用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-06命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-info-06 |
| description | Identify Application Entry Points |
| category | information-gathering |
| owasp_id | WSTG-INFO-06 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["wstg-inpv-05","wstg-inpv-09","wstg-conf-05"] |
| prerequisites | ["wstg-info-01"] |
| severity_boost | {} |
WSTG-INFO-06
Identify Application Entry Points
Entry points are the interfaces through which user-supplied data enters the application. Identifying all entry points is critical for mapping the application's attack surface before conducting targeted security tests. Entry points include URL parameters, POST body data, HTTP headers, cookies, file uploads, and any other mechanism that accepts user input. A comprehensive understanding of entry points allows penetration testers to systematically test each input vector for vulnerabilities such as injection, access control bypasses, and business logic flaws.
GET /app/search?query=test&category=all&page=1&sort=desc HTTP/1.1
Host: target.com
Cookie: session=abc123; preference=dark
User-Agent: Mozilla/5.0
Referer: https://target.com/home
X-Requested-With: XMLHttpRequest
| Location | Parameter | Value |
|---|---|---|
| Query String | query | test |
| Query String | category | all |
| Query String | page | 1 |
| Query String | sort | desc |
| Cookie | session | abc123 |
| Cookie | preference | dark |
| Header | User-Agent | Mozilla/5.0 |
| Header | Referer | https://... |
| Header | X-Requested-With | XMLHttpRequest |
POST /app/checkout HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123
product_id=100&quantity=2&price=50.00&discount_code=SAVE10&shipping=express
| Location | Parameter | Value | Notes |
|---|---|---|---|
| Body | product_id | 100 | Potential IDOR |
| Body | quantity | 2 | Integer manipulation |
| Body | price | 50.00 | Price tampering |
| Body | discount_code | SAVE10 | Brute-force target |
| Body | shipping | express | Business logic |
POST /api/v1/users HTTP/1.1
Host: target.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1...
X-API-Key: abcd1234
{
"username": "newuser",
"email": "user@example.com",
"role": "user",
"permissions": ["read", "write"],
"metadata": {
"source": "web",
"version": "2.0"
}
}
| Location | Parameter | Path | Type |
|---|---|---|---|
| Header | Authorization | - | JWT Token |
| Header | X-API-Key | - | API Key |
| Body | username | $.username | String |
| Body | |||
| Body | role | $.role | Enum |
| Body | permissions | $.permissions[] | Array |
| Body | source | $.metadata.source | Nested |
GET /api/users/123/orders/456/items
| Segment | Type | Description |
|---|---|---|
| users | Resource | User collection |
| 123 | ID Parameter | User ID (IDOR test) |
| orders | Resource | Orders collection |
| 456 | ID Parameter | Order ID (IDOR test) |
| items | Resource | Items sub-resource |
HTTP/1.1 200 OK
Server: nginx/1.18.0
Set-Cookie: session=newvalue; HttpOnly; Secure
Set-Cookie: tracking=xyz; Path=/
X-Request-ID: req-12345
X-Debug-Mode: enabled
Cache-Control: no-cache
Content-Type: application/json
| Header | Value | Security Note |
|---|---|---|
| Server | nginx/1.18.0 | Version disclosure |
| Set-Cookie | session=... | Session management |
| X-Debug-Mode | enabled | Debug info leak |
| X-Request-ID | req-12345 | Tracking identifier |
<form action="/checkout" method="POST">
<input type="hidden" name="csrf_token" value="abc123" />
<input type="hidden" name="user_id" value="500" />
<input type="hidden" name="base_price" value="100.00" />
<input type="hidden" name="is_admin" value="false" />
<input type="text" name="quantity" value="1" />
<button type="submit">Purchase</button>
</form>
| Field | Value | Risk |
|---|---|---|
| csrf_token | abc123 | Token strength |
| user_id | 500 | IDOR vulnerability |
| base_price | 100.00 | Price manipulation |
| is_admin | false | Privilege escalation |
Document workflows that require multiple requests:
1. GET /cart → View cart
2. POST /cart/apply-coupon → Apply discount
3. GET /checkout → Checkout page
4. POST /checkout/address → Submit address
5. POST /checkout/payment → Submit payment
6. POST /checkout/confirm → Confirm order
| Step | Method | Key Parameters | State |
|---|---|---|---|
| 1 | GET | - | Unauthenticated |
| 2 | POST | coupon_code | Cart active |
| 3 | GET | - | Authenticated |
| 4 | POST | address_id, new_address | Cart active |
| 5 | POST | card_token, save_card | Address set |
| 6 | POST | confirm_token | Payment ready |
// Browser DevTools > Network > WS
ws://target.com/socket
wss://target.com/secure-socket
// WebSocket message format
{"action": "subscribe", "channel": "orders", "user_id": 123}
# GraphQL query entry points
query {
user(id: 123) {
name
email
orders {
id
total
}
}
}
mutation {
updateUser(id: 123, role: "admin") {
success
}
}
| Tool | Description | Key Feature |
|---|---|---|
| Burp Suite | Web proxy | Site map, parameter extraction |
| OWASP ZAP | Open-source proxy | Automated spider, HUD |
| Fiddler | Traffic inspector | .NET integration |
| mitmproxy | CLI proxy | Scriptable interception |
| Charles Proxy | macOS proxy | SSL proxying |
