wooyun-legacy

What this skill does

# WooYun Vulnerability Analysis Knowledge Base

Methodology and testing patterns extracted from 88,636 real-world
vulnerability cases reported to the WooYun platform (2010-2016).

---

## When to Use

> All testing described here must be performed only against systems you
> have written authorization to test.

- Penetration testing web applications
- Security code review (server-side or client-side)
- Vulnerability research against web targets you have explicit authorization to test
- Building security test cases or checklists
- Assessing web application attack surface
- Reviewing remediation effectiveness
- Training or education in authorized security testing contexts

## When NOT to Use

- Network infrastructure testing (firewalls, routers, switches)
- Mobile application binary analysis
- Malware analysis or reverse engineering
- Compliance-only assessments (PCI-DSS, SOC2 checklists without testing)
- Physical security assessments
- Social engineering campaigns
- Cloud infrastructure misconfigurations (IAM, S3 buckets) — these
  require cloud-specific tooling, not web vuln patterns

## Rationalizations to Reject

These shortcuts lead to missed findings. Reject them:

- "The WAF will catch it" — WAFs are bypass-able; test the application
  logic, not the middleware
- "It's an internal app, so auth doesn't matter" — internal apps get
  compromised via SSRF, lateral movement, and credential reuse
- "We already use parameterized queries everywhere" — check for ORM
  misuse, stored procedures with dynamic SQL, and second-order injection
- "The framework handles XSS" — template engines have raw output modes,
  JavaScript contexts bypass HTML encoding, and DOM XSS lives
  entirely client-side
- "File uploads are safe because we check the extension" — extension
  checks are bypassed via null bytes, double extensions, parser
  discrepancies, and race conditions
- "We validate on the frontend" — client-side validation is a UX
  feature, not a security control
- "Nobody would guess that URL" — security through obscurity fails
  against directory bruteforcing, referrer leaks, and JS source analysis
- "Low severity, not worth reporting" — low-severity findings chain
  into critical attack paths

---

## Core Mental Model

```
Vulnerability = Expected Behavior - Actual Behavior
             = Developer Assumptions + Attacker Input -> Unexpected State

Analysis chain:
1. Where does data come from?  (Input sources)
   -> GET/POST/Cookie/Header/File/WebSocket
2. Where does data flow?       (Data path)
   -> Validation -> Processing -> Storage -> Output
3. Where is data trusted?      (Trust boundaries)
   -> Client / Server / Database / OS / External service
4. How is data processed?      (Processing logic)
   -> Filter / Escape / Validate / Execute
5. Where does data end up?     (Output sinks)
   -> HTML / SQL / Shell / Filesystem / Log / Email
```

---

## Attack Surface Mapping

```
              +-------------------------------------------+
              |         Application Attack Surface         |
              +-------------------------------------------+
                                  |
          +-----------------------+-----------------------+
          |                       |                       |
     +----v----+            +-----v-----+           +-----v-----+
     |  Input  |            | Processing|           |  Output   |
     +---------+            +-----------+           +-----------+
     | GET     |            | Input     |           | HTML page |
     | POST    |    ->      | validation|    ->     | JSON resp |
     | Cookie  |            | Biz logic |           | File DL   |
     | Headers |            | DB query  |           | Error msg |
     | File    |            | File op   |           | Log entry |
     | Upload  |            | Sys call  |           | Email     |
     +---------+            +-----------+           +-----------+
```

---

## SQL Injection

**Cases:** 27,732 | **Reference:** [sql-injection.md]({baseDir}/references/sql-injection.md)
| **Checklist:** [sql-injection-checklist.md]({baseDir}/references/checklists/sql-injection-checklist.md)

High-risk parameters: `id`, `sort_id`, `username`, `password`, `search`,
`keyword`, `page`, `order`, `cat_id`

Injection point detection:
- String terminators: `'  "  )  ')  ")  --  #  /*`
- DB fingerprint: `@@version` (MSSQL), `version()` (MySQL),
  `v$version` (Oracle)

Bypass techniques:
- Whitespace: `/**/  %09  %0a  ()`
- Keywords: `SeLeCt  sel%00ect  /*!select*/`
- Equals: `LIKE  REGEXP  BETWEEN  IN`
- Quotes: `0x` hex, `char()`, `concat()`

Core defense: parameterized queries (PreparedStatement / ORM binding).

