type': 'string', 'minlength': 3, 'maxlength': 50},
'email': {'type': 'string', 'regex': r'^[^@]+@[^@]+\.[^@]+$'},
'age': {'type': 'integer', 'min': 0, 'max': 150},
'role': {'type': 'string', 'allowed': ['user', 'moderator']}
}
# Validate against schema
return validate(data, schema)
<!-- BAD: Exposing sensitive data -->
<input type="hidden" name="price" value="100.00" />
<input type="hidden" name="is_admin" value="false" />
<!-- GOOD: Server-side price lookup -->
<input type="hidden" name="product_id" value="SKU123" />
<!-- Price calculated server-side based on product_id -->
# Check ownership before processing
def update_order(request, order_id):
order = Order.objects.get(id=order_id)
if order.user_id != request.user.id:
return HttpResponseForbidden()
# Process update
Set-Cookie: session=value; HttpOnly; Secure; SameSite=Strict
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'
# nginx rate limiting
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
server {
location /api/ {
limit_req zone=api burst=20 nodelay;
}
}
This is a reconnaissance/enumeration activity, not a direct vulnerability. The CVSS score depends on what is discovered:
Entry Point Mapping (Info)
Excessive Entry Points (Observation)
| Observation | Risk Level | Implication |
|---|---|---|
| < 20 parameters | Low | Minimal attack surface |
| 20-50 parameters | Medium | Moderate attack surface |
| 50-100 parameters | High | Large attack surface |
| > 100 parameters | Critical | Extensive testing required |
| CWE ID | Title | Relevance |
|---|---|---|
| CWE-20 | Improper Input Validation | Entry points require validation |
| CWE-284 | Improper Access Control | Entry point authorization |
| CWE-639 | Authorization Bypass Through User-Controlled Key | ID parameters in paths |
| CWE-352 | Cross-Site Request Forgery | Form entry points |
[ ] Proxy configured and traffic captured
[ ] All GET parameters documented
[ ] All POST parameters documented
[ ] Hidden form fields identified
[ ] Cookie parameters noted
[ ] Custom headers recorded
[ ] RESTful path parameters mapped
[ ] JSON/XML body parameters extracted
[ ] File upload fields identified
[ ] WebSocket endpoints documented
[ ] GraphQL queries analyzed
[ ] Multi-step processes mapped
[ ] Authentication requirements noted
[ ] Parameter data types identified
[ ] Required vs optional parameters distinguished
[ ] Response headers analyzed
[ ] Entry point spreadsheet/document created
[ ] Attack surface summary prepared