Web Exploitation

This phase covers active exploitation of identified vulnerabilities to demonstrate impact and gain access to the target application or underlying systems. Each vulnerability type has its own comprehensive guide with detailed techniques, automation scripts, and practice labs.

Warning

Always ensure you have proper authorization before attempting any exploitation techniques. Document all actions taken for the final report.

Exploitation Guides

SQL Injection

Union-based, blind Boolean/time-based, error-based SQLi. WAF bypasses and database-specific payloads.

MySQL PostgreSQL MSSQL Oracle

Cross-Site Scripting (XSS)

Reflected, stored, and DOM-based XSS. Filter bypasses, CSP evasion, and BeEF integration.

Reflected Stored DOM

Cross-Site Request Forgery

CSRF token bypass, SameSite cookie bypass, JSON CSRF, and PoC generation.

Token Bypass SameSite JSON

File Upload Attacks

Web shell uploads, extension bypasses, magic byte manipulation, and polyglot files.

PHP JSP ASP Polyglot

Server-Side Request Forgery

Internal network scanning, cloud metadata exploitation, DNS rebinding, and protocol smuggling.

AWS GCP Azure

OS Command Injection

Command separators, blind injection, filter bypasses, and reverse shells for Linux/Windows.

Linux Windows Reverse Shell

XML External Entity (XXE)

File disclosure, SSRF via XXE, blind XXE with OOB exfiltration, and SVG/DOCX injection.

File Read Blind OOB SAML

Authentication Bypass

Default credentials, SQLi login bypass, JWT attacks, 2FA bypass, and OAuth/SAML attacks.

JWT 2FA OAuth SAML

Server-Side Template Injection

Jinja2, Twig, Freemarker exploitation. Template detection, RCE payloads, and filter bypasses.

Jinja2 Twig Freemarker

Path Traversal / LFI / RFI

Directory traversal, local/remote file inclusion, PHP wrappers, and log poisoning.

LFI RFI PHP Wrappers

Insecure Deserialization

Java (ysoserial), PHP (phpggc), Python (pickle), and .NET gadget chains with exploitation.

Java PHP Python .NET

IDOR

Horizontal/vertical privilege escalation, GUID prediction, parameter tampering, and automation.

Horizontal Vertical Autorize

NoSQL Injection

MongoDB operator injection, authentication bypass, data extraction, and blind injection.

MongoDB CouchDB Redis

Open Redirect

URL validation bypasses, OAuth token theft, SSRF chains, and phishing enhancement.

OAuth SSRF Chain Phishing

Business Logic Vulnerabilities

Workflow bypass, race conditions, payment manipulation, and rate limiting bypass.

Workflow Race Conditions Payment Logic

Race Conditions

TOCTOU exploitation, limit-overrun attacks, Turbo Intruder, and single-packet techniques.

TOCTOU Limit Overrun Turbo Intruder

HTTP Request Smuggling

CL.TE, TE.CL, TE.TE desync attacks, HTTP/2 downgrade smuggling, and cache poisoning chains.

CL.TE TE.CL HTTP/2

Web Cache Poisoning

Unkeyed header injection, cache deception, Param Miner, and cache key manipulation.

Unkeyed Headers Cache Deception Param Miner

WebSocket Security

Cross-Site WebSocket Hijacking (CSWSH), message injection, and origin validation bypass.

CSWSH Message Injection Origin Bypass

JWT Attacks

Algorithm confusion, none algorithm bypass, weak secret cracking, and KID injection.

None Alg RS256→HS256 jwt_tool

OAuth/OIDC Attacks

Redirect URI manipulation, token leakage, PKCE bypass, and state parameter CSRF.

Redirect URI PKCE Bypass Token Theft

GraphQL Security

Introspection leakage, batching attacks, DoS via nested queries, and authorization bypass.

Introspection Batching DoS

Prototype Pollution

Client-side and server-side exploitation, gadget chains, PP-to-XSS, and Node.js RCE.

Client-Side Server-Side RCE

CORS Misconfiguration

Origin reflection, null origin bypass, wildcard with credentials, and regex bypass techniques.

Origin Reflection Null Origin Preflight

Security Headers

CSP bypass, HSTS stripping, clickjacking via X-Frame-Options, and missing security headers.

CSP HSTS Clickjacking

WAF Bypass

WAF detection, encoding tricks, SQLi/XSS/command injection evasion, and origin IP discovery.

Detection Encoding Evasion

Client-Side Attacks

DOM clobbering, postMessage abuse, service worker hijacking, CSS injection, and exfiltration.

DOM Clobbering postMessage CSS Exfil

HTTP/2 & HTTP/3 Attacks

H2 request smuggling, h2c smuggling, single-packet race conditions, and QUIC attack surface.

