4. Common vulnerability attack and defense

Content Index:

• 4.1. SQL Injection
  • 4.1.1. Injection Classification
  • 4.1.2. Injection Detection
  • 4.1.3. Privilege Escalation
  • 4.1.4. Database Detection
  • 4.1.5. Bypass Techniques
  • 4.1.6. SQL Injection Tips
  • 4.1.7. CheatSheet
  • 4.1.8. Precompile
  • 4.1.9. Reference articles
• 4.2. XSS
  • 4.2.1. Classification
  • 4.2.2. Hazards
  • 4.2.3. Same Origin Policy
  • 4.2.4. CSP
  • 4.2.5. XSS data sources
  • 4.2.6. Sink
  • 4.2.7. XSS Protection
  • 4.2.8. WAF Bypass
  • 4.2.9. Skills
  • 4.2.10. Payload
  • 4.2.11. Persistence
  • 4.2.12. Reference Links
• 4.3. CSRF
  • 4.3.1. Introduction
  • 4.3.2. Classification
  • 4.3.3. Defense
  • 4.3.4. Reference Links
• 4.4. SSRF
  • 4.4.1. Introduction
  • 4.4.2. Utilization
  • 4.4.3. Associated Hazard Functions
  • 4.4.4. Filter Bypass
  • 4.4.5. Possible exploit points
  • 4.4.6. Defense methods
  • 4.4.7. Reference Links
• 4.5. Command Injection
  • 4.5.1. Introduction
  • 4.5.2. Common hazard functions
  • 4.5.3. Common injection methods
  • 4.5.4. No echo technique
  • 4.5.5. Common bypass methods
  • 4.5.6. Common symbols
  • 4.5.7. Defense
• 4.6. Directory Traversal
  • 4.6.1. Introduction
  • 4.6.2. Attack payload
  • 4.6.3. Filter Bypass
  • 4.6.4. Defense
  • 4.6.5. Reference Links
• 4.7. File reading
• 4.8. File Upload
  • 4.8.1. File Type Detection Bypass
  • 4.8.2. Attack techniques
  • 4.8.3. Protection techniques
  • 4.8.4. Reference Links
• 4.9. File Include
  • 4.9.1. Basic
  • 4.9.2. Triggering Sink
  • 4.9.3. Bypass Techniques
  • 4.9.4. Reference Links
• 4.10. XXE
  • 4.10.1. XML Basics
  • 4.10.2. Basic syntax
  • 4.10.3. XXE
  • 4.10.4. Attack Mode
  • 4.10.5. Reference Links
• 4.11. Template Injection
  • 4.11.1. Introduction
  • 4.11.2. Test method
  • 4.11.3. Test Cases
  • 4.11.4. Objectives
  • 4.11.5. Related Properties
  • 4.11.6. Common Payloads
  • 4.11.7. Bypass Techniques
  • 4.11.8. Reference Links
• 4.12. Xpath injection
  • 4.12.1. Xpath definitions
  • 4.12.2. Principle of Xpath Injection Attack
• 4.13. Logic Vulnerability / Business Vulnerability
  • 4.13.1. Introduction
  • 4.13.2. Installation Logic
  • 4.13.3. Transactions
  • 4.13.4. Accounts
  • 4.13.5. 2FA
  • 4.13.6. Verification Code
  • 4.13.7. Session
  • 4.13.8. Ultraviolet
  • 4.13.9. Random Number Security
  • 4.13.10. Others
  • 4.13.11. Reference Links
• 4.14. Configuration and Policy Security
  • 4.14.1. Authentication Policy
  • 4.14.2. Permission configuration
  • 4.14.3. Supply chain security
• 4.15. Middleware
  • 4.15.1. IIS
  • 4.15.2. Apache
  • 4.15.3. Nginx
• 4.16. Web Cache Spoofing Attack
  • 4.16.1. Introduction
  • 4.16.2. Vulnerability Causes
  • 4.16.3. Vulnerability Exploitation
  • 4.16.4. Conditions for the existence of vulnerabilities
  • 4.16.5. Vulnerability Defense
  • 4.16.6. Web Cache spoofing attack example
  • 4.16.7. Reference Links
• 4.17. HTTP Request Smuggling
  • 4.17.1. Introduction
  • 4.17.2. Causes
  • 4.17.3. Classification
  • 4.17.4. Attacks
  • 4.17.5. Defense
  • 4.17.6. Reference Links