deep-cut-surfaces

name

deep-cut-surfaces

description

HackTricks-level deep-cut techniques not covered by the mainstream vuln-class skills -- ESI/SSI injection, NTLM relay/coercion, SMTP header injection, JSONP hijacking, XS-Leak timing oracles, tabnabbing, DNS rebinding, exposed management interfaces (JMX/Druid/Kafka admin), ORM error leaks, PHP type juggling, insecure randomness, GWT RPC, Java RMI, and deeper GraphQL/WebSocket issues. Converted from master-pentest-prompt.md Phase 23. Use as a secondary pass after the mainstream vuln classes are covered, or when the target's stack specifically suggests one of these (e.g. a CDN in front suggests checking ESI).

Missing deep-cut surfaces (HackTricks-level)

When to use

After the mainstream vuln-class skills are covered, or when a specific signal points here directly -- a CDN/edge-cache provider suggests checking ESI injection, an internal Windows-adjacent auth flow suggests NTLM, a contact form suggests SMTP header injection.

Edge / include injection

• ESI injection (Edge Side Includes): <esi:include src="//evil/x"> can achieve internal SSRF or cache poisoning on Akamai/Fastly/Varnish deployments that process ESI tags.
• SSI injection (Server Side Includes): <!--#exec cmd="id"--> in an uploaded file processed by Apache mod_ssi (commonly .shtml).

Mail and auth protocol

• SMTP header injection: a contact form vulnerable to %0d%0aBcc: can become an open spam relay.
• NTLM / Integrated Windows Auth: HTTP-based NTLM coercion (Responder, PrinterBug/PetitPotam delivered over HTTP to capture NTLM hashes), NTLM relay to an HTTP target.

Client-side / browser-trust issues

• JSONP hijacking: legacy callback= endpoints that leak authenticated user data cross-origin, since JSONP responses are just executable JS the requesting origin can read.
• Content spoofing / HTML injection: phishing without needing actual script execution.
• XS-Leak: cross-site timing/cache/oracle leaks (window.length, favicon cache behavior, media error events) used to confirm the existence of a resource the attacker shouldn't be able to see directly.
• Tabnabbing: target="_blank" without rel="noopener" lets the opened page control/hijack the opener tab.
• DNS rebinding: pin a benign IP that passes an SSRF allowlist check, then rebind the same hostname to an internal IP for the actual request.
• Headless browser abuse (PhantomJS-style server-side rendering): URL parameter injection, SSRF, local file read through the rendering service.

Server-side misconfiguration

• External variable modification: injection into environment variables or headers that get trusted and used later in the request lifecycle.
• Insecure management interfaces: exposed JConsole, JMX over RMI, Druid's admin console, Spring Boot Actuator env/heapdump endpoints, Kafka or Redis admin UIs left reachable.
• Insecure source code management: .git/.svn/.hg exposure (see the information-disclosure skill), misconfigured AWS CodeCommit access, an exposed SonarQube instance.
• Virtual host enumeration: fuzz for vhosts with a dedicated wordlist -- a vhost not linked from anywhere can carry weaker auth.
• ORM leak: Hibernate/TypeORM-style error messages that leak raw SQL or schema details.
• Type juggling (PHP-specific): loose comparison (== vs. ===), "0e123"-style magic hash collisions, MD5 collision arrays (password[]= bypass), 0 == "abc" evaluating true under loose comparison.
• Insecure randomness: predictable tokens/OTPs/secrets from a time-based or otherwise guessable seed, weak UUIDv1 (embeds a MAC address), poor PRNG seeding generally.

Less-common RPC/API surfaces

• Google Web Toolkit (GWT) RPC: IDOR, auth bypass, and service injection in GWT's serialized RPC format.
• Java RMI: an exposed RMI registry (port 1099) can allow remote class loading.
• GraphQL (deeper cuts beyond the basics in access-control-and-idor): introspection queries, batching brute-force, alias-based IDOR, query depth for DoS, field-suggestion schema leakage, and GET-based introspection responses ending up cached where they shouldn't be.
• WebSockets: no authentication on the socket, cross-site WebSocket hijacking, subprotocol injection, ws:// downgrade from wss://, and message deserialization where the client sends a serialized object the server deserializes unsafely (a potential RCE path).