[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-wooyun-legacy":3,"mdc--ssjkqp-key":37,"related-org-trail-of-bits-wooyun-legacy":2043,"related-repo-trail-of-bits-wooyun-legacy":2197},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":35,"mdContent":36},"wooyun-legacy","perform web vulnerability testing and audits","Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},"Code Analysis","code-analysis",{"name":24,"slug":25,"type":16},"Debugging","debugging",460,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills-curated","2026-07-17T06:04:47.62039",null,29,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":34},[],"Curated, community-vetted Claude Code plugin marketplace","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills-curated\u002Ftree\u002FHEAD\u002Fplugins\u002Fwooyun-legacy\u002Fskills\u002Fwooyun-legacy","---\nname: wooyun-legacy\ndescription: >-\n  Provides web vulnerability testing methodology distilled from 88,636\n  real-world cases from the WooYun vulnerability database (2010-2016). Use when\n  performing penetration testing, security audits, code reviews for security\n  flaws, or vulnerability research. Covers SQL injection, XSS, command\n  execution, file upload, path traversal, unauthorized access, information\n  disclosure, and business logic flaws.\nallowed-tools:\n  - Read\n  - Grep\n  - Glob\n  - Bash\n---\n\n# WooYun Vulnerability Analysis Knowledge Base\n\nMethodology and testing patterns extracted from 88,636 real-world\nvulnerability cases reported to the WooYun platform (2010-2016).\n\n---\n\n## When to Use\n\n> All testing described here must be performed only against systems you\n> have written authorization to test.\n\n- Penetration testing web applications\n- Security code review (server-side or client-side)\n- Vulnerability research against web targets you have explicit authorization to test\n- Building security test cases or checklists\n- Assessing web application attack surface\n- Reviewing remediation effectiveness\n- Training or education in authorized security testing contexts\n\n## When NOT to Use\n\n- Network infrastructure testing (firewalls, routers, switches)\n- Mobile application binary analysis\n- Malware analysis or reverse engineering\n- Compliance-only assessments (PCI-DSS, SOC2 checklists without testing)\n- Physical security assessments\n- Social engineering campaigns\n- Cloud infrastructure misconfigurations (IAM, S3 buckets) — these\n  require cloud-specific tooling, not web vuln patterns\n\n## Rationalizations to Reject\n\nThese shortcuts lead to missed findings. Reject them:\n\n- \"The WAF will catch it\" — WAFs are bypass-able; test the application\n  logic, not the middleware\n- \"It's an internal app, so auth doesn't matter\" — internal apps get\n  compromised via SSRF, lateral movement, and credential reuse\n- \"We already use parameterized queries everywhere\" — check for ORM\n  misuse, stored procedures with dynamic SQL, and second-order injection\n- \"The framework handles XSS\" — template engines have raw output modes,\n  JavaScript contexts bypass HTML encoding, and DOM XSS lives\n  entirely client-side\n- \"File uploads are safe because we check the extension\" — extension\n  checks are bypassed via null bytes, double extensions, parser\n  discrepancies, and race conditions\n- \"We validate on the frontend\" — client-side validation is a UX\n  feature, not a security control\n- \"Nobody would guess that URL\" — security through obscurity fails\n  against directory bruteforcing, referrer leaks, and JS source analysis\n- \"Low severity, not worth reporting\" — low-severity findings chain\n  into critical attack paths\n\n---\n\n## Core Mental Model\n\n```\nVulnerability = Expected Behavior - Actual Behavior\n             = Developer Assumptions + Attacker Input -> Unexpected State\n\nAnalysis chain:\n1. Where does data come from?  (Input sources)\n   -> GET\u002FPOST\u002FCookie\u002FHeader\u002FFile\u002FWebSocket\n2. Where does data flow?       (Data path)\n   -> Validation -> Processing -> Storage -> Output\n3. Where is data trusted?      (Trust boundaries)\n   -> Client \u002F Server \u002F Database \u002F OS \u002F External service\n4. How is data processed?      (Processing logic)\n   -> Filter \u002F Escape \u002F Validate \u002F Execute\n5. Where does data end up?     (Output sinks)\n   -> HTML \u002F SQL \u002F Shell \u002F Filesystem \u002F Log \u002F Email\n```\n\n---\n\n## Attack Surface Mapping\n\n```\n              +-------------------------------------------+\n              |         Application Attack Surface         |\n              +-------------------------------------------+\n                                  |\n          +-----------------------+-----------------------+\n          |                       |                       |\n     +----v----+            +-----v-----+           +-----v-----+\n     |  Input  |            | Processing|           |  Output   |\n     +---------+            +-----------+           +-----------+\n     | GET     |            | Input     |           | HTML page |\n     | POST    |    ->      | validation|    ->     | JSON resp |\n     | Cookie  |            | Biz logic |           | File DL   |\n     | Headers |            | DB query  |           | Error msg |\n     | File    |            | File op   |           | Log entry |\n     | Upload  |            | Sys call  |           | Email     |\n     +---------+            +-----------+           +-----------+\n```\n\n---\n\n## SQL Injection\n\n**Cases:** 27,732 | **Reference:** [sql-injection.md]({baseDir}\u002Freferences\u002Fsql-injection.md)\n| **Checklist:** [sql-injection-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fsql-injection-checklist.md)\n\nHigh-risk parameters: `id`, `sort_id`, `username`, `password`, `search`,\n`keyword`, `page`, `order`, `cat_id`\n\nInjection point detection:\n- String terminators: `'  \"  )  ')  \")  --  #  \u002F*`\n- DB fingerprint: `@@version` (MSSQL), `version()` (MySQL),\n  `v$version` (Oracle)\n\nBypass techniques:\n- Whitespace: `\u002F**\u002F  %09  %0a  ()`\n- Keywords: `SeLeCt  sel%00ect  \u002F*!select*\u002F`\n- Equals: `LIKE  REGEXP  BETWEEN  IN`\n- Quotes: `0x` hex, `char()`, `concat()`\n\nCore defense: parameterized queries (PreparedStatement \u002F ORM binding).\n\n---\n\n## Cross-Site Scripting (XSS)\n\n**Cases:** 7,532 | **Reference:** [xss.md]({baseDir}\u002Freferences\u002Fxss.md)\n| **Checklist:** [xss-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fxss-checklist.md)\n\nOutput points: user profile fields (nickname, bio), search reflections,\nfile metadata (filename, alt text), email content (subject, body)\n\nBypass techniques:\n- Tag mutation: `\u003CScRiPt>  \u003Cscript\u002Fx>  \u003Cscript\\n>`\n- Event handlers: `onerror  onload  onmouseover  onfocus`\n- Encoding: HTML entities, JS Unicode, URL encoding\n- Protocol handlers: `javascript:  data:  vbscript:`\n\nCore defense: context-aware output encoding + Content Security Policy.\n\n---\n\n## Command Execution\n\n**Cases:** 6,826 | **Reference:** [command-execution.md]({baseDir}\u002Freferences\u002Fcommand-execution.md)\n| **Checklist:** [command-execution-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fcommand-execution-checklist.md)\n\nEntry points: system command wrappers (ping, traceroute, nslookup),\nfile operations (compress, decompress, image processing), code eval\n(`eval`, `assert`, `preg_replace(\u002Fe)`), framework vulnerabilities\n(Struts2, WebLogic, JBoss)\n\nCommand chaining:\n- Linux: `;  |  ||  &&  \\`  $()`\n- Windows: `&  |  ||  &&`\n\nBypass techniques:\n- Whitespace: `${IFS}  $IFS$9  %09  \u003C  \u003C>`\n- Keywords: `ca\\t  ca''t  c$@at  \u002F???\u002F??t`\n- Encoding: `$(printf \"\\x63\\x61\\x74\")`,\n  `` `echo Y2F0|base64 -d` ``\n\nCore defense: avoid shell invocation; use `execFile` over `exec`,\nallowlist acceptable inputs.\n\n---\n\n## File Upload\n\n**Cases:** 2,711 | **Reference:** [file-upload.md]({baseDir}\u002Freferences\u002Ffile-upload.md)\n| **Checklist:** [file-upload-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Ffile-upload-checklist.md)\n\nBypass detection:\n- Client-side validation: modify JS or send request directly\n- Content-Type: `image\u002Fgif` header + PHP code body\n- Extension: `.php5  .phtml  .pht  .php.  .php::$DATA`\n- Content inspection: `GIF89a` + `\u003C?php` or image-based webshell\n- Parser discrepancy: `\u002Fupload\u002F1.asp;.jpg` (IIS 6.0)\n\nParser-specific vulnerabilities:\n- IIS 6.0: `\u002Ftest.asp\u002F1.jpg`, `test.asp;.jpg`\n- Apache: `.php.xxx` (unknown extension fallback)\n- Nginx: `\u002F1.jpg\u002F1.php` (`cgi.fix_pathinfo`)\n- Tomcat: `test.jsp%00.jpg`\n\nCore defense: allowlist extensions, rename uploads, store outside\nwebroot, validate content type server-side.\n\n---\n\n## Path Traversal\n\n**Cases:** 2,854 | **Reference:** [path-traversal.md]({baseDir}\u002Freferences\u002Fpath-traversal.md)\n| **Checklist:** [path-traversal-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fpath-traversal-checklist.md)\n\nHigh-risk parameters: `file`, `path`, `filename`, `url`, `dir`,\n`template`, `page`, `include`, `download`\n\nTraversal payloads:\n- Basic: `..\u002F..\u002F..\u002Fetc\u002Fpasswd`\n- Encoded: `%2e%2e%2f`, `..%252f`, `%c0%ae%c0%ae\u002F`\n- Null byte: `..\u002F..\u002F..