attacker-thinking-primers

name

attacker-thinking-primers

description

Conceptual mindset primers for reasoning about each major vuln class during live testing (SQLi, auth, info disclosure, access control, API testing, cache deception, request smuggling, Host header, JWT, SSTI, GraphQL, LLM) -- the "why" behind the payload, not another payload list. Converted from master-pentest-prompt.md Phase 21.6. Use alongside the technique-specific skills as a reasoning framework, especially when a class's standard payloads aren't landing.

Attacker-thinking primers (conceptual knowledge base)

When to use

The payloads live in the technique-specific skills (injection-and-rce, auth-and-session, etc.) -- this is the reasoning layer underneath them, most useful when the standard payload list for a class isn't landing and a different angle is needed.

Primers

• SQLi: any input placed into a query is a candidate. Break structure first ('), then control logic (AND 1=1 vs. AND 1=2), then shape output (UNION, comment-out the rest of the WHERE clause), then go blind (SLEEP/pg_sleep/behavioral diff), then substring-extract. Watch for second-order: a payload stored safely that executes later.
• Authentication: find what the app actually uses to prove identity, then ask whether you can control it -- a cookie, a parameter, a token, or the order of steps. Test for no lockout on brute force, 2FA step skipping, a reset token not actually tied to the user it was issued for, and remember-me cookie forgery.
• Info disclosure: you don't attack this class, you notice it. Verbose errors, stack traces, /robots.txt pointing at /backup/config.php.bak, hidden debug endpoints, .git diffs containing old credentials, headers. Each leak reduces unknowns -- one leaked header () can bypass auth entirely on its own.