Posts on: Web

---

NoSQL injection occurs when user-controlled input is interpreted as part of a NoSQL query — as an operator, a JSON structure, or a JavaScript expression — rather than as a literal value. It is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) and sits under OWASP Top 10 A05:2025 (Injection). 2025–2026 context: the class is no longer just {"$ne": null} in a login form. The current CVE feed is dominated by ORM-layer flaws (Mongoose $where nesting, CVE-2025-23061), unauthenticated multi-database operator injection (Budibase, CVE-2026-54350), Redis command injection via SSRF/Gopher, and Cassandra UDF RCE on legacy deployments. The common thread: the application has a schema or an ODM, and the library coerces a type or falls back to a code path the developer did not anticipate.

Many web applications provide a PDF generation functionality which may contain dynamic user input. Some of these generators may be vulnerable due to HTML injection, allowing several attacks. PDF Library Enumeration Determining the PDF generation library used by a web application may be pretty easy: most of them add information in the metadata of the generated file such as the library name and version. To display the metadata of a PDF file, there are multiple options:

JSON Web Token (JWT) is a format for transmitting cryptographically secure data, typically used as a stateless session token. The server verifies the token’s signature and then retrieves user information from the JWT claims. A JWT has three base64url-encoded parts separated by dots: <Base64_Header>.<Base64_Payload>.<Base64_Signature> Header — metadata, including the signing alg (algorithm) and optional key identifiers (kid, jwk, jku). Payload — the claims (registered and custom). Signature — computed over the header and payload using a key, per the algorithm in the header. If any part of the header or payload is modified, the signature no longer matches — unless the server’s verification logic is flawed. That is what every attack in this file targets: not the cryptography, but the verification code path.

Internet Information Services (IIS) for Windows Server is a flexible, secure and manageable Web server for hosting anything on the Web. From media streaming to web applications, IIS’s scalable and open architecture is ready to handle the most demanding tasks. 2025–2026 context: IIS remains a live attack surface not because of the web server itself, but because of legacy Windows filesystem features it exposes, misconfigured WebDAV, and the ASP.NET ViewState/machineKey ecosystem. The tilde (8.3 short name) disclosure is still being assigned CVEs in 2025 — CVE-2025-46294 covers FileMaker Server’s implementation, rated CVSS 5.3 (CWE-200) — and the real impact is what those short names reveal: hidden upload endpoints, backup files, and configuration files that standard directory brute-forcing never finds.

Here is the revised and expanded SQL Injection (SQLi) reference. Your original payloads, filter-evasion tables, SQLMap commands, and field notes are preserved. The major additions are the 2025–2026 WAF-evasion research (AST mutation, adversarial generation), NoSQL injection (MongoDB operator injection, Redis, Cassandra), ORM-level injection (Hibernate CVE-2026-0603, Sequelize), modern SQLMap tamper collections, out-of-band and error-based refinements, and current critical CVEs. SQL injection allows an attacker to interfere with the queries an application makes to its database. It can expose data belonging to other users, modify or delete data, escalate to server compromise, or cause denial of service.

WebDAV (Web Distributed Authoring and Versioning) is a protocol that extends the HTTP protocol, allowing users to collaboratively author and manage files on a web server, enabling actions like creating, editing, moving, and deleting files remotely. An HTTP Server with WebDav might require valid credentials to perform file operations, such as creating, deleting or editing existing files. The credentials are most probably required via HTTP Basic Authentication. Success Notice: You will need to use the HTTP PUT, DELETE and MOVE verbs to respectively upload, delete and move files. Warning Sometimes, the WebDav instance might be configured to deny any file upload using specific file extensions. If this configuration is not properly set, you might be able to subvert it by uploading the file with any other accepted extension, and then using a move (rename) operation or a copy operation.

WebSphere is a Java EE application server provided by IBM, used to deploy and manage enterprise-level Java applications. Discovery & Fuzzing Fuzz for IBM WebSphere specific endpoints using this wordlist: https://github.com/kkrypt0nn/wordlists/blob/main/wordlists/vulnerabilities/websphere.txt Fuzz for files with the following extensions: *.do *.jsp *.jsv *.jsw Missing Authorization in administrative servlets You may find some interesting administrative endpoints lacking authentication. One particular endpoint is the snoop servlet, typically located at the server’s webroot: https://example.com/snoop/

Here is the revised and expanded SSRF reference. Your original tools, parameter list, and Gopher POST example are preserved; the additions cover the areas that decide whether an SSRF is a reportable finding or a full cloud compromise: cloud metadata exploitation (IMDSv1/v2), DNS rebinding, redirect-based bypasses, protocol smuggling, modern localhost bypasses, and OOB confirmation for blind SSRF. Server-Side Request Forgery (SSRF) occurs when an attacker can coerce the server into making requests to an arbitrary URL. In cloud environments, a single SSRF often pivots to full account compromise via the instance metadata service (IMDS) — which is why it is consistently one of the highest-impact bug classes.