/wooyun-legacy

name: wooyun-legacy
description: >-
  Provides web vulnerability testing methodology distilled from 88,636
  real-world cases from the WooYun vulnerability database (2010-2016). Use when
  performing penetration testing, security audits, code reviews for security
  flaws, or vulnerability research. Covers SQL injection, XSS, command
  execution, file upload, path traversal, unauthorized access, information
  disclosure, and business logic flaws.
allowed-tools:
  - Read
  - Grep
  - Glob
  - Bash

WooYun Vulnerability Analysis Knowledge Base

Methodology and testing patterns extracted from 88,636 real-world vulnerability cases reported to the WooYun platform (2010-2016).

---

When to Use

> All testing described here must be performed only against systems you > have written authorization to test.

• Penetration testing web applications
• Security code review (server-side or client-side)
• Vulnerability research against web targets you have explicit authorization to test
• Building security test cases or checklists
• Assessing web application attack surface
• Reviewing remediation effectiveness
• Training or education in authorized security testing contexts

When NOT to Use

• Network infrastructure testing (firewalls, routers, switches)
• Mobile application binary analysis
• Malware analysis or reverse engineering
• Compliance-only assessments (PCI-DSS, SOC2 checklists without testing)
• Physical security assessments
• Social engineering campaigns
• Cloud infrastructure misconfigurations (IAM, S3 buckets) — these

require cloud-specific tooling, not web vuln patterns

Rationalizations to Reject

These shortcuts lead to missed findings. Reject them:

• "The WAF will catch it" — WAFs are bypass-able; test the application

logic, not the middleware

• "It's an internal app, so auth doesn't matter" — internal apps get

compromised via SSRF, lateral movement, and credential reuse

• "We already use parameterized queries everywhere" — check for ORM

misuse, stored procedures with dynamic SQL, and second-order injection

• "The framework handles XSS" — template engines have raw output modes,

JavaScript contexts bypass HTML encoding, and DOM XSS lives entirely client-side

• "File uploads are safe because we check the extension" — extension

checks are bypassed via null bytes, double extensions, parser discrepancies, and race conditions

• "We validate on the frontend" — client-side validation is a UX

feature, not a security control

• "Nobody would guess that URL" — security through obscurity fails

against directory bruteforcing, referrer leaks, and JS source analysis

• "Low severity, not worth reporting" — low-severity findings chain

into critical attack paths

---

Core Mental Model

Vulnerability = Expected Behavior - Actual Behavior
             = Developer Assumptions + Attacker Input -> Unexpected State

Analysis chain:
1. Where does data come from?  (Input sources)
   -> GET/POST/Cookie/Header/File/WebSocket
2. Where does data flow?       (Data path)
   -> Validation -> Processing -> Storage -> Output
3. Where is data trusted?      (Trust boundaries)
   -> Client / Server / Database / OS / External service
4. How is data processed?      (Processing logic)
   -> Filter / Escape / Validate / Execute
5. Where does data end up?     (Output sinks)
   -> HTML / SQL / Shell / Filesystem / Log / Email

---

Attack Surface Mapping

              +-------------------------------------------+
              |         Application Attack Surface         |
              +-------------------------------------------+
                                  |
          +-----------------------+-----------------------+
          |                       |                       |
     +----v----+            +-----v-----+           +-----v-----+
     |  Input  |            | Processing|           |  Output   |
     +---------+            +-----------+           +-----------+
     | GET     |            | Input     |           | HTML page |
     | POST    |    ->      | validation|    ->     | JSON resp |
     | Cookie  |            | Biz logic |           | File DL   |
     | Headers |            | DB query  |           | Error msg |
     | File    |            | File op   |           | Log entry |
     | Upload  |            | Sys call  |           | Email     |
     +---------+            +-----------+           +-----------+

---

SQL Injection

**Cases:** 27,732 | **Reference:** [sql-injection.md]({baseDir}/references/sql-injection.md) | **Checklist:** [sql-injection-checklist.md]({baseDir}/references/checklists/sql-injection-checklist.md)

High-risk parameters: `id`, `sort_id`, `username`, `password`, `search`, `keyword`, `page`, `order`, `cat_id`

Injection point detection:

• String terminators: `' " ) ') ") -- # /*`
• DB fingerprint: `@@version` (MSSQL), `version()` (MySQL),

`v$version` (Oracle)

Bypass techniques:

• Whitespace: `/**/ %09 %0a ()`
• Keywords: `SeLeCt sel%00ect /*!select*/`
• Equals: `LIKE REGEXP BETWEEN IN`
• Quotes: `0x` hex, `char()`, `concat()`

Core defense: parameterized queries (PreparedStatement / ORM binding).

---

Cross-Site Scripting (XSS)

**Cases:** 7,532 | **Reference:** [xss.md]({baseDir}/references/xss.md) | **Checklist:** [xss-checklist.md]({baseDir}/references/checklists/xss-checklist.md)

Output points: user profile fields (nickname, bio), search reflections, file metadata (filename, alt text), email content (subject, body)

Bypass techniques:

• Tag mutation: `<ScRiPt> <script/x> <script\n>`
• Event handlers: `onerror onload onmouseover onfocus`
• Encoding: HTML entities, JS Unicode, URL encoding
• Protocol handlers: `javascript: data: vbscript:`

Core defense: context-aware output encoding + Content Security Policy.

---

Command Execution

**Cases:** 6,826 | **Reference:** [command-execution.md]({baseDir}/references/command-execution.md) | **Checklist:** [command-execution-checklist.md]({