\u002Fetc\u002Fpasswd%00.jpg`\n- Windows: `..\\..\\..\\windows\\win.ini`\n\nTarget files (Linux): `\u002Fetc\u002Fpasswd`, `\u002Fetc\u002Fshadow`,\n`\u002Fproc\u002Fself\u002Fenviron`, `\u002Fvar\u002Flog\u002Fapache2\u002Faccess.log`\n\nCore defense: resolve canonical paths, validate against allowlisted\ndirectories, never use user input in file paths directly.\n\n---\n\n## Unauthorized Access\n\n**Cases:** 14,377 | **Reference:** [unauthorized-access.md]({baseDir}\u002Freferences\u002Funauthorized-access.md)\n| **Checklist:** [unauthorized-access-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Funauthorized-access-checklist.md)\n\nAccess types:\n- Admin panel exposure: `\u002Fadmin`, `\u002Fmanager`, `\u002Fconsole`\n- API without authentication: missing token validation, predictable\n  tokens\n- Exposed services: Redis (6379), MongoDB (27017),\n  Elasticsearch (9200), Memcached (11211), Docker (2375)\n- IDOR: horizontal privilege escalation via ID enumeration\n\nCore defense: authentication + authorization on every endpoint,\nsession management, principle of least privilege.\n\n---\n\n## Information Disclosure\n\n**Cases:** 7,337 | **Reference:** [info-disclosure.md]({baseDir}\u002Freferences\u002Finfo-disclosure.md)\n| **Checklist:** [info-disclosure-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Finfo-disclosure-checklist.md)\n\nDisclosure sources: error messages with stack traces, exposed `.git`\nor `.svn` directories, backup files (`.bak`, `.sql`, `.tar.gz`),\nconfiguration files, debug endpoints, directory listings\n\nCore defense: custom error pages, disable directory listing, remove\ndebug endpoints in production, audit publicly accessible files.\n\n---\n\n## Business Logic Flaws\n\n**Cases:** 8,292 | **Reference:** [logic-flaws.md]({baseDir}\u002Freferences\u002Flogic-flaws.md)\n| **Checklist:** [logic-flaws-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Flogic-flaws-checklist.md)\n\nVulnerability patterns:\n- Password reset: verification code in response body, step skipping,\n  controllable reset tokens\n- Authorization bypass: horizontal (ID enumeration), vertical (role\n  escalation)\n- Payment logic: amount tampering, quantity manipulation, coupon\n  stacking\n- CAPTCHA: not refreshed, reusable, brute-forceable, client-side only\n\nTesting approach:\n1. Map the business flow -> draw state transition diagram\n2. Identify critical checks -> which parameters determine outcomes\n3. Attempt bypass -> modify parameters \u002F skip steps \u002F replay \u002F race\n4. Verify impact -> prove the scope of harm\n\nCore defense: server-side validation of all business-critical logic.\n\n---\n\n## Additional Categories\n\nThese categories are derived from case data without full reference\ndocuments. Each has a testing checklist extracted from real cases.\n\n| Category | Checklist |\n|----------|-----------|\n| CSRF | [csrf-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fcsrf-checklist.md) |\n| SSRF | [ssrf-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fssrf-checklist.md) |\n| Weak Passwords | [weak-password-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fweak-password-checklist.md) |\n| Misconfiguration | [misconfig-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fmisconfig-checklist.md) |\n| Remote Code Execution | [rce-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Frce-checklist.md) |\n| XML External Entity (XXE) | [xxe-checklist.md]({baseDir}\u002Freferences\u002Fchecklists\u002Fxxe-checklist.md) |\n\n> **Note:** The RCE checklist covers deserialization, OGNL injection, and\n> framework-specific remote code execution — distinct from the OS command\n> injection focus of the Command Execution reference above.\n\n---\n\n## Methodology Case Studies\n\nReal-world penetration testing methodology examples (anonymized):\n\n| Case Study | Description |\n|------------|-------------|\n| [bank-penetration.md]({baseDir}\u002Freferences\u002Fbank-penetration.md) | Multi-stage attack chain against a financial institution |\n| [telecom-penetration.md]({baseDir}\u002Freferences\u002Ftelecom-penetration.md) | Infrastructure penetration of a telecom carrier |\n\nThese demonstrate how individual vulnerabilities chain together into\nfull compromise scenarios.\n\n---\n\n## Testing Priority Framework\n\n### High Priority (test first)\n\n1. **SQL Injection** — direct data access, highest case count (27,732)\n2. **Command Execution** — OS-level compromise\n3. **File Upload** — arbitrary code execution via webshell\n\n### Medium Priority\n\n4. **Unauthorized Access** — second-highest case count (14,377)\n5. **Business Logic Flaws** — application-specific, hard to automate\n6. **XSS** — session hijacking, phishing\n\n### Lower Priority (but still important)\n\n7. **Path Traversal** — file read, sometimes write\n8. **Information Disclosure** — reconnaissance value, enables chaining\n9. **CSRF\u002FSSRF\u002FXXE** — context-dependent severity\n\n---\n\n## Defense Quick Reference\n\n| Vulnerability | Core Defense | Implementation |\n|---------------|-------------|----------------|\n| SQL Injection | Parameterized queries | PreparedStatement \u002F ORM |\n| XSS | Output encoding | Context-aware escaping + CSP |\n| Command Execution | Avoid shell | `execFile` not `exec`, allowlist |\n| File Upload | Strict validation | Allowlist ext, rename, isolate |\n| Path Traversal | Canonical paths | Resolve + validate against allowlist |\n| Unauthorized Access | Access control | AuthN + AuthZ + session mgmt |\n| Logic Flaws | Server-side checks | Validate all business logic server-side |\n| Info Disclosure | Minimize exposure | Custom errors, no debug in prod |\n\n---\n\n## Key Insight\n\nAll 88,636 vulnerabilities in this database share a common root cause:\nthe gap between what developers assumed and what attackers actually\nprovided. Effective security testing means systematically challenging\nevery assumption at every trust boundary.\n\nFour principles from the data:\n1. **Boundary thinking** — all vulnerabilities occur at trust boundaries\n2. **Data flow tracing** — follow data from input to output completely\n3. **Assumption challenging** — question every \"obvious\" validation\n4. **Chain composition** — individual low-severity findings combine\n   into critical attack paths\n",{"data":38,"body":44},{"name":4,"description":6,"allowed-tools":39},[40,41,42,43],"Read","Grep","Glob","Bash",{"type":45,"children":46},"root",[47,56,62,66,73,82,122,128,166,172,177,220,223,229,242,245,251,260,263,269,308,377,382,425,430,492,497,500,506,538,543,547,588,593,596,602,634,661,666,693,697,738,759,762,768,800,805,871,876,942,947,950,956,988,1053,1058,1118,1150,1155,1158,1164,1196,1201,1244,1249,1252,1258,1290,1333,1338,1341,1347,1379,1384,1407,1412,1436,1441,1444,1450,1455,1585,1598,1601,1607,1612,1668,1673,1676,1682,1689,1719,1725,1757,1763,1795,1798,1804,1981,1984,1990,1995,2000],{"type":48,"tag":49,"props":50,"children":52},"element","h1",{"id":51},"wooyun-vulnerability-analysis-knowledge-base",[53],{"type":54,"value":55},"text","WooYun Vulnerability Analysis Knowledge Base",{"type":48,"tag":57,"props":58,"children":59},"p",{},[60],{"type":54,"value":61},"Methodology and testing patterns extracted from 88,636 real-world\nvulnerability cases reported to the WooYun platform (2010-2016).",{"type":48,"tag":63,"props":64,"children":65},"hr",{},[],{"type":48,"tag":67,"props":68,"children":70},"h2",{"id":69},"when-to-use",[71],{"type":54,"value":72},"When to Use",{"type":48,"tag":74,"props":75,"children":76},"blockquote",{},[77],{"type":48,"tag":57,"props":78,"children":79},{},[80],{"type":54,"value":81},"All testing described here must be performed only against systems you\nhave written authorization to test.",{"type":48,"tag":83,"props":84,"children":85},"ul",{},[86,92,97,102,107,112,117],{"type":48,"tag":87,"props":88,"children":89},"li",{},[90],{"type":54,"value":91},"Penetration testing web applications",{"type":48,"tag":87,"props":93,"children":94},{},[95],{"type":54,"value":96},"Security code review (server-side or client-side)",{"type":48,"tag":87,"props":98,"children":99},{},[100],{"type":54,"value":101},"Vulnerability research against web targets you have explicit authorization to test",{"type":48,"tag":87,"props":103,"children":104},{},[105],{"type":54,"value":106},"Building security test cases or checklists",{"type":48,"tag":87,"props":108,"children":109},{},[110],{"type":54,"value":111},"Assessing web application attack surface",{"type":48,"tag":87,"props":113,"children":114},{},[115],{"type":54,"value":116},"Reviewing remediation effectiveness",{"type":48,"tag":87,"props":118,"children":119},{},[120],{"type":54,"value":121},"Training or education in authorized security testing contexts",{"type":48,"tag":67,"props":123,"children":125},{"id":124},"when-not-to-use",[126],{"type":54,"value":127},"When NOT to Use",{"type":48,"tag":83,"props":129,"children":130},{},[131,136,141,146,151,156,161],{"type":48,"tag":87,"props":132,"children":133},{},[134],{"type":54,"value":135},"Network infrastructure testing (firewalls, routers, switches)",{"type":48,"tag":87,"props":137,"children":138},{},[139],{"type":54,"value":140},"Mobile application binary analysis",{"type":48,"tag":87,"props":142,"children":143},{},[144],{"type":54,"value":145},"Malware analysis or reverse