Web Exploits on Garrettoh's Research / Blog

Mon, 01 Jan 0001 00:00:00 +0000

CSRF (Cross-Site Request Forgery)

Basics

CSRF tricks a victim’s browser into performing an unwanted action on a different website where they are currently authenticated. Unlike XSS (which steals data), CSRF executes actions (e.g., changing a password, deleting an account).

What to look for

A useful CSRF target is a sensitive action (usually a POST request) that does not require a unique CSRF token.

The Test:

The Observation: Find a form (like “Change Email”) and look at the request in Burp.
The Check: Is there a random string like csrf_token=a83j...? If NO, it is likely vulnerable.
The Proof: If you can submit the form by only knowing the victim’s new email address, you can “force” them to submit it via a hidden form on your own site.

XSS: Steals the cookie.
CSRF: Uses the cookie (without seeing it) to perform an action.
SSRF: Makes the Server do the work.

References

Burp Suite - CSRF PoC Generator: (Pro feature, but can be done manually) Generates the HTML to trigger the attack.

Scope note

In OSCP, CSRF is usually part of a chain. It may enable an administrative change that exposes another weakness, such as a file upload. Validate the impact after the request succeeds.

Mon, 01 Jan 0001 00:00:00 +0000

SQL Injection (SQLi)

Basics

SQL Injection is a vulnerability where an application improperly handles user input, allowing an attacker to “inject” their own SQL commands into a database query. This can lead to unauthorized data access, data modification, or even full system compromise (RCE).

What to look for

The classic sign of SQLi is a Database Error or a Change in Page Content when you input a single quote (').

Mon, 01 Jan 0001 00:00:00 +0000

SSRF (Server-Side Request Forgery)

Basics

SSRF allows an attacker to induce the server-side application to make requests to an arbitrary domain. Essentially, you are using the vulnerable server as a “proxy” to attack internal systems that you cannot reach directly from the internet.

What to look for

A common SSRF entry point is a user-controlled URL parameter.

The Test:

The Observation: A feature that “fetches” content, like http://site.com/preview?url=http://google.com.
The Manipulation: Change the URL to an internal address: url=http://127.0.0.1:80 or url=http://169.254.169.254 (Cloud Metadata).
The Result: If the server returns internal data (like a local index.html or AWS keys), you have SSRF

Testing workflow

Step 1: Internal Port Scanning
- Use the server to scan itself: url=http://127.0.0.1:22, url=http://127.0.0.1:3306.
Step 2: Cloud Metadata Exfiltration
- AWS: http://169.254.169.254/latest/meta-data/iam/security-credentials/
- Azure: http://169.254.169.254/metadata/instance?api-version=2021-02-01
Step 3: Access Local Files
- Try the file:// protocol: url=file:///etc/passwd.

SSTI (Server-Side Template Injection)

Basics

SSTI occurs when an application embeds user input directly into a Template Engine (like Jinja2, Twig, or Mako) instead of passing it as data. Template engines are designed to execute code to generate dynamic HTML; if you can inject into them, you aren’t just changing text—you are running code on the server.

What to look for

A simple SSTI test is mathematical evaluation: send an expression in the template syntax and check whether the server renders its result.

Mon, 01 Jan 0001 00:00:00 +0000

XSS (Cross-Site Scripting)

Basics

XSS is an injection vulnerability where an attacker “tricks” a website into executing malicious JavaScript in a victim’s browser. The browser thinks the script came from the trusted website, so it allows the script to access cookies, session tokens, or perform actions as that user.

What to look for

Start by checking for reflection. If you type a unique string (like XSS_TEST_123) into a search bar, a URL parameter, or a profile field, and that exact string appears in the page’s HTML source, the site is likely vulnerable.

Web Exploits on Garrettoh's Research / Blog

CSRF (Cross-Site Request Forgery)

Basics

What to look for

How it differs from related issues

References

Scope note

SQL Injection (SQLi)

Basics

What to look for

SSRF (Server-Side Request Forgery)

Basics

What to look for

Testing workflow

Further reading

SSTI (Server-Side Template Injection)

Basics

What to look for

XSS (Cross-Site Scripting)

Basics

What to look for