H2 Smuggling h2c QUIC

Prompt Injection / LLM Attacks

Direct and indirect prompt injection, RAG poisoning, jailbreaking, and AI data extraction.

Direct Injection RAG Poisoning Jailbreaking

SAML / SSO Attacks

Signature bypass, XML signature wrapping, assertion manipulation, and SSO relay attacks.

Signature Bypass XSW Replay

MFA Bypass Techniques

OTP brute force, response manipulation, push fatigue, token reuse, and evilginx2 phishing.

OTP Bypass Push Fatigue evilginx2

Host Header Injection

Password reset poisoning, cache poisoning via host, virtual host enumeration, and SSRF chains.

Reset Poisoning Cache Poison VHost Enum

CRLF Injection

HTTP response splitting, XSS via CRLF, session fixation, log poisoning, and encoding variants.

Response Split Log Poisoning Encoding

LDAP Injection

Authentication bypass, data extraction, blind LDAP injection, and modification attacks.

Auth Bypass Blind LDAP Enterprise

HTTP Parameter Pollution

Framework parsing differences, WAF bypass via HPP, business logic bypass, and server-side HPP.

WAF Bypass Parsing Diff Logic Bypass

Web Cache Deception

Path confusion techniques, CDN-specific testing, automated exploitation, and cache key analysis.

Path Confusion CDN Testing Cache Key

Information Disclosure

Error page analysis, verbose headers, debug endpoints, source code exposure, and directory listing.

Error Pages Debug Endpoints Git Exposure

Mass Assignment

Framework-specific attacks (Rails, Django, Laravel, Spring), nested object injection, and GraphQL mass assignment.

Rails Django GraphQL

REST API Attacks

OWASP API Top 10, BOLA/BFLA, JWT attacks, rate limiting bypass, and API versioning bugs.

BOLA BFLA API Top 10

Secrets Exposure

Hardcoded keys in JS/source maps, .env files, git mining with truffleHog/gitleaks, and regex patterns.

Git Mining Source Maps .env Files

XPath Injection

Authentication bypass, data extraction, blind XPath injection, and XML structure enumeration.

Auth Bypass Blind XPath XML Data

Credential Stuffing & Account Enumeration

Username enumeration via timing/message/size differences, Hydra/ffuf attacks, and rate limit bypass.

Enumeration Rate Limit Hydra

Vulnerable & Outdated Components

Fingerprinting with Wappalyzer/WhatWeb, dependency analysis, Retire.js, Nuclei, and CVE exploitation.

Fingerprint Nuclei SCA

Expression Language Injection

Java EL, Spring SpEL, OGNL, Jinja2, Twig, and Freemarker RCE chains with polyglot payloads.

Java EL SpEL OGNL

Email Header Injection

CRLF in email headers, CC/BCC injection, content-type injection, and password reset token theft.

CC/BCC Content-Type Reset Theft

Webhook Security

Webhook SSRF via cloud metadata, signature forgery, replay attacks, and callback manipulation.

SSRF Signature Replay

Session Fixation

Pre-auth session assignment, URL-based fixation, cookie injection, and session ID regeneration testing.

Cookie Inject URL Based Regeneration

Clickjacking

X-Frame-Options/CSP detection, PoC generation, multi-step UI redress, and frame-busting bypasses.

UI Redress Drag & Drop Cursor Hijack

PDF Generation Attacks

Local file read via HTML-to-PDF, SSRF through PDF libraries, and data exfiltration techniques.

File Read SSRF wkhtmltopdf

API Gateway / Proxy Bypass

Path normalization bypass, direct backend access, header manipulation, and method override exploits.

Path Bypass Direct Access Method Override

gRPC Security

Service discovery via reflection, authentication testing, injection in protobuf fields, and fuzzing.

Reflection Protobuf grpcurl

Serverless Function Attacks

Event injection, environment/credential exposure, IAM privilege escalation, and cold start abuse.

Event Inject Env Exposure IAM Escalation

Cryptographic Failures

TLS/SSL testing, weak password storage, data in transit/at rest analysis, and weak crypto detection.

TLS/SSL Password Hash OWASP A02

Logging & Monitoring Failures

Missing log testing, log quality assessment, monitoring/alerting gaps, and audit trail analysis.

Log Quality Monitoring OWASP A09

Quick Reference

Exploitation Methodology

Identify vulnerability type - Confirm the vulnerability exists and understand its nature
Research exploitation techniques - Use the detailed guides above for specific attack vectors
Develop/customize payloads - Adapt payloads to bypass any security controls
Demonstrate impact - Show real-world consequences (data access, RCE, etc.)
Document everything - Screenshot evidence, save payloads, note exact steps

Information

Documentation is Key: Screenshot every successful exploitation attempt, note the exact payload used, and document the impact clearly for the final report.