| Tool | Description | Usage |
|---|---|---|
| Attack Surface Detector | Source code analysis | java -jar asd.jar <source> |
| Param Miner | Burp extension | Hidden parameter discovery |
| Arjun | Parameter finder | arjun -u https://target.com |
| x8 | Hidden parameter discovery | x8 -u https://target.com |
| ParamSpider | Parameter extraction | paramspider -d target.com |
| Tool | Description |
|---|---|
| Postman | API testing |
| Insomnia | REST/GraphQL client |
| GraphQL Voyager | Schema visualization |
| Swagger UI | OpenAPI testing |
# Install
pip3 install arjun
# Basic scan
arjun -u https://target.com/page
# With wordlist
arjun -u https://target.com/page -w params.txt
# JSON body parameters
arjun -u https://target.com/api -m POST -c 'Content-Type: application/json'
# Multiple URLs
arjun -i urls.txt -o results.json
# Install
git clone https://github.com/devanshbatham/paramspider
cd paramspider
pip3 install -r requirements.txt
# Basic usage
python3 paramspider.py -d target.com
# Exclude specific parameters
python3 paramspider.py -d target.com -e js,css,png
# Output to file
python3 paramspider.py -d target.com -o params.txt
# Install (Rust required)
cargo install x8
# Basic scan
x8 -u https://target.com/page -w params.txt
# With method and body
x8 -u https://target.com/api -X POST -b '{"test":"value"}'
#!/bin/bash
# Extract entry points from Burp Suite export
INPUT_FILE=$1
OUTPUT_FILE="entry_points.csv"
echo "URL,Method,Parameter,Location,Type" > $OUTPUT_FILE
# Parse URLs for GET parameters
grep -oP 'https?://[^\s]+' $INPUT_FILE | while read url; do
# Extract query parameters
echo "$url" | grep -oP '\?[^#]+' | tr '&' '\n' | while read param; do
name=$(echo $param | cut -d= -f1 | tr -d '?')
echo "$url,GET,$name,Query String,Unknown" >> $OUTPUT_FILE
done
done
echo "Entry points saved to $OUTPUT_FILE"
## Endpoint: /api/users/{id}
### Request
- **Method**: PUT
- **Authentication**: Required (Bearer token)
- **Content-Type**: application/json
### Parameters
| Name | Location | Type | Required | Description |
| ------------- | -------- | ------- | -------- | ------------- |
| id | URL Path | Integer | Yes | User ID |
| Authorization | Header | String | Yes | JWT Token |
| name | Body | String | No | Display name |
| email | Body | String | No | Email address |
| role | Body | Enum | No | user/admin |
### Example Request
```json
PUT /api/users/123
Authorization: Bearer eyJ...
Content-Type: application/json
{
"name": "John Doe",
"email": "john@example.com",
"role": "user"
}
```
---
## Remediation Guide
### 1. Input Validation
```python
# Server-side validation example
def validate_user_input(data):
schema = {
'username': {'type': 'string', 'minlength': 3, 'maxlength': 50},
'email': {'type': 'string', 'regex': r'^[^@]+@[^@]+\.[^@]+$'},
'age': {'type': 'integer', 'min': 0, 'max': 150},
'role': {'type': 'string', 'allowed': ['user', 'moderator']}
}
# Validate against schema
return validate(data, schema)
<!-- BAD: Exposing sensitive data -->
<input type="hidden" name="price" value="100.00" />
<input type="hidden" name="is_admin" value="false" />
<!-- GOOD: Server-side price lookup -->
<input type="hidden" name="product_id" value="SKU123" />
<!-- Price calculated server-side based on product_id -->
# Check ownership before processing
def update_order(request, order_id):
order = Order.objects.get(id=order_id)
if order.user_id != request.user.id:
return HttpResponseForbidden()
# Process update
Set-Cookie: session=value; HttpOnly; Secure; SameSite=Strict
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'
# nginx rate limiting
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
server {
location /api/ {
limit_req zone=api burst=20 nodelay;
}
}
This is a reconnaissance/enumeration activity, not a direct vulnerability. The CVSS score depends on what is discovered:
Entry Point Mapping (Info)
Excessive Entry Points (Observation)
| Observation | Risk Level | Implication |
|---|---|---|
| < 20 parameters | Low | Minimal attack surface |
| 20-50 parameters | Medium | Moderate attack surface |
| 50-100 parameters | High | Large attack surface |
| > 100 parameters | Critical | Extensive testing required |
| CWE ID | Title | Relevance |
|---|---|---|
| CWE-20 | Improper Input Validation | Entry points require validation |
| CWE-284 | Improper Access Control | Entry point authorization |
| CWE-639 | Authorization Bypass Through User-Controlled Key | ID parameters in paths |
| CWE-352 | Cross-Site Request Forgery | Form entry points |
[ ] Proxy configured and traffic captured
[ ] All GET parameters documented
[ ] All POST parameters documented
[ ] Hidden form fields identified
[ ] Cookie parameters noted
[ ] Custom headers recorded
[ ] RESTful path parameters mapped
[ ] JSON/XML body parameters extracted
[ ] File upload fields identified
[ ] WebSocket endpoints documented
[ ] GraphQL queries analyzed
[ ] Multi-step processes mapped
[ ] Authentication requirements noted
[ ] Parameter data types identified
[ ] Required vs optional parameters distinguished
[ ] Response headers analyzed
[ ] Entry point spreadsheet/document created
[ ] Attack surface summary prepared