https://gchq.github.

io/CyberChef/ 

https://lelinhtinh.github.io/de4js/ 

https://xcat.readthedocs.io/en/latest/ 

https://github.com/detectify/page-fetch 

OXML_XXE (https://github.com/BuffaloWill/
oxml_xxe)

https://github.com/swisskyrepo/
PayloadsAllTheThings

wpscan 

https://book.hacktricks.xyz 
Cheat Sheets Tools Droopescan 

https://maxtoroq.github.io/xpath-ref/  WEB HACKING CMSmap 

https://0xsp.com/  CMSeeK 

Reconnaissance WPXF 

Content Discovery joomscan 

JoomlaVS 

Identify Web technology Drupwn 

https://github.com/wireghoul/htshells 

Wappalyzer

Common filetypes

html

php

aspx

txt

js

feroxbuster / gobuster

Review JavaScript Files

https://lelinhtinh.github.io/de4js/

Review HTML code

Spiders

gospider

Identify directory and filename patterns

Read metadata of files (PDF/Images) to

identify Author, E-mails, Software used

Subdomain Enumeration

SSL

Google Dorks

Bruteforce

gobuster dns

ffuf -H "Host: FUZZ.domain.com"

amass

HTTP VERBS

OPTIONS

GET

POST

PUT

DELETE

curl -X MOVE --header 'Destination:http://$

MOVE
ip/shell.php' 'http://$ip/shell.txt'

PATCH

INSERT (ARBITRARY VALUE) Setting arbitrary HTTP verb

might force the Web Server
HELP to disclose information.

Change Request Method

Provide parameters in GET

Change Content-Type

JSON => XML

https://codebeautify.org/xmltojson

https://www.oxygenxml.com/xml_json_
converter.html

HTTP Headers

Common Headers

X-Requested-For

X-Real-IP

X-Forwarded-Host

X-Client-IP

X-Forwarded-By

X-Remote-Addr

X-Remote-IP

X-Wap-Profile: <URL-to-XML-file>

Custom Headers

BurpCollaboratorEverywhere (SSRF)

Differrent User-Agent

Windows

Linux

Android

Custom Value (injection?)

Duplicate Host Header

Some implementations might be parsing

HTTP Headers like "User-Agent" in an
insecure manner

Command Injection

Shellshock

SSRF

BurpCollaboratorEverywhere

SQLi

Origin overwrite

HTTP Parameters

ParamMiner

HTTP Parameter Pollution

id=1&id=2

Password Reset

User Enumeration

Missing Rate Limiting

Password Reset Poisoning via Host Header

Injection

Re-usable Password Reset Token

No Expiration on Password Reset Token

Guessable Password Reset Token

IDN Homograph Attack

Weak Password Policy

Information Disclosure

Generate an error

Special characters

HTTP Parameters

Change type to array ( ?id= to ?id[]= )

Missing parameters

Parameter Pollution

Non existing page => 404

Very long session/cookies

HTML code review

JS code review

Search for ".map" files

https://lelinhtinh.github.io/de4js/

Path Traversal

NGINX

nginx.conf

location /path misconfiguration

vulnerable.site/path..%2f..%2f..%2f..%
2fetc%2fpasswd

Filter Bypass

Unicode

Codepoints: &#32;

URL Encoding: %2e%2e%2f

Web Servers

Apache

/etc/apache2/apache2.conf

/etc/apache2/envvars

/etc/apache2/sites-enabled/000-default.
conf

/var/log/apache2/error.log

NGINX

/etc/nginx/nginx.conf

/etc/nginx/locations.conf

/etc/nginx/server.conf

/etc/nginx/sites-enabled/default

NodeJS

var http = require('http');

LDAP Injection

XPATH Injection

https://xcat.readthedocs.io/en/latest/ 

https://maxtoroq.github.io/xpath-ref/ 

OS Command Injection

SQL Injection

Identify number of columns

UNION SELECT NULL, NULL, NULL, NULL; -- -

Identify columns data types and which

columns are visible

Identify Database type (MySQL,

PostgreSQL, ...) and version

sqlmap

NOSQL Injection

XML eXternal Entities (XXE)

OOB (Out of Band)

xxe.sh

OXML_XXE (https://github.com/BuffaloWill/
oxml_xxe)


OOXML (DOCX, XLSX, PPTX), ODF, PDF, RSS

File Inclusion (LFI/RFI)

Wrappers

phar://
Access archives
zlib://

file://

ogg://

expect://

glob:// File pattern matching

data://

php://

php://filter/convert.base64-encode/
resource=

Log Poisoning

Session Poisoning

Interesting Files

Race Conditions (TOCTOU)

Template Injection (SSTI)

Python

Jinja2

PHP

Twig

Server Side Request Forgery (

SSRF)

gopher:// URL Scheme

Filter Bypass

127.0.0.1.nip.io

localhost == [::]

decimal notation 127.0.0.1 == 2130706433

IPv6/IPv4 Embedding [0:0:0:0:0:ffff:127.0.0.

1]

Cloud

AWS http://169.254.169.254/latest/meta-
data

Alibaba http://100.100.100.200/latest/meta-
data/

Oracle Cloud http://192.0.0.192/latest/meta-

data/

Digital Ocean http://169.254.169.254/

metadata/v1.json

Request Smuggling

Smuggler

Insecure Deserialization

Check all user controlled input

Cookies / Sessions
The application would need to deserialize
untrusted user input
HTTP Parameters

HTTP Headers

Remote Method Invocation (RMI)

Python

Pickle

PyYAML load

Java

Magic Numbers "AC ED 00 05"

Java-Deserialization-Cheat-Sheet

ysoserial

XMLDecoder

XStream->fromXML

ObjectInputStream

ObjectInputStream->readExternal

ObjectInputStream->readResolve

ObjectInputStream->readObject

ObjectInputStream->readUnshared

Content-Type: application/x-java-serialized-
object

Ruby

unmarshal

PHP

unserialize

phpggc

Cross Site Scripting (XSS)

Same Origin Policy (SOP)

Cross Origin Resource Sharing (CORS)

Check for Request Splitting

Add CORS related HTTP Header to allow

XSS

File Upload

WebDAV

cadaver

davtest [-auth user:password] -move -

davtest
sendbd auto -url http://<IP>

curl -T file.txt http://<IP>

curl -X MOVE --header 'Destination:http://$

HTTP MOVE
ip/shell.php' 'http://$ip/shell.txt'

web.config (ASP.NET)

Make specific file extensions executable (e.

g: execute txt files)

https://soroush.secproject.com/blog/2014/
07/upload-a-web-config-file-for-fun-profit/


.htaccess (Apache)

Make specific file extensions executable (e.

g: execute txt files)

https://github.com/wireghoul/htshells 

Content-Type filter bypass

Magic Bytes filter bypass

Double Extensions filter bypass

Alternative extensions blacklist filter bypass

Prototype Pollution

https://github.com/detectify/page-fetch 

Content Management Systems (

CMS)

Wordpress

wpscan 

Droopescan 

CMSmap 

CMSeeK 

WPXF 

Joomla

joomscan 

Droopescan 

CMSmap 

CMSeeK 

JoomlaVS 

Drupal

Droopescan 

CMSmap 

Drupwn 

CMSeeK 