Posts on: Web-Attacks

---

Here is the revised and expanded Cross-Site Scripting (XSS) reference. The original payloads, encoding tables, and delivery techniques are preserved. The major additions address the 2025–2026 reality: DOM-based XSS has overtaken reflected XSS as the primary high-value target, Trusted Types adoption is slow and bypassable, sanitizer bypasses (DOMPurify prototype pollution, Shadow DOM) are now a first-class attack class, and AI agents are a new injection surface. XSS remains the most consistently exploitable web vulnerability class because the attack surface keeps expanding: frameworks add new sinks, sanitizers add new bypasses, and browsers ship new APIs before their security model is fully understood. Reflected XSS is largely caught by scanners now; the current high-value targets are DOM-based XSS (unsafe innerHTML, document.write, framework-specific sinks), sanitizer bypasses (prototype pollution, Shadow DOM), and CSP misconfigurations.

Cross-Site Request Forgery (CSRF) tricks a victim’s browser into sending an authenticated request to a web application. The browser automatically attaches cookies, so the server cannot distinguish the forged request from a legitimate one. CSRF is not dead — SameSite cookies reduced the classic form-POST surface, but 2025–2026 produced a steady stream of bypasses through Content-Type parsing bugs, browser-level redirect flaws, and GraphQL/WebSocket endpoints that never had CSRF protection to begin with.

File upload vulnerabilities arise when a web server accepts user-supplied files without adequately validating their extension, content type, magic bytes, or destination path. The impact ranges from stored XSS to full remote code execution, and the attack surface has expanded in 2025–2026 with new WAF-parsing bypasses, framework-specific sanitizer flaws, and race-condition exploitation tools. The impact depends on two factors: Which part of the file is validated — size, type, contents, name, or none of them. Which restrictions apply after upload — whether the directory executes scripts, whether it is web-accessible, and whether configuration files can be dropped. 2025–2026 context: WAF-level file upload checks are now a distinct bypass class. CVE-2026-33691 (OWASP CRS whitespace padding) and CVE-2026-114101 (Coraza filename parsing) both allow dangerous extensions past the WAF without touching the application. Framework sanitizers have their own bugs — CVE-2026-48557 (Spatie Laravel Media Library) checks only the final suffix, letting shell.php.jpg through.

NoSQL injection occurs when user-controlled input is interpreted as part of a NoSQL query — as an operator, a JSON structure, or a JavaScript expression — rather than as a literal value. It is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) and sits under OWASP Top 10 A05:2025 (Injection). 2025–2026 context: the class is no longer just {"$ne": null} in a login form. The current CVE feed is dominated by ORM-layer flaws (Mongoose $where nesting, CVE-2025-23061), unauthenticated multi-database operator injection (Budibase, CVE-2026-54350), Redis command injection via SSRF/Gopher, and Cassandra UDF RCE on legacy deployments. The common thread: the application has a schema or an ODM, and the library coerces a type or falls back to a code path the developer did not anticipate.

JSON Web Token (JWT) is a format for transmitting cryptographically secure data, typically used as a stateless session token. The server verifies the token’s signature and then retrieves user information from the JWT claims. A JWT has three base64url-encoded parts separated by dots: <Base64_Header>.<Base64_Payload>.<Base64_Signature> Header — metadata, including the signing alg (algorithm) and optional key identifiers (kid, jwk, jku). Payload — the claims (registered and custom). Signature — computed over the header and payload using a key, per the algorithm in the header. If any part of the header or payload is modified, the signature no longer matches — unless the server’s verification logic is flawed. That is what every attack in this file targets: not the cryptography, but the verification code path.

Here is the revised and expanded SQL Injection (SQLi) reference. Your original payloads, filter-evasion tables, SQLMap commands, and field notes are preserved. The major additions are the 2025–2026 WAF-evasion research (AST mutation, adversarial generation), NoSQL injection (MongoDB operator injection, Redis, Cassandra), ORM-level injection (Hibernate CVE-2026-0603, Sequelize), modern SQLMap tamper collections, out-of-band and error-based refinements, and current critical CVEs. SQL injection allows an attacker to interfere with the queries an application makes to its database. It can expose data belonging to other users, modify or delete data, escalate to server compromise, or cause denial of service.

Here is the revised and expanded SSRF reference. Your original tools, parameter list, and Gopher POST example are preserved; the additions cover the areas that decide whether an SSRF is a reportable finding or a full cloud compromise: cloud metadata exploitation (IMDSv1/v2), DNS rebinding, redirect-based bypasses, protocol smuggling, modern localhost bypasses, and OOB confirmation for blind SSRF. Server-Side Request Forgery (SSRF) occurs when an attacker can coerce the server into making requests to an arbitrary URL. In cloud environments, a single SSRF often pivots to full account compromise via the instance metadata service (IMDS) — which is why it is consistently one of the highest-impact bug classes.

OAuth is a standard designed to enable secure authorization between services and applications. It is widely used in Single Sign-On (SSO) scenarios, where a user can authenticate once and access multiple applications without sharing their credentials with each service. 2025–2026 context: OAuth 2.0/2.1 is now the backbone of almost every authentication system, and the vulnerability classes have moved out of the redirect_uri parameter and into the libraries that implement the flows. The current CVE feed is dominated by state-parameter persistence failures (Authlib, fastapi-sso), PKCE downgrade bypasses (Cloudflare workers-oauth-provider), OAuth email-linking account takeover (Pingvin Share, AshAuthentication), unauthenticated callback fallback (Feathers, CVSS 9.8), and dynamic client registration that accepts arbitrary redirect URIs.