engineering",{"type":48,"tag":87,"props":147,"children":148},{},[149],{"type":54,"value":150},"Compliance-only assessments (PCI-DSS, SOC2 checklists without testing)",{"type":48,"tag":87,"props":152,"children":153},{},[154],{"type":54,"value":155},"Physical security assessments",{"type":48,"tag":87,"props":157,"children":158},{},[159],{"type":54,"value":160},"Social engineering campaigns",{"type":48,"tag":87,"props":162,"children":163},{},[164],{"type":54,"value":165},"Cloud infrastructure misconfigurations (IAM, S3 buckets) — these\nrequire cloud-specific tooling, not web vuln patterns",{"type":48,"tag":67,"props":167,"children":169},{"id":168},"rationalizations-to-reject",[170],{"type":54,"value":171},"Rationalizations to Reject",{"type":48,"tag":57,"props":173,"children":174},{},[175],{"type":54,"value":176},"These shortcuts lead to missed findings. Reject them:",{"type":48,"tag":83,"props":178,"children":179},{},[180,185,190,195,200,205,210,215],{"type":48,"tag":87,"props":181,"children":182},{},[183],{"type":54,"value":184},"\"The WAF will catch it\" — WAFs are bypass-able; test the application\nlogic, not the middleware",{"type":48,"tag":87,"props":186,"children":187},{},[188],{"type":54,"value":189},"\"It's an internal app, so auth doesn't matter\" — internal apps get\ncompromised via SSRF, lateral movement, and credential reuse",{"type":48,"tag":87,"props":191,"children":192},{},[193],{"type":54,"value":194},"\"We already use parameterized queries everywhere\" — check for ORM\nmisuse, stored procedures with dynamic SQL, and second-order injection",{"type":48,"tag":87,"props":196,"children":197},{},[198],{"type":54,"value":199},"\"The framework handles XSS\" — template engines have raw output modes,\nJavaScript contexts bypass HTML encoding, and DOM XSS lives\nentirely client-side",{"type":48,"tag":87,"props":201,"children":202},{},[203],{"type":54,"value":204},"\"File uploads are safe because we check the extension\" — extension\nchecks are bypassed via null bytes, double extensions, parser\ndiscrepancies, and race conditions",{"type":48,"tag":87,"props":206,"children":207},{},[208],{"type":54,"value":209},"\"We validate on the frontend\" — client-side validation is a UX\nfeature, not a security control",{"type":48,"tag":87,"props":211,"children":212},{},[213],{"type":54,"value":214},"\"Nobody would guess that URL\" — security through obscurity fails\nagainst directory bruteforcing, referrer leaks, and JS source analysis",{"type":48,"tag":87,"props":216,"children":217},{},[218],{"type":54,"value":219},"\"Low severity, not worth reporting\" — low-severity findings chain\ninto critical attack paths",{"type":48,"tag":63,"props":221,"children":222},{},[],{"type":48,"tag":67,"props":224,"children":226},{"id":225},"core-mental-model",[227],{"type":54,"value":228},"Core Mental Model",{"type":48,"tag":230,"props":231,"children":235},"pre",{"className":232,"code":234,"language":54},[233],"language-text","Vulnerability = Expected Behavior - Actual Behavior\n             = Developer Assumptions + Attacker Input -> Unexpected State\n\nAnalysis chain:\n1. Where does data come from?  (Input sources)\n   -> GET\u002FPOST\u002FCookie\u002FHeader\u002FFile\u002FWebSocket\n2. Where does data flow?       (Data path)\n   -> Validation -> Processing -> Storage -> Output\n3. Where is data trusted?      (Trust boundaries)\n   -> Client \u002F Server \u002F Database \u002F OS \u002F External service\n4. How is data processed?      (Processing logic)\n   -> Filter \u002F Escape \u002F Validate \u002F Execute\n5. Where does data end up?     (Output sinks)\n   -> HTML \u002F SQL \u002F Shell \u002F Filesystem \u002F Log \u002F Email\n",[236],{"type":48,"tag":237,"props":238,"children":240},"code",{"__ignoreMap":239},"",[241],{"type":54,"value":234},{"type":48,"tag":63,"props":243,"children":244},{},[],{"type":48,"tag":67,"props":246,"children":248},{"id":247},"attack-surface-mapping",[249],{"type":54,"value":250},"Attack Surface Mapping",{"type":48,"tag":230,"props":252,"children":255},{"className":253,"code":254,"language":54},[233],"              +-------------------------------------------+\n              |         Application Attack Surface         |\n              +-------------------------------------------+\n                                  |\n          +-----------------------+-----------------------+\n          |                       |                       |\n     +----v----+            +-----v-----+           +-----v-----+\n     |  Input  |            | Processing|           |  Output   |\n     +---------+            +-----------+           +-----------+\n     | GET     |            | Input     |           | HTML page |\n     | POST    |    ->      | validation|    ->     | JSON resp |\n     | Cookie  |            | Biz logic |           | File DL   |\n     | Headers |            | DB query  |           | Error msg |\n     | File    |            | File op   |           | Log entry |\n     | Upload  |            | Sys call  |           | Email     |\n     +---------+            +-----------+           +-----------+\n",[256],{"type":48,"tag":237,"props":257,"children":258},{"__ignoreMap":239},[259],{"type":54,"value":254},{"type":48,"tag":63,"props":261,"children":262},{},[],{"type":48,"tag":67,"props":264,"children":266},{"id":265},"sql-injection",[267],{"type":54,"value":268},"SQL Injection",{"type":48,"tag":57,"props":270,"children":271},{},[272,278,280,285,287,294,296,301,302],{"type":48,"tag":273,"props":274,"children":275},"strong",{},[276],{"type":54,"value":277},"Cases:",{"type":54,"value":279}," 27,732 | ",{"type":48,"tag":273,"props":281,"children":282},{},[283],{"type":54,"value":284},"Reference:",{"type":54,"value":286}," ",{"type":48,"tag":288,"props":289,"children":291},"a",{"href":290},"%7BbaseDir%7D\u002Freferences\u002Fsql-injection.md",[292],{"type":54,"value":293},"sql-injection.md",{"type":54,"value":295},"\n| ",{"type":48,"tag":273,"props":297,"children":298},{},[299],{"type":54,"value":300},"Checklist:",{"type":54,"value":286},{"type":48,"tag":288,"props":303,"children":305},{"href":304},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fsql-injection-checklist.md",[306],{"type":54,"value":307},"sql-injection-checklist.md",{"type":48,"tag":57,"props":309,"children":310},{},[311,313,319,321,327,328,334,335,341,342,348,350,356,357,363,364,370,371],{"type":54,"value":312},"High-risk parameters: ",{"type":48,"tag":237,"props":314,"children":316},{"className":315},[],[317],{"type":54,"value":318},"id",{"type":54,"value":320},", ",{"type":48,"tag":237,"props":322,"children":324},{"className":323},[],[325],{"type":54,"value":326},"sort_id",{"type":54,"value":320},{"type":48,"tag":237,"props":329,"children":331},{"className":330},[],[332],{"type":54,"value":333},"username",{"type":54,"value":320},{"type":48,"tag":237,"props":336,"children":338},{"className":337},[],[339],{"type":54,"value":340},"password",{"type":54,"value":320},{"type":48,"tag":237,"props":343,"children":345},{"className":344},[],[346],{"type":54,"value":347},"search",{"type":54,"value":349},",\n",{"type":48,"tag":237,"props":351,"children":353},{"className":352},[],[354],{"type":54,"value":355},"keyword",{"type":54,"value":320},{"type":48,"tag":237,"props":358,"children":360},{"className":359},[],[361],{"type":54,"value":362},"page",{"type":54,"value":320},{"type":48,"tag":237,"props":365,"children":367},{"className":366},[],[368],{"type":54,"value":369},"order",{"type":54,"value":320},{"type":48,"tag":237,"props":372,"children":374},{"className":373},[],[375],{"type":54,"value":376},"cat_id",{"type":48,"tag":57,"props":378,"children":379},{},[380],{"type":54,"value":381},"Injection point detection:",{"type":48,"tag":83,"props":383,"children":384},{},[385,396],{"type":48,"tag":87,"props":386,"children":387},{},[388,390],{"type":54,"value":389},"String terminators: ",{"type":48,"tag":237,"props":391,"children":393},{"className":392},[],[394],{"type":54,"value":395},"'  \"  )  ')  \")  --  #  \u002F*",{"type":48,"tag":87,"props":397,"children":398},{},[399,401,407,409,415,417,423],{"type":54,"value":400},"DB fingerprint: ",{"type":48,"tag":237,"props":402,"children":404},{"className":403},[],[405],{"type":54,"value":406},"@@version",{"type":54,"value":408}," (MSSQL), ",{"type":48,"tag":237,"props":410,"children":412},{"className":411},[],[413],{"type":54,"value":414},"version()",{"type":54,"value":416}," (MySQL),\n",{"type":48,"tag":237,"props":418,"children":420},{"className":419},[],[421],{"type":54,"value":422},"v$version",{"type":54,"value":424}," (Oracle)",{"type":48,"tag":57,"props":426,"children":427},{},[428],{"type":54,"value":429},"Bypass techniques:",{"type":48,"tag":83,"props":431,"children":432},{},[433,444,455,466],{"type":48,"tag":87,"props":434,"children":435},{},[436,438],{"type":54,"value":437},"Whitespace: ",{"type":48,"tag":237,"props":439,"children":441},{"className":440},[],[442],{"type":54,"value":443},"\u002F**\u002F  %09  %0a  ()",{"type":48,"tag":87,"props":445,"children":446},{},[447,449],{"type":54,"value":448},"Keywords: ",{"type":48,"tag":237,"props":450,"children":452},{"className":451},[],[453],{"type":54,"value":454},"SeLeCt  sel%00ect  \u002F*!select*\u002F",{"type":48,"tag":87,"props":456,"children":457},{},[458,460],{"type":54,"value":459},"Equals: ",{"type":48,"tag":237,"props":461,"children":463},{"className":462},[],[464],{"type":54,"value":465},"LIKE  REGEXP  BETWEEN  IN",{"type":48,"tag":87,"props":467,"children":468},{},[469,471,477,479,485,486],{"type":54,"value":470},"Quotes: ",{"type":48,"tag":237,"props":472,"children":474},{"className":473},[],[475],{"type":54,"value":476},"0x",{"type":54,"value":478}," hex, ",{"type":48,"tag":237,"props":480,"children":482},{"className":481},[],[483],{"type":54,"value":484},"char()",{"type":54,"value":320},{"type":48,"tag":237,"props":487,"children":489},{"className":488},[],[490],{"type":54,"value":491},"concat()",{"type":48,"tag":57,"props":493,"children":494},{},[495],{"type":54,"value":496},"Core defense: parameterized queries (PreparedStatement \u002F ORM binding).",{"type":48,"tag":63,"props":498,"children":499},{},[],{"type":48,"tag":67,"props":501,"children":503},{"id":502},"cross-site-scripting-xss",[504],{"type":54,"value":505},"Cross-Site Scripting (XSS)",{"type":48,"tag":57,"props":507,"children":508},{},[509,513,515,519,520,526,527,531,532],{"type":48,"tag":273,"props":510,"children":511},{},[512],{"type":54,"value":277},{"type":54,"value":514}," 7,532 | ",{"type":48,"tag":273,"props":516,"children":517},{},[518],{"type":54,"value":284},{"type":54,"value":286},{"type":48,"tag":288,"props":521,"children":523},{"href":522},"%7BbaseDir%7D\u002Freferences\u002Fxss.md",[524],{"type":54,"value":525},"xss.md",{"type":54,"value":295},{"type":48,"tag":273,"props":528,"children":529},{},[530],{"type":54,"value":300},{"type":54,"value":286},{"type":48,"tag":288,"props":533,"children":535},{"href":534},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fxss-checklist.md",[536],{"type":54,"value":537},"xss-checklist.md",{"type":48,"tag":57,"props":539,"children":540},{},[541],{"type":54,"value":542},"Output points: user profile fields (nickname, bio), search reflections,\nfile metadata (filename, alt text), email content (subject, body)",{"type":48,"tag":57,"props":544,"children":545},{},[546],{"type":54,"value":429},{"type":48,"tag":83,"props":548,"children":549},{},[550,561,572,577],{"type":48,"tag":87,"props":551,"children":552},{},[553,555],{"type":54,"value":554},"Tag mutation: ",{"type":48,"tag":237,"props":556,"children":558},{"className":557},[],[559],{"type":54,"value":560},"\u003CScRiPt>  \u003Cscript\u002Fx>  \u003Cscript\\n>",{"type":48,"tag":87,"props":562,"children":563},{},[564,566],{"type":54,"value":565},"Event handlers: ",{"type":48,"tag":237,"props":567,"children":569},{"className":568},[],[570],{"type":54,"value":571},"onerror  onload  onmouseover  onfocus",{"type":48,"tag":87,"props":573,"children":574},{},[575],{"type":54,"value":576},"Encoding: HTML entities, JS Unicode, URL encoding",{"type":48,"tag":87,"props":578,"children":579},{},[580,582],{"type":54,"value":581},"Protocol handlers: ",{"type":48,"tag":237,"props":583,"children":585},{"className":584},[],[586],{"type":54,"value":587},"javascript:  data:  vbscript:",{"type":48,"tag":57,"props":589,"children":590},{},[591],{"type":54,"value":592},"Core defense: context-aware output encoding + Content Security Policy.",{"type":48,"tag":63,"props":594,"children":595},{},[],{"type":48,"tag":67,"props":597,"children":599},{"id":598},"command-execution",[600],{"type":54,"value":601},"Command Execution",{"type":48,"tag":57,"props":603,"children":604},{},[605,609,611,615,616,622,623,627,628],{"type":48,"tag":273,"props":606,"children":607},{},[608],{"type":54,"value":277},{"type":54,"value":610}," 6,826 | ",{"type":48,"tag":273,"props":612,"children":613},{},[614],{"type":54,"value":284},{"type":54,"value":286},{"type":48,"tag":288,"props":617,"children":619},{"href":618},"%7BbaseDir%7D\u002Freferences\u002Fcommand-execution.md",[620],{"type":54,"value":621},"command-execution.md",{"type":54,"value":295},{"type":48,"tag":273,"props":624,"children":625},{},[626],{"type":54,"value":300},{"type":54,"value":286},{"type":48,"tag":288,"props":629,"children":631},{"href":630},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fcommand-execution-checklist.md",[632],{"type":54,"value":633},"command-execution-checklist.md",{"type":48,"tag":57,"props":635,"children":636},{},[637,639,645,646,652,653,659],{"type":54,"value":638},"Entry points: system command wrappers (ping, traceroute, nslookup),\nfile operations (compress, decompress, image processing), code eval\n(",{"type":48,"tag":237,"props":640,"children":642},{"className":641},[],[643],{"type":54,"value":644},"eval",{"type":54,"value":320},{"type":48,"tag":237,"props":647,"children":649},{"className":648},[],[650],{"type":54,"value":651},"assert",{"type":54,"value":320},{"type":48,"tag":237,"props":654,"children":656},{"className":655},[],[657],{"type":54,"value":658},"preg_replace(\u002Fe)",{"type":54,"value":660},"), framework vulnerabilities\n(Struts2, WebLogic, JBoss)",{"type":48,"tag":57,"props":662,"children":663},{},[664],{"type":54,"value":665},"Command chaining:",{"type":48,"tag":83,"props":667,"children":668},{},[669,682],{"type":48,"tag":87,"props":670,"children":671},{},[672,674,680],{"type":54,"value":673},"Linux: ",{"type":48,"tag":237,"props":675,"children":677},{"className":676},[],[678],{"type":54,"value":679},";  |  ||  &&  \\",{"type":54,"value":681},"  $()`",{"type":48,"tag":87,"props":683,"children":684},{},[685,687],{"type":54,"value":686},"Windows: ",{"type":48,"tag":237,"props":688,"children":690},{"className":689},[],[691],{"type":54,"value":692},"&  |  ||  &&",{"type":48,"tag":57,"props":694,"children":695},{},[696],{"type":54,"value":429},{"type":48,"tag":83,"props":698,"children":699},{},[700,710,720],{"type":48,"tag":87,"props":701,"children":702},{},[703,704],{"type":54,"value":437},{"type":48,"tag":237,"props":705,"children":707},{"className":706},[],[708],{"type":54,"value":709},"${IFS}  $IFS$9  %09  \u003C  \u003C>",{"type":48,"tag":87,"props":711,"children":712},{},[713,714],{"type":54,"value":448},{"type":48,"tag":237,"props":715,"children":717},{"className":716},[],[718],{"type":54,"value":719},"ca\\t  ca''t  c$@at  \u002F???\u002F??t",{"type":48,"tag":87,"props":721,"children":722},{},[723,725,731,732],{"type":54,"value":724},"Encoding: ",{"type":48,"tag":237,"props":726,"children":728},{"className":727},[],[729],{"type":54,"value":730},"$(printf \"\\x63\\x61\\x74\")",{"type":54,"value":349},{"type":48,"tag":237,"props":733,"children":735},{"className":734},[],[736],{"type":54,"value":737},"`echo Y2F0|base64 -d`",{"type":48,"tag":57,"props":739,"children":740},{},[741,743,749,751,757],{"type":54,"value":742},"Core defense: avoid shell invocation; use ",{"type":48,"tag":237,"props":744,"children":746},{"className":745},[],[747],{"type":54,"value":748},"execFile",{"type":54,"value":750}," over ",{"type":48,"tag":237,"props":752,"children":754},{"className":753},[],[755],{"type":54,"value":756},"exec",{"type":54,"value":758},",\nallowlist acceptable inputs.",{"type":48,"tag":63,"props":760,"children":761},{},[],{"type":48,"tag":67,"props":763,"children":765},{"id":764},"file-upload",[766],{"type":54,"value":767},"File Upload",{"type":48,"tag":57,"props":769,"children":770},{},[771,775,777,781,782,788,789,793,794],{"type":48,"tag":273,"props":772,"children":773},{},[774],{"type":54,"value":277},{"type":54,"value":776}," 2,711 | ",{"type":48,"tag":273,"props":778,"children":779},{},[780],{"type":54,"value":284},{"type":54,"value":286},{"type":48,"tag":288,"props":783,"children":785},{"href":784},"%7BbaseDir%7D\u002Freferences\u002Ffile-upload.md",[786],{"type":54,"value":787},"file-upload.md",{"type":54,"value":295},{"type":48,"tag":273,"props":790,"children":791},{},[792],{"type":54,"value":300},{"type":54,"value":286},{"type":48,"tag":288,"props":795,"children":797},{"href":796},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Ffile-upload-checklist.md",[798],{"type":54,"value":799},"file-upload-checklist.md",{"type":48,"tag":57,"props":801,"children":802},{},[803],{"type":54,"value":804},"Bypass detection:",{"type":48,"tag":83,"props":806,"children":807},{},[808,813,826,837,858],{"type":48,"tag":87,"props":809,"children":810},{},[811],{"type":54,"value":812},"Client-side validation: modify JS or send request directly",{"type":48,"tag":87,"props":814,"children":815},{},[816,818,824],{"type":54,"value":817},"Content-Type: ",{"type":48,"tag":237,"props":819,"children":821},{"className":820},[],[822],{"type":54,"value":823},"image\u002Fgif",{"type":54,"value":825}," header + PHP code body",{"type":48,"tag":87,"props":827,"children":828},{},[829,831],{"type":54,"value":830},"Extension: ",{"type":48,"tag":237,"props":832,"children":834},{"className":833},[],[835],{"type":54,"value":836},".php5  .phtml  .pht  .php.  .php::$DATA",{"type":48,"tag":87,"props":838,"children":839},{},[840,842,848,850,856],{"type":54,"value":841},"Content inspection: ",{"type":48,"tag":237,"props":843,"children":845},{"className":844},[],[846],{"type":54,"value":847},"GIF89a",{"type":54,"value":849}," + ",{"type":48,"tag":237,"props":851,"children":853},{"className":852},[],[854],{"type":54,"value":855},"\u003C?php",{"type":54,"value":857}," or image-based webshell",{"type":48,"tag":87,"props":859,"children":860},{},[861,863,869],{"type":54,"value":862},"Parser discrepancy: ",{"type":48,"tag":237,"props":864,"children":866},{"className":865},[],[867],{"type":54,"value":868},"\u002Fupload\u002F1.asp;.jpg",{"type":54,"value":870}," (IIS 6.0)",{"type":48,"tag":57,"props":872,"children":873},{},[874],{"type":54,"value":875},"Parser-specific vulnerabilities:",{"type":48,"tag":83,"props":877,"children":878},{},[879,897,910,931],{"type":48,"tag":87,"props":880,"children":881},{},[882,884,890,891],{"type":54,"value":883},"IIS 6.0: ",{"type":48,"tag":237,"props":885,"children":887},{"className":886},[],[888],{"type":54,"value":889},"\u002Ftest.asp\u002F1.jpg",{"type":54,"value":320},{"type":48,"tag":237,"props":892,"children":894},{"className":893},[],[895],{"type":54,"value":896},"test.asp;.jpg",{"type":48,"tag":87,"props":898,"children":899},{},[900,902,908],{"type":54,"value":901},"Apache: ",{"type":48,"tag":237,"props":903,"children":905},{"className":904},[],[906],{"type":54,"value":907},".php.xxx",{"type":54,"value":909}," (unknown extension fallback)",{"type":48,"tag":87,"props":911,"children":912},{},[913,915,921,923,929],{"type":54,"value":914},"Nginx: ",{"type":48,"tag":237,"props":916,"children":918},{"className":917},[],[919],{"type":54,"value":920},"\u002F1.jpg\u002F1.php",{"type":54,"value":922}," (",{"type":48,"tag":237,"props":924,"children":926},{"className":925},[],[927],{"type":54,"value":928},"cgi.fix_pathinfo",{"type":54,"value":930},")",{"type":48,"tag":87,"props":932,"children":933},{},[934,936],{"type":54,"value":935},"Tomcat: ",{"type":48,"tag":237,"props":937,"children":939},{"className":938},[],[940],{"type":54,"value":941},"test.jsp%00.jpg",{"type":48,"tag":57,"props":943,"children":944},{},[945],{"type":54,"value":946},"Core defense: allowlist extensions, rename uploads, store outside\nwebroot, validate content type server-side.",{"type":48,"tag":63,"props":948,"children":949},{},[],{"type":48,"tag":67,"props":951,"children":953},{"id":952},"path-traversal",[954],{"type":54,"value":955},"Path Traversal",{"type":48,"tag":57,"props":957,"children":958},{},[959,963,965,969,970,976,977,981,982],{"type":48,"tag":273,"props":960,"children":961},{},[962],{"type":54,"value":277},{"type":54,"value":964}," 2,854 | ",{"type":48,"tag":273,"props":966,"children":967},{},[968],{"type":54,"value":284},{"type":54,"value":286},{"type":48,"tag":288,"props":971,"children":973},{"href":972},"%7BbaseDir%7D\u002Freferences\u002Fpath-traversal.md",[974],{"type":54,"value":975},"path-traversal.md",{"type":54,"value":295},{"type":48,"tag":273,"props":978,"children":979},{},[980],{"type":54,"value":300},{"type":54,"value":286},{"type":48,"tag":288,"props":983,"children":985},{"href":984},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fpath-traversal-checklist.md",[986],{"type":54,"value":987},"path-traversal-checklist.md",{"type":48,"tag":57,"props":989,"children":990},{},[991,992,998,999,1005,1006,1012,1013,1019,1020,1026,1027,1033,1034,1039,1040,1046,1047],{"type":54,"value":312},{"type":48,"tag":237,"props":993,"children":995},{"className":994},[],[996],{"type":54,"value":997},"file",{"type":54,"value":320},{"type":48,"tag":237,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":54,"value":1004},"path",{"type":54,"value":320},{"type":48,"tag":237,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":54,"value":1011},"filename",{"type":54,"value":320},{"type":48,"tag":237,"props":1014,"children":1016},{"className":1015},[],[1017],{"type":54,"value":1018},"url",{"type":54,"value":320},{"type":48,"tag":237,"props":1021,"children":1023},{"className":1022},[],[1024],{"type":54,"value":1025},"dir",{"type":54,"value":349},{"type":48,"tag":237,"props":1028,"children":1030},{"className":1029},[],[1031],{"type":54,"value":1032},"template",{"type":54,"value":320},{"type":48,"tag":237,"props":1035,"children":1037},{"className":1036},[],[1038],{"type":54,"value":362},{"type":54,"value":320},{"type":48,"tag":237,"props":1041,"children":1043},{"className":1042},[],[1044],{"type":54,"value":1045},"include",{"type":54,"value":320},{"type":48,"tag":237,"props":1048,"children":1050},{"className":1049},[],[1051],{"type":54,"value":1052},"download",{"type":48,"tag":57,"props":1054,"children":1055},{},[1056],{"type":54,"value":1057},"Traversal payloads:",{"type":48,"tag":83,"props":1059,"children":1060},{},[1061,1072,1097,1108],{"type":48,"tag":87,"props":1062,"children":1063},{},[1064,1066],{"type":54,"value":1065},"Basic: ",{"type":48,"tag":237,"props":1067,"children":1069},{"className":1068},[],[1070],{"type":54,"value":1071},"..\u002F..\u002F..\u002Fetc\u002Fpasswd",{"type":48,"tag":87,"props":1073,"children":1074},{},[1075,1077,1083,1084,1090,1091],{"type":54,"value":1076},"Encoded: ",{"type":48,"tag":237,"props":1078,"children":1080},{"className":1079},[],[1081],{"type":54,"value":1082},"%2e%2e%2f",{"type":54,"value":320},{"type":48,"tag":237,"props":1085,"children":1087},{"className":1086},[],[1088],{"type":54,"value":1089},"..%252f",{"type":54,"value":320},{"type":48,"tag":237,"props":1092,"children":1094},{"className":1093},[],[1095],{"type":54,"value":1096},"%c0%ae%c0%ae\u002F",{"type":48,"tag":87,"props":1098,"children":1099},{},[1100,1102],{"type":54,"value":1101},"Null byte: ",{"type":48,"tag":237,"props":1103,"children":1105},{"className":1104},[],[1106],{"type":54,"value":1107},"..\u002F..\u002F..\u002Fetc\u002Fpasswd%00.jpg",{"type":48,"tag":87,"props":1109,"children":1110},{},[1111,1112],{"type":54,"value":686},{"type":48,"tag":237,"props":1113,"children":1115},{"className":1114},[],[1116],{"type":54,"value":1117},"..\\..\\..\\windows\\win.ini",{"type":48,"tag":57,"props":1119,"children":1120},{},[1121,1123,1129,1130,1136,1137,1143,1144],{"type":54,"value":1122},"Target files (Linux): ",{"type":48,"tag":237,"props":1124,"children":1126},{"className":1125},[],[1127],{"type":54,"value":1128},"\u002Fetc\u002Fpasswd",{"type":54,"value":320},{"type":48,"tag":237,"props":1131,"children":1133},{"className":1132},[],[1134],{"type":54,"value":1135},"\u002Fetc\u002Fshadow",{"type":54,"value":349},{"type":48,"tag":237,"props":1138,"children":1140},{"className":1139},[],[1141],{"type":54,"value":1142},"\u002Fproc\u002Fself\u002Fenviron",{"type":54,"value":320},{"type":48,"tag":237,"props":1145,"children":1147},{"className":1146},[],[1148],{"type":54,"value":1149},"\u002Fvar\u002Flog\u002Fapache2\u002Faccess.log",{"type":48,"tag":57,"props":1151,"children":1152},{},[1153],{"type":54,"value":1154},"Core defense: resolve canonical paths, validate against allowlisted\ndirectories, never use user input in file paths directly.",{"type":48,"tag":63,"props":1156,"children":1157},{},[],{"type":48,"tag":67,"props":1159,"children":1161},{"id":1160},"unauthorized-access",[1162],{"type":54,"value":1163},"Unauthorized Access",{"type":48,"tag":57,"props":1165,"children":1166},{},[1167,1171,1173,1177,1178,1184,1185,1189,1190],{"type":48,"tag":273,"props":1168,"children":1169},{},[1170],{"type":54,"value":277},{"type":54,"value":1172}," 14,377 | ",{"type":48,"tag":273,"props":1174,"children":1175},{},[1176],{"type":54,"value":284},{"type":54,"value":286},{"type":48,"tag":288,"props":1179,"children":1181},{"href":1180},"%7BbaseDir%7D\u002Freferences\u002Funauthorized-access.md",[1182],{"type":54,"value":1183},"unauthorized-access.md",{"type":54,"value":295},{"type":48,"tag":273,"props":1186,"children":1187},{},[1188],{"type":54,"value":300},{"type":54,"value":286},{"type":48,"tag":288,"props":1191,"children":1193},{"href":1192},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Funauthorized-access-checklist.md",[1194],{"type":54,"value":1195},"unauthorized-access-checklist.md",{"type":48,"tag":57,"props":1197,"children":1198},{},[1199],{"type":54,"value":1200},"Access types:",{"type":48,"tag":83,"props":1202,"children":1203},{},[1204,1229,1234,1239],{"type":48,"tag":87,"props":1205,"children":1206},{},[1207,1209,1215,1216,1222,1223],{"type":54,"value":1208},"Admin panel exposure: ",{"type":48,"tag":237,"props":1210,"children":1212},{"className":1211},[],[1213],{"type":54,"value":1214},"\u002Fadmin",{"type":54,"value":320},{"type":48,"tag":237,"props":1217,"children":1219},{"className":1218},[],[1220],{"type":54,"value":1221},"\u002Fmanager",{"type":54,"value":320},{"type":48,"tag":237,"props":1224,"children":1226},{"className":1225},[],[1227],{"type":54,"value":1228},"\u002Fconsole",{"type":48,"tag":87,"props":1230,"children":1231},{},[1232],{"type":54,"value":1233},"API without authentication: missing token validation, predictable\ntokens",{"type":48,"tag":87,"props":1235,"children":1236},{},[1237],{"type":54,"value":1238},"Exposed services: Redis (6379), MongoDB (27017),\nElasticsearch (9200), Memcached (11211), Docker (2375)",{"type":48,"tag":87,"props":1240,"children":1241},{},[1242],{"type":54,"value":1243},"IDOR: horizontal privilege escalation via ID enumeration",{"type":48,"tag":57,"props":1245,"children":1246},{},[1247],{"type":54,"value":1248},"Core defense: authentication + authorization on every endpoint,\nsession management, principle of least privilege.",{"type":48,"tag":63,"props":1250,"children":1251},{},[],{"type":48,"tag":67,"props":1253,"children":1255},{"id":1254},"information-disclosure",[1256],{"type":54,"value":1257},"Information Disclosure",{"type":48,"tag":57,"props":1259,"children":1260},{},[1261,1265,1267,1271,1272,1278,1279,1283,1284],{"type":48,"tag":273,"props":1262,"children":1263},{},[1264],{"type":54,"value":277},{"type":54,"value":1266}," 7,337 | ",{"type":48,"tag":273,"props":1268,"children":1269},{},[1270],{"type":54,"value":284},{"type":54,"value":286},{"type":48,"tag":288,"props":1273,"children":1275},{"href":1274},"%7BbaseDir%7D\u002Freferences\u002Finfo-disclosure.md",[1276],{"type":54,"value":1277},"info-disclosure.md",{"type":54,"value":295},{"type":48,"tag":273,"props":1280,"children":1281},{},[1282],{"type":54,"value":300},{"type":54,"value":286},{"type":48,"tag":288,"props":1285,"children":1287},{"href":1286},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Finfo-disclosure-checklist.md",[1288],{"type":54,"value":1289},"info-disclosure-checklist.md",{"type":48,"tag":57,"props":1291,"children":1292},{},[1293,1295,1301,1303,1309,1311,1317,1318,1324,1325,1331],{"type":54,"value":1294},"Disclosure sources: error messages with stack traces, exposed ",{"type":48,"tag":237,"props":1296,"children":1298},{"className":1297},[],[1299],{"type":54,"value":1300},".git",{"type":54,"value":1302},"\nor ",{"type":48,"tag":237,"props":1304,"children":1306},{"className":1305},[],[1307],{"type":54,"value":1308},".svn",{"type":54,"value":1310}," directories, backup files (",{"type":48,"tag":237,"props":1312,"children":1314},{"className":1313},[],[1315],{"type":54,"value":1316},".bak",{"type":54,"value":320},{"type":48,"tag":237,"props":1319,"children":1321},{"className":1320},[],[1322],{"type":54,"value":1323},".sql",{"type":54,"value":320},{"type":48,"tag":237,"props":1326,"children":1328},{"className":1327},[],[1329],{"type":54,"value":1330},".tar.gz",{"type":54,"value":1332},"),\nconfiguration files, debug endpoints, directory listings",{"type":48,"tag":57,"props":1334,"children":1335},{},[1336],{"type":54,"value":1337},"Core defense: custom error pages, disable directory listing, remove\ndebug endpoints in production, audit publicly accessible files.",{"type":48,"tag":63,"props":1339,"children":1340},{},[],{"type":48,"tag":67,"props":1342,"children":1344},{"id":1343},"business-logic-flaws",[1345],{"type":54,"value":1346},"Business Logic Flaws",{"type":48,"tag":57,"props":1348,"children":1349},{},[1350,1354,1356,1360,1361,1367,1368,1372,1373],{"type":48,"tag":273,"props":1351,"children":1352},{},[1353],{"type":54,"value":277},{"type":54,"value":1355}," 8,292 | ",{"type":48,"tag":273,"props":1357,"children":1358},{},[1359],{"type":54,"value":284},{"type":54,"value":286},{"type":48,"tag":288,"props":1362,"children":1364},{"href":1363},"%7BbaseDir%7D\u002Freferences\u002Flogic-flaws.md",[1365],{"type":54,"value":1366},"logic-flaws.md",{"type":54,"value":295},{"type":48,"tag":273,"props":1369,"children":1370},{},[1371],{"type":54,"value":300},{"type":54,"value":286},{"type":48,"tag":288,"props":1374,"children":1376},{"href":1375},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Flogic-flaws-checklist.md",[1377],{"type":54,"value":1378},"logic-flaws-checklist.md",{"type":48,"tag":57,"props":1380,"children":1381},{},[1382],{"type":54,"value":1383},"Vulnerability patterns:",{"type":48,"tag":83,"props":1385,"children":1386},{},[1387,1392,1397,1402],{"type":48,"tag":87,"props":1388,"children":1389},{},[1390],{"type":54,"value":1391},"Password reset: verification code in response body, step skipping,\ncontrollable reset tokens",{"type":48,"tag":87,"props":1393,"children":1394},{},[1395],{"type":54,"value":1396},"Authorization bypass: horizontal (ID enumeration), vertical (role\nescalation)",{"type":48,"tag":87,"props":1398,"children":1399},{},[1400],{"type":54,"value":1401},"Payment logic: amount tampering, quantity manipulation, coupon\nstacking",{"type":48,"tag":87,"props":1403,"children":1404},{},[1405],{"type":54,"value":1406},"CAPTCHA: not refreshed, reusable, brute-forceable, client-side only",{"type":48,"tag":57,"props":1408,"children":1409},{},[1410],{"type":54,"value":1411},"Testing approach:",{"type":48,"tag":1413,"props":1414,"children":1415},"ol",{},[1416,1421,1426,1431],{"type":48,"tag":87,"props":1417,"children":1418},{},[1419],{"type":54,"value":1420},"Map the business flow -> draw state transition diagram",{"type":48,"tag":87,"props":1422,"children":1423},{},[1424],{"type":54,"value":1425},"Identify critical checks -> which parameters determine outcomes",{"type":48,"tag":87,"props":1427,"children":1428},{},[1429],{"type":54,"value":1430},"Attempt bypass -> modify parameters \u002F skip steps \u002F replay \u002F race",{"type":48,"tag":87,"props":1432,"children":1433},{},[1434],{"type":54,"value":1435},"Verify impact -> prove the scope of harm",{"type":48,"tag":57,"props":1437,"children":1438},{},[1439],{"type":54,"value":1440},"Core defense: server-side validation of all business-critical logic.",{"type":48,"tag":63,"props":1442,"children":1443},{},[],{"type":48,"tag":67,"props":1445,"children":1447},{"id":1446},"additional-categories",[1448],{"type":54,"value":1449},"Additional Categories",{"type":48,"tag":57,"props":1451,"children":1452},{},[1453],{"type":54,"value":1454},"These categories are derived from case data without full reference\ndocuments. Each has a testing checklist extracted from real cases.",{"type":48,"tag":1456,"props":1457,"children":1458},"table",{},[1459,1478],{"type":48,"tag":1460,"props":1461,"children":1462},"thead",{},[1463],{"type":48,"tag":1464,"props":1465,"children":1466},"tr",{},[1467,1473],{"type":48,"tag":1468,"props":1469,"children":1470},"th",{},[1471],{"type":54,"value":1472},"Category",{"type":48,"tag":1468,"props":1474,"children":1475},{},[1476],{"type":54,"value":1477},"Checklist",{"type":48,"tag":1479,"props":1480,"children":1481},"tbody",{},[1482,1500,1517,1534,1551,1568],{"type":48,"tag":1464,"props":1483,"children":1484},{},[1485,1491],{"type":48,"tag":1486,"props":1487,"children":1488},"td",{},[1489],{"type":54,"value":1490},"CSRF",{"type":48,"tag":1486,"props":1492,"children":1493},{},[1494],{"type":48,"tag":288,"props":1495,"children":1497},{"href":1496},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fcsrf-checklist.md",[1498],{"type":54,"value":1499},"csrf-checklist.md",{"type":48,"tag":1464,"props":1501,"children":1502},{},[1503,1508],{"type":48,"tag":1486,"props":1504,"children":1505},{},[1506],{"type":54,"value":1507},"SSRF",{"type":48,"tag":1486,"props":1509,"children":1510},{},[1511],{"type":48,"tag":288,"props":1512,"children":1514},{"href":1513},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fssrf-checklist.md",[1515],{"type":54,"value":1516},"ssrf-checklist.md",{"type":48,"tag":1464,"props":1518,"children":1519},{},[1520,1525],{"type":48,"tag":1486,"props":1521,"children":1522},{},[1523],{"type":54,"value":1524},"Weak Passwords",{"type":48,"tag":1486,"props":1526,"children":1527},{},[1528],{"type":48,"tag":288,"props":1529,"children":1531},{"href":1530},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fweak-password-checklist.md",[1532],{"type":54,"value":1533},"weak-password-checklist.md",{"type":48,"tag":1464,"props":1535,"children":1536},{},[1537,1542],{"type":48,"tag":1486,"props":1538,"children":1539},{},[1540],{"type":54,"value":1541},"Misconfiguration",{"type":48,"tag":1486,"props":1543,"children":1544},{},[1545],{"type":48,"tag":288,"props":1546,"children":1548},{"href":1547},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fmisconfig-checklist.md",[1549],{"type":54,"value":1550},"misconfig-checklist.md",{"type":48,"tag":1464,"props":1552,"children":1553},{},[1554,1559],{"type":48,"tag":1486,"props":1555,"children":1556},{},[1557],{"type":54,"value":1558},"Remote Code Execution",{"type":48,"tag":1486,"props":1560,"children":1561},{},[1562],{"type":48,"tag":288,"props":1563,"children":1565},{"href":1564},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Frce-checklist.md",[1566],{"type":54,"value":1567},"rce-checklist.md",{"type":48,"tag":1464,"props":1569,"children":1570},{},[1571,1576],{"type":48,"tag":1486,"props":1572,"children":1573},{},[1574],{"type":54,"value":1575},"XML External Entity (XXE)",{"type":48,"tag":1486,"props":1577,"children":1578},{},[1579],{"type":48,"tag":288,"props":1580,"children":1582},{"href":1581},"%7BbaseDir%7D\u002Freferences\u002Fchecklists\u002Fxxe-checklist.md",[1583],{"type":54,"value":1584},"xxe-checklist.md",{"type":48,"tag":74,"props":1586,"children":1587},{},[1588],{"type":48,"tag":57,"props":1589,"children":1590},{},[1591,1596],{"type":48,"tag":273,"props":1592,"children":1593},{},[1594],{"type":54,"value":1595},"Note:",{"type":54,"value":1597}," The RCE checklist covers deserialization, OGNL injection, and\nframework-specific remote code execution — distinct from the OS command\ninjection focus of the Command Execution reference above.",{"type":48,"tag":63,"props":1599,"children":1600},{},[],{"type":48,"tag":67,"props":1602,"children":1604},{"id":1603},"methodology-case-studies",[1605],{"type":54,"value":1606},"Methodology Case Studies",{"type":48,"tag":57,"props":1608,"children":1609},{},[1610],{"type":54,"value":1611},"Real-world penetration testing methodology examples (anonymized):",{"type":48,"tag":1456,"props":1613,"children":1614},{},[1615,1631],{"type":48,"tag":1460,"props":1616,"children":1617},{},[1618],{"type":48,"tag":1464,"props":1619,"children":1620},{},[1621,1626],{"type":48,"tag":1468,"props":1622,"children":1623},{},[1624],{"type":54,"value":1625},"Case