---

## Cross-Site Scripting (XSS)

**Cases:** 7,532 | **Reference:** [xss.md]({baseDir}/references/xss.md)
| **Checklist:** [xss-checklist.md]({baseDir}/references/checklists/xss-checklist.md)

Output points: user profile fields (nickname, bio), search reflections,
file metadata (filename, alt text), email content (subject, body)

Bypass techniques:
- Tag mutation: `<ScRiPt>  <script/x>  <script\n>`
- Event handlers: `onerror  onload  onmouseover  onfocus`
- Encoding: HTML entities, JS Unicode, URL encoding
- Protocol handlers: `javascript:  data:  vbscript:`

Core defense: context-aware output encoding + Content Security Policy.

---

## Command Execution

**Cases:** 6,826 | **Reference:** [command-execution.md]({baseDir}/references/command-execution.md)
| **Checklist:** [command-execution-checklist.md]({baseDir}/references/checklists/command-execution-checklist.md)

Entry points: system command wrappers (ping, traceroute, nslookup),
file operations (compress, decompress, image processing), code eval
(`eval`, `assert`, `preg_replace(/e)`), framework vulnerabilities
(Struts2, WebLogic, JBoss)

Command chaining:
- Linux: `;  |  ||  &&  \`  $()`
- Windows: `&  |  ||  &&`

Bypass techniques:
- Whitespace: `${IFS}  $IFS$9  %09  <  <>`
- Keywords: `ca\t  ca''t  c$@at  /???/??t`
- Encoding: `$(printf "\x63\x61\x74")`,
  `` `echo Y2F0|base64 -d` ``

Core defense: avoid shell invocation; use `execFile` over `exec`,
allowlist acceptable inputs.

---

## File Upload

**Cases:** 2,711 | **Reference:** [file-upload.md]({baseDir}/references/file-upload.md)
| **Checklist:** [file-upload-checklist.md]({baseDir}/references/checklists/file-upload-checklist.md)

Bypass detection:
- Client-side validation: modify JS or send request directly
- Content-Type: `image/gif` header + PHP code body
- Extension: `.php5  .phtml  .pht  .php.  .php::$DATA`
- Content inspection: `GIF89a` + `<?php` or image-based webshell
- Parser discrepancy: `/upload/1.asp;.jpg` (IIS 6.0)

Parser-specific vulnerabilities:
- IIS 6.0: `/test.asp/1.jpg`, `test.asp;.jpg`
- Apache: `.php.xxx` (unknown extension fallback)
- Nginx: `/1.jpg/1.php` (`cgi.fix_pathinfo`)
- Tomcat: `test.jsp%00.jpg`

Core defense: allowlist extensions, rename uploads, store outside
webroot, validate content type server-side.

---

## Path Traversal

**Cases:** 2,854 | **Reference:** [path-traversal.md]({baseDir}/references/path-traversal.md)
| **Checklist:** [path-traversal-checklist.md]({baseDir}/references/checklists/path-traversal-checklist.md)

High-risk parameters: `file`, `path`, `filename`, `url`, `dir`,
`template`, `page`, `include`, `download`

Traversal payloads:
- Basic: `../../../etc/passwd`
- Encoded: `%2e%2e%2f`, `..%252f`, `%c0%ae%c0%ae/`
- Null byte: `../../../etc/passwd%00.jpg`
- Windows: `..\..\..\windows\win.ini`

Target files (Linux): `/etc/passwd`, `/etc/shadow`,
`/proc/self/environ`, `/var/log/apache2/access.log`

Core defense: resolve canonical paths, validate against allowlisted
directories, never use user input in file paths directly.

---

## Unauthorized Access

**Cases:** 14,377 | **Reference:** [unauthorized-access.md]({baseDir}/references/unauthorized-access.md)
| **Checklist:** [unauthorized-access-checklist.md]({baseDir}/references/checklists/unauthorized-access-checklist.md)

Access types:
- Admin panel expos