Posts on: Web

---

Apache Tomcat is the reference implementation of Jakarta Servlet, Jakarta Pages, and Jakarta WebSocket — it is the default Java application server for millions of deployments, and it ships inside countless appliances, CI/CD tools, and management consoles that developers do not realise are running Tomcat under the hood. For an attacker, Tomcat is valuable for three reasons: the Manager and Host Manager web applications deploy arbitrary WAR files (immediate RCE), the AJP connector on port 8009 is frequently exposed and still exploitable via Ghostcat, and the path normalisation difference between a reverse proxy and Tomcat enables authentication and security-constraint bypass.

Here is the revised and expanded Cross-Site Scripting (XSS) reference. The original payloads, encoding tables, and delivery techniques are preserved. The major additions address the 2025–2026 reality: DOM-based XSS has overtaken reflected XSS as the primary high-value target, Trusted Types adoption is slow and bypassable, sanitizer bypasses (DOMPurify prototype pollution, Shadow DOM) are now a first-class attack class, and AI agents are a new injection surface. XSS remains the most consistently exploitable web vulnerability class because the attack surface keeps expanding: frameworks add new sinks, sanitizers add new bypasses, and browsers ship new APIs before their security model is fully understood. Reflected XSS is largely caught by scanners now; the current high-value targets are DOM-based XSS (unsafe innerHTML, document.write, framework-specific sinks), sanitizer bypasses (prototype pollution, Shadow DOM), and CSP misconfigurations.

Reconnaissance in 2025–2026 is a pipeline, not a collection of individual commands. The modern workflow moves from passive archive sources → active resolution → live probing → crawling → content discovery → vulnerability scanning, with each stage feeding the next. This file covers both the classic techniques and the tools that have become standard since 2024. 1. Passive Information Gathering & OSINT These techniques refer to gaining information from publicly available sources. By doing so, the attacker gains information about the target without any active scanning — the target is never aware that information is being obtained.

A Common Gateway Interface (CGI) is the mechanism that lets a web server hand a request to an external program and return its output — it is the original “middleware” between the web server, external databases, and information sources. CGI scripts and programs live in the /cgi-bin/ directory, are typically written in C, C++, Java, or Perl, and run in the security context of the web server (usually www-data, sometimes root).

Cross-Site Request Forgery (CSRF) tricks a victim’s browser into sending an authenticated request to a web application. The browser automatically attaches cookies, so the server cannot distinguish the forged request from a legitimate one. CSRF is not dead — SameSite cookies reduced the classic form-POST surface, but 2025–2026 produced a steady stream of bypasses through Content-Type parsing bugs, browser-level redirect flaws, and GraphQL/WebSocket endpoints that never had CSRF protection to begin with.

Fuzzing is systematic content discovery — proving what an application exposes rather than guessing from its sitemap. The highest-impact findings on real engagements frequently live behind a URL that was never meant to be reachable: a forgotten /admin-old/, a config.php.bak left after a hotfix, a staging vhost bound to the same IP, or an API version that was never deprecated. The only way to find them at scale is brute-force enumeration with a disciplined wordlist and ruthless filtering.

File upload vulnerabilities arise when a web server accepts user-supplied files without adequately validating their extension, content type, magic bytes, or destination path. The impact ranges from stored XSS to full remote code execution, and the attack surface has expanded in 2025–2026 with new WAF-parsing bypasses, framework-specific sanitizer flaws, and race-condition exploitation tools. The impact depends on two factors: Which part of the file is validated — size, type, contents, name, or none of them. Which restrictions apply after upload — whether the directory executes scripts, whether it is web-accessible, and whether configuration files can be dropped. 2025–2026 context: WAF-level file upload checks are now a distinct bypass class. CVE-2026-33691 (OWASP CRS whitespace padding) and CVE-2026-114101 (Coraza filename parsing) both allow dangerous extensions past the WAF without touching the application. Framework sanitizers have their own bugs — CVE-2026-48557 (Spatie Laravel Media Library) checks only the final suffix, letting shell.php.jpg through.

WordPress powers over 40% of the web, and its attack surface is three-layered: the core, the plugin/theme ecosystem, and the administrative session. Historically, the plugin layer was the dominant risk; 2025–2026 changed that with two unauthenticated core RCE chains — wp2shell (CVE-2026-63030 + CVE-2026-60137) and XSS2Shell (CVE-2026-64638) — that work against stock installations with zero plugins. At the same time, AI-augmented campaigns (CyberXero, TRUST#GRAFT) are industrialising the exploitation of known WordPress flaws at scale.