Vulnerability Patterns

# Vulnerability Patterns Reference

## Purpose

Provide comprehensive knowledge of common web vulnerability patterns for whitebox penetration testing. Understanding these patterns enables identification of security flaws during code review and guides exploitation techniques.

## When to Use

Activate this skill when:
- Analyzing potential vulnerabilities found during sink search
- Understanding how specific vulnerability classes work
- Determining exploitability of identified code patterns
- Learning attack techniques for specific vulnerability types

## OWASP Top 10 Overview

| Rank | Category | Code Indicators | Related Skill |
|------|----------|-----------------|---------------|
| A01 | Broken Access Control | Missing auth checks, IDOR patterns | `business-logic` |
| A02 | Cryptographic Failures | Weak algorithms, hardcoded keys | `cryptographic-failures` |
| A03 | Injection | User input in queries/commands | `vuln-patterns` (this skill) |
| A04 | Insecure Design | Logic flaws, missing controls | `business-logic` |
| A05 | Security Misconfiguration | Debug enabled, default creds | `security-misconfiguration` |
| A06 | Vulnerable and Outdated Components | Dependency vulns, build pipeline | *(out of scope)* |
| A07 | Identification and Authentication Failures | Weak session, credential issues | `vuln-patterns` (this skill) |
| A08 | Software and Data Integrity Failures | Deserialization, CI/CD issues | `vuln-patterns` (this skill) |
| A09 | Security Logging and Monitoring Failures | Missing logs, log injection | `logging-failures` |
| A10 | Server-Side Request Forgery | Attacker-controlled outbound fetches | `vulnerability-chains`, `framework-patterns` |

See `owasp-2025` skill for complete mapping with CWE references.

## Core Vulnerability Categories

### SQL Injection (SQLi)

**Pattern**: User input concatenated into SQL queries

**Indicators**:
- String concatenation in query construction
- Template literals/f-strings in SQL
- Missing parameterized queries
- Raw/native query methods

**Exploitation Flow**:
1. Identify injection point
2. Determine database type
3. Test with basic payloads
4. Extract data or escalate

**Risk Impact**: Data breach, authentication bypass, RCE (in some cases)

### Command Injection

**Pattern**: User input passed to system command functions

**Indicators**:
- Command execution functions with user data
- Shell metacharacters not filtered
- Insufficient input validation

**Exploitation Flow**:
1. Identify command execution sink
2. Trace user input to sink
3. Test command separators
4. Chain commands for exploitation

**Risk Impact**: Remote Code Execution, full system compromise

### Cross-Site Scripting (XSS)

**Types**:
- Reflected: Input reflected in response
- Stored: Input persisted and displayed
- DOM-based: Client-side JavaScript manipulation

**Indicators**:
- User input in HTML output without encoding
- Dynamic HTML insertion with user data
- Missing output encoding

**Risk Impact**: Session hijacking, credential theft, malware distribution

### Path Traversal / LFI

**Pattern**: User input in file path operations

**Indicators**:
- File inclusion with user-controlled path
- File read/write with user input
- Missing path validation

**Exploitation Flow**:
1. Identify file operation with user input
2. Test traversal sequences
3. Target sensitive files
4. Chain with other vulnerabilities

**Risk Impact**: Information disclosure, source code leak, potential RCE

### Deserialization

**Pattern**: Untrusted data passed to deserialization functions

**Indicators**:
- Deserialization functions with user data
- User-controlled serialized data
- Missing type validation

**Exploitation Flow**:
1. Identify deserialization sink
2. Find gadget chains
3. Craft malicious payload
4. Achieve code execution

**Risk Impact**: Remote Code Execution

### Server-Side Request Forgery (SSRF)

**Pattern**: User-controlled URLs in server-side requests

**Indicators**:
- HTTP client with user-provided URL
- URL validation bypass possibilities
- Internal network access

**Exploitation Flow**:
1. Identify HTTP request with user URL
2. Test internal endpoints
3. Bypass URL validation
4. Access internal services

**Risk Impact**: Internal network access, cloud metadata exposure

#### SSRF Exfiltration Vectors

When SSRF response is not directly returned to the attacker, consider these exfiltration methods:

| Vector | How It Works | Detection |
|--------|--------------|-----------|
| **External Callback** | SSRF visits attacker-controlled URL with data | Check if outbound requests are allowed |
| **DNS Exfiltration** | Data encoded in subdomain (e.g., `secret.evil.com`) | Works even with firewall restrictions |
| **Cache Poisoning** | Response cached, retrieved later by attacker | Check proxy cache config for static extensions |
| **Error-Based** | Error messages leak response data | Check error handling and logging |
| **Timing/Blind** | Response time reveals information | Measure response latency variations |
| **File Write** | Write response to accessible location | Check for file write primitives |

**Cache-Based Exfiltration Pattern** (commonly missed):
```
1. SSRF makes request to /sensitive-endpoint.png
2. Proxy caches response (thinks it's static file)
3. Attacker requests /sensitive-endpoint.png
4. Gets cached sensitive data
```

See `cache-poisoning` skill for detailed detection patterns.

### Template Injection (SSTI)

**Pattern**: User input rendered in server-side templates

**Indicators**:
- Template rendering with user-controlled template
- Template syntax in user input

**Exploitation Flow**:
1. Identify template rendering point
2. Test template syntax
3. Determine template engine
4. Escalate to RCE

**Risk Impact**: Remote Code Execution

## Vulnerability Identification Framework

### Step 1: Sink Identification
Use the dangerous-functions skill to find security-sensitive functions.

### Step 2: Source Tracing
Use the data-flow-tracing skill to trace user input to sinks.

### Step 3: Pattern Matching
Match code patterns against known vulnerability types.

### Step 4: Exploitability Assessment
Consider filters, authentication, impact, and bypass potential.

## Additional Resources

### Reference Files

For detailed exploitation techniques:
- **`references/injection-attacks.md`** - SQLi, Command Injection, LDAP Injection
- **`references/deserialization-attacks.md`** - PHP, Java, Python, .NET gadgets
- **`references/access-control.md`** - IDOR, privilege escalation, authorization bypass
- **`references/auth