Skip to main content

Server-side topics

SQL injection​

  • SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
  • SQL injection vulnerability allowing login bypass
  • SQL injection attack, querying the database type and version on Oracle
  • SQL injection attack, querying the database type and version on MySQL and Microsoft
  • SQL injection attack, listing the database contents on non-Oracle databases
  • SQL injection attack, listing the database contents on Oracle
  • SQL injection UNION attack, determining the number of columns returned by the query
  • SQL injection UNION attack, finding a column containing text
  • SQL injection UNION attack, retrieving data from other tables
  • SQL injection UNION attack, retrieving multiple values in a single column

Business logic vulnerabilities​

  • Excessive trust in client-side controls
  • High-level logic vulnerability
  • Inconsistent security controls
  • Flawed enforcement of business rules

Authentication vulnerabilities​

  • Username enumeration via different responses
  • 2FA simple bypass
  • Password reset broken logic
  • Username enumeration via subtly different responses

Command Injection​

  • OS command injection, simple case
  • Blind OS command injection with time delays
  • Blind OS command injection with output redirection

Path Traversal​

  • File path traversal, simple case
  • File path traversal, traversal sequences blocked with absolute path bypass
  • File path traversal, traversal sequences stripped non-recursively
  • File path traversal, traversal sequences stripped with superfluous URL-decode
  • File path traversal, validation of start of path
  • File path traversal, validation of file extension with null byte bypass

Server-side request forgery​

  • Basic SSRF against the local server
  • Basic SSRF against another back-end system
  • SSRF with blacklist-based input filter
  • Information disclosure
  • Information disclosure in error messages
  • Information disclosure on debug page
  • Source code disclosure via backup files
  • Authentication bypass via information disclosure

Access control​

  • Unprotected admin functionality
  • Unprotected admin functionality with unpredictable URL
  • User role controlled by request parameter
  • User role can be modified in user profile
  • User ID controlled by request parameter
  • User ID controlled by request parameter, with unpredictable user IDs
  • User ID controlled by request parameter with data leakage in redirect
  • User ID controlled by request parameter with password disclosure

Insecure direct object references​

  • URL-based access control can be circumvented
  • Method-based access control can be circumvented
  • Multi-step process with no access control on one step
  • Referer-based access control

XXE injection​

  • Exploiting XXE using external entities to retrieve files
  • Exploiting XXE to perform SSRF attacks