Study",{"type":48,"tag":1468,"props":1627,"children":1628},{},[1629],{"type":54,"value":1630},"Description",{"type":48,"tag":1479,"props":1632,"children":1633},{},[1634,1651],{"type":48,"tag":1464,"props":1635,"children":1636},{},[1637,1646],{"type":48,"tag":1486,"props":1638,"children":1639},{},[1640],{"type":48,"tag":288,"props":1641,"children":1643},{"href":1642},"%7BbaseDir%7D\u002Freferences\u002Fbank-penetration.md",[1644],{"type":54,"value":1645},"bank-penetration.md",{"type":48,"tag":1486,"props":1647,"children":1648},{},[1649],{"type":54,"value":1650},"Multi-stage attack chain against a financial institution",{"type":48,"tag":1464,"props":1652,"children":1653},{},[1654,1663],{"type":48,"tag":1486,"props":1655,"children":1656},{},[1657],{"type":48,"tag":288,"props":1658,"children":1660},{"href":1659},"%7BbaseDir%7D\u002Freferences\u002Ftelecom-penetration.md",[1661],{"type":54,"value":1662},"telecom-penetration.md",{"type":48,"tag":1486,"props":1664,"children":1665},{},[1666],{"type":54,"value":1667},"Infrastructure penetration of a telecom carrier",{"type":48,"tag":57,"props":1669,"children":1670},{},[1671],{"type":54,"value":1672},"These demonstrate how individual vulnerabilities chain together into\nfull compromise scenarios.",{"type":48,"tag":63,"props":1674,"children":1675},{},[],{"type":48,"tag":67,"props":1677,"children":1679},{"id":1678},"testing-priority-framework",[1680],{"type":54,"value":1681},"Testing Priority Framework",{"type":48,"tag":1683,"props":1684,"children":1686},"h3",{"id":1685},"high-priority-test-first",[1687],{"type":54,"value":1688},"High Priority (test first)",{"type":48,"tag":1413,"props":1690,"children":1691},{},[1692,1701,1710],{"type":48,"tag":87,"props":1693,"children":1694},{},[1695,1699],{"type":48,"tag":273,"props":1696,"children":1697},{},[1698],{"type":54,"value":268},{"type":54,"value":1700}," — direct data access, highest case count (27,732)",{"type":48,"tag":87,"props":1702,"children":1703},{},[1704,1708],{"type":48,"tag":273,"props":1705,"children":1706},{},[1707],{"type":54,"value":601},{"type":54,"value":1709}," — OS-level compromise",{"type":48,"tag":87,"props":1711,"children":1712},{},[1713,1717],{"type":48,"tag":273,"props":1714,"children":1715},{},[1716],{"type":54,"value":767},{"type":54,"value":1718}," — arbitrary code execution via webshell",{"type":48,"tag":1683,"props":1720,"children":1722},{"id":1721},"medium-priority",[1723],{"type":54,"value":1724},"Medium Priority",{"type":48,"tag":1413,"props":1726,"children":1728},{"start":1727},4,[1729,1738,1747],{"type":48,"tag":87,"props":1730,"children":1731},{},[1732,1736],{"type":48,"tag":273,"props":1733,"children":1734},{},[1735],{"type":54,"value":1163},{"type":54,"value":1737}," — second-highest case count (14,377)",{"type":48,"tag":87,"props":1739,"children":1740},{},[1741,1745],{"type":48,"tag":273,"props":1742,"children":1743},{},[1744],{"type":54,"value":1346},{"type":54,"value":1746}," — application-specific, hard to automate",{"type":48,"tag":87,"props":1748,"children":1749},{},[1750,1755],{"type":48,"tag":273,"props":1751,"children":1752},{},[1753],{"type":54,"value":1754},"XSS",{"type":54,"value":1756}," — session hijacking, phishing",{"type":48,"tag":1683,"props":1758,"children":1760},{"id":1759},"lower-priority-but-still-important",[1761],{"type":54,"value":1762},"Lower Priority (but still important)",{"type":48,"tag":1413,"props":1764,"children":1766},{"start":1765},7,[1767,1776,1785],{"type":48,"tag":87,"props":1768,"children":1769},{},[1770,1774],{"type":48,"tag":273,"props":1771,"children":1772},{},[1773],{"type":54,"value":955},{"type":54,"value":1775}," — file read, sometimes write",{"type":48,"tag":87,"props":1777,"children":1778},{},[1779,1783],{"type":48,"tag":273,"props":1780,"children":1781},{},[1782],{"type":54,"value":1257},{"type":54,"value":1784}," — reconnaissance value, enables chaining",{"type":48,"tag":87,"props":1786,"children":1787},{},[1788,1793],{"type":48,"tag":273,"props":1789,"children":1790},{},[1791],{"type":54,"value":1792},"CSRF\u002FSSRF\u002FXXE",{"type":54,"value":1794}," — context-dependent severity",{"type":48,"tag":63,"props":1796,"children":1797},{},[],{"type":48,"tag":67,"props":1799,"children":1801},{"id":1800},"defense-quick-reference",[1802],{"type":54,"value":1803},"Defense Quick Reference",{"type":48,"tag":1456,"props":1805,"children":1806},{},[1807,1828],{"type":48,"tag":1460,"props":1808,"children":1809},{},[1810],{"type":48,"tag":1464,"props":1811,"children":1812},{},[1813,1818,1823],{"type":48,"tag":1468,"props":1814,"children":1815},{},[1816],{"type":54,"value":1817},"Vulnerability",{"type":48,"tag":1468,"props":1819,"children":1820},{},[1821],{"type":54,"value":1822},"Core Defense",{"type":48,"tag":1468,"props":1824,"children":1825},{},[1826],{"type":54,"value":1827},"Implementation",{"type":48,"tag":1479,"props":1829,"children":1830},{},[1831,1848,1865,1894,1911,1928,1945,1963],{"type":48,"tag":1464,"props":1832,"children":1833},{},[1834,1838,1843],{"type":48,"tag":1486,"props":1835,"children":1836},{},[1837],{"type":54,"value":268},{"type":48,"tag":1486,"props":1839,"children":1840},{},[1841],{"type":54,"value":1842},"Parameterized queries",{"type":48,"tag":1486,"props":1844,"children":1845},{},[1846],{"type":54,"value":1847},"PreparedStatement \u002F ORM",{"type":48,"tag":1464,"props":1849,"children":1850},{},[1851,1855,1860],{"type":48,"tag":1486,"props":1852,"children":1853},{},[1854],{"type":54,"value":1754},{"type":48,"tag":1486,"props":1856,"children":1857},{},[1858],{"type":54,"value":1859},"Output encoding",{"type":48,"tag":1486,"props":1861,"children":1862},{},[1863],{"type":54,"value":1864},"Context-aware escaping + CSP",{"type":48,"tag":1464,"props":1866,"children":1867},{},[1868,1872,1877],{"type":48,"tag":1486,"props":1869,"children":1870},{},[1871],{"type":54,"value":601},{"type":48,"tag":1486,"props":1873,"children":1874},{},[1875],{"type":54,"value":1876},"Avoid shell",{"type":48,"tag":1486,"props":1878,"children":1879},{},[1880,1885,1887,1892],{"type":48,"tag":237,"props":1881,"children":1883},{"className":1882},[],[1884],{"type":54,"value":748},{"type":54,"value":1886}," not ",{"type":48,"tag":237,"props":1888,"children":1890},{"className":1889},[],[1891],{"type":54,"value":756},{"type":54,"value":1893},", allowlist",{"type":48,"tag":1464,"props":1895,"children":1896},{},[1897,1901,1906],{"type":48,"tag":1486,"props":1898,"children":1899},{},[1900],{"type":54,"value":767},{"type":48,"tag":1486,"props":1902,"children":1903},{},[1904],{"type":54,"value":1905},"Strict validation",{"type":48,"tag":1486,"props":1907,"children":1908},{},[1909],{"type":54,"value":1910},"Allowlist ext, rename, isolate",{"type":48,"tag":1464,"props":1912,"children":1913},{},[1914,1918,1923],{"type":48,"tag":1486,"props":1915,"children":1916},{},[1917],{"type":54,"value":955},{"type":48,"tag":1486,"props":1919,"children":1920},{},[1921],{"type":54,"value":1922},"Canonical paths",{"type":48,"tag":1486,"props":1924,"children":1925},{},[1926],{"type":54,"value":1927},"Resolve + validate against allowlist",{"type":48,"tag":1464,"props":1929,"children":1930},{},[1931,1935,1940],{"type":48,"tag":1486,"props":1932,"children":1933},{},[1934],{"type":54,"value":1163},{"type":48,"tag":1486,"props":1936,"children":1937},{},[1938],{"type":54,"value":1939},"Access control",{"type":48,"tag":1486,"props":1941,"children":1942},{},[1943],{"type":54,"value":1944},"AuthN + AuthZ + session mgmt",{"type":48,"tag":1464,"props":1946,"children":1947},{},[1948,1953,1958],{"type":48,"tag":1486,"props":1949,"children":1950},{},[1951],{"type":54,"value":1952},"Logic Flaws",{"type":48,"tag":1486,"props":1954,"children":1955},{},[1956],{"type":54,"value":1957},"Server-side checks",{"type":48,"tag":1486,"props":1959,"children":1960},{},[1961],{"type":54,"value":1962},"Validate all business logic server-side",{"type":48,"tag":1464,"props":1964,"children":1965},{},[1966,1971,1976],{"type":48,"tag":1486,"props":1967,"children":1968},{},[1969],{"type":54,"value":1970},"Info Disclosure",{"type":48,"tag":1486,"props":1972,"children":1973},{},[1974],{"type":54,"value":1975},"Minimize exposure",{"type":48,"tag":1486,"props":1977,"children":1978},{},[1979],{"type":54,"value":1980},"Custom errors, no debug in prod",{"type":48,"tag":63,"props":1982,"children":1983},{},[],{"type":48,"tag":67,"props":1985,"children":1987},{"id":1986},"key-insight",[1988],{"type":54,"value":1989},"Key Insight",{"type":48,"tag":57,"props":1991,"children":1992},{},[1993],{"type":54,"value":1994},"All 88,636 vulnerabilities in this database share a common root cause:\nthe gap between what developers assumed and what attackers actually\nprovided. Effective security testing means systematically challenging\nevery assumption at every trust boundary.",{"type":48,"tag":57,"props":1996,"children":1997},{},[1998],{"type":54,"value":1999},"Four principles from the data:",{"type":48,"tag":1413,"props":2001,"children":2002},{},[2003,2013,2023,2033],{"type":48,"tag":87,"props":2004,"children":2005},{},[2006,2011],{"type":48,"tag":273,"props":2007,"children":2008},{},[2009],{"type":54,"value":2010},"Boundary thinking",{"type":54,"value":2012}," — all vulnerabilities occur at trust boundaries",{"type":48,"tag":87,"props":2014,"children":2015},{},[2016,2021],{"type":48,"tag":273,"props":2017,"children":2018},{},[2019],{"type":54,"value":2020},"Data flow tracing",{"type":54,"value":2022}," — follow data from input to output completely",{"type":48,"tag":87,"props":2024,"children":2025},{},[2026,2031],{"type":48,"tag":273,"props":2027,"children":2028},{},[2029],{"type":54,"value":2030},"Assumption challenging",{"type":54,"value":2032}," — question every \"obvious\" validation",{"type":48,"tag":87,"props":2034,"children":2035},{},[2036,2041],{"type":48,"tag":273,"props":2037,"children":2038},{},[2039],{"type":54,"value":2040},"Chain composition",{"type":54,"value":2042}," — individual low-severity findings combine\ninto critical attack paths",{"items":2044,"total":2196},[2045,2062,2072,2090,2103,2116,2128,2138,2151,2162,2174,2185],{"slug":2046,"name":2046,"fn":2047,"description":2048,"org":2049,"tags":2050,"stars":2059,"repoUrl":2060,"updatedAt":2061},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2051,2054,2055,2056],{"name":2052,"slug":2053,"type":16},"C#","c",{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":2057,"slug":2058,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:14.925095",{"slug":2063,"name":2063,"fn":2064,"description":2065,"org":2066,"tags":2067,"stars":2059,"repoUrl":2060,"updatedAt":2071},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2068,2069,2070],{"name":2052,"slug":2053,"type":16},{"name":14,"slug":15,"type":16},{"name":2057,"slug":2058,"type":16},"2026-07-17T06:05:12.433192",{"slug":2073,"name":2073,"fn":2074,"description":2075,"org":2076,"tags":2077,"stars":2059,"repoUrl":2060,"updatedAt":2089},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2078,2081,2084,2085,2088],{"name":2079,"slug":2080,"type":16},"Agents","agents",{"name":2082,"slug":2083,"type":16},"CI\u002FCD","ci-cd",{"name":21,"slug":22,"type":16},{"name":2086,"slug":2087,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":2091,"name":2091,"fn":2092,"description":2093,"org":2094,"tags":2095,"stars":2059,"repoUrl":2060,"updatedAt":2102},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2096,2097,2098,2099],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":2100,"slug":2101,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":2104,"name":2104,"fn":2105,"description":2106,"org":2107,"tags":2108,"stars":2059,"repoUrl":2060,"updatedAt":2115},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2109,2112],{"name":2110,"slug":2111,"type":16},"Engineering","engineering",{"name":2113,"slug":2114,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":2117,"name":2117,"fn":2118,"description":2119,"org":2120,"tags":2121,"stars":2059,"repoUrl":2060,"updatedAt":2127},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2122,2125,2126],{"name":2123,"slug":2124,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":2057,"slug":2058,"type":16},"2026-07-17T06:05:14.575191",{"slug":2129,"name":2129,"fn":2130,"description":2131,"org":2132,"tags":2133,"stars":2059,"repoUrl":2060,"updatedAt":2137},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2134,2135,2136],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":2139,"name":2139,"fn":2140,"description":2141,"org":2142,"tags":2143,"stars":2059,"repoUrl":2060,"updatedAt":2150},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2144,2147,2148,2149],{"name":2145,"slug":2146,"type":16},"Architecture","architecture",{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":2110,"slug":2111,"type":16},"2026-07-18T05:47:40.122449",{"slug":2152,"name":2152,"fn":2153,"description":2154,"org":2155,"tags":2156,"stars":2059,"repoUrl":2060,"updatedAt":2161},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2157,2158,2159,2160],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":2110,"slug":2111,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":2163,"name":2163,"fn":2164,"description":2165,"org":2166,"tags":2167,"stars":2059,"repoUrl":2060,"updatedAt":2173},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2168,2169,2172],{"name":18,"slug":19,"type":16},{"name":2170,"slug":2171,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":2175,"name":2175,"fn":2176,"description":2177,"org":2178,"tags":2179,"stars":2059,"repoUrl":2060,"updatedAt":2184},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2180,2181,2182,2183],{"name":18,"slug":19,"type":16},{"name":2052,"slug":2053,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":2186,"name":2186,"fn":2187,"description":2188,"org":2189,"tags":2190,"stars":2059,"repoUrl":2060,"updatedAt":2195},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2191,2192,2193,2194],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":2100,"slug":2101,"type":16},"2026-07-18T05:47:42.84568",111,{"items":2198,"total":2299},[2199,2209,2219,2238,2250,2266,2280],{"slug":2200,"name":2200,"fn":2201,"description":2202,"org":2203,"tags":2204,"stars":26,"repoUrl":27,"updatedAt":2208},"ffuf-web-fuzzing","perform web fuzzing with ffuf","Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration, parameter fuzzing, authenticated fuzzing with raw requests, auto-calibration, and result analysis. Use when running ffuf scans, analyzing ffuf output, or building fuzzing strategies for web targets.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2205,2206,2207],{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":2057,"slug":2058,"type":16},"2026-07-17T06:05:08.247908",{"slug":2210,"name":2210,"fn":2211,"description":2212,"org":2213,"tags":2214,"stars":26,"repoUrl":27,"updatedAt":2218},"ghidra-headless","reverse engineer binaries with Ghidra","Reverse engineers binaries using Ghidra's headless analyzer. Use when decompiling executables, extracting functions, strings, symbols, or analyzing call graphs from compiled binaries without the Ghidra GUI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2215,2216,2217],{"name":21,"slug":22,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:30.015093",{"slug":2220,"name":2220,"fn":2221,"description":2222,"org":2223,"tags":2224,"stars":26,"repoUrl":27,"updatedAt":2237},"grilling","stress-test plans and decisions","Interviews the user relentlessly about a plan, decision, or idea until every branch of the decision tree is resolved. Use when the user wants to stress-test their thinking, sharpen a plan or design before acting, or uses any 'grill' trigger phrase (e.g. \"grill me on this\").",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2225,2228,2231,2234],{"name":2226,"slug":2227,"type":16},"Analysis","analysis",{"name":2229,"slug":2230,"type":16},"Coaching","coaching",{"name":2232,"slug":2233,"type":16},"Ideation","ideation",{"name":2235,"slug":2236,"type":16},"Strategy","strategy","2026-07-18T05:48:12.46583",{"slug":2239,"name":2239,"fn":2240,"description":2241,"org":2242,"tags":2243,"stars":26,"repoUrl":27,"updatedAt":2249},"handoff","compact conversation for session handoff","Compacts the current conversation into a handoff document so a fresh agent can continue the work in a new session.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2244,2245,2248],{"name":2079,"slug":2080,"type":16},{"name":2246,"slug":2247,"type":16},"Context","context",{"name":2113,"slug":2114,"type":16},"2026-07-18T05:47:03.196098",{"slug":2251,"name":2251,"fn":2252,"description":2253,"org":2254,"tags":2255,"stars":26,"repoUrl":27,"updatedAt":2265},"humanizer","edit text to sound human-written","Remove signs of AI-generated writing from text. Use when editing or reviewing\ntext to make it sound more natural and human-written. Based on Wikipedia's\ncomprehensive \"Signs of AI writing\" guide. Detects and fixes patterns including:\ninflated symbolism, promotional language, superficial -ing analyses, vague\nattributions, em dash overuse, rule of three, AI vocabulary words, negative\nparallelisms, and excessive conjunctive phrases. 30c5c8d (Update humanizer plugin to upstream v2.2.0)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2256,2259,2262],{"name":2257,"slug":2258,"type":16},"Content Creation","content-creation",{"name":2260,"slug":2261,"type":16},"Editing","editing",{"name":2263,"slug":2264,"type":16},"Writing","writing","2026-07-18T05:47:18.1749",{"slug":2267,"name":2267,"fn":2268,"description":2269,"org":2270,"tags":2271,"stars":26,"repoUrl":27,"updatedAt":2279},"last30days","research recent community discussions and trends","Researches a topic from the last 30 days on Reddit, X, and the web. Surfaces real community discussions with engagement metrics and synthesizes findings into actionable insights. Use when the user wants to know what people are saying about a topic right now.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2272,2273,2276],{"name":2226,"slug":2227,"type":16},{"name":2274,"slug":2275,"type":16},"Research","research",{"name":2277,"slug":2278,"type":16},"Social Media","social-media","2026-07-17T06:04:39.744471",{"slug":2281,"name":2281,"fn":2282,"description":2283,"org":2284,"tags":2285,"stars":26,"repoUrl":27,"updatedAt":2298},"openai-cloudflare-deploy","deploy applications to Cloudflare","Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare. Originally from OpenAI's curated skills catalog.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2286,2289,2292,2295],{"name":2287,"slug":2288,"type":16},"Cloudflare","cloudflare",{"name":2290,"slug":2291,"type":16},"Cloudflare Pages","cloudflare-pages",{"name":2293,"slug":2294,"type":16},"Cloudflare Workers","cloudflare-workers",{"name":2296,"slug":2297,"type":16},"Deployment","deployment","2026-07-17T06:04:46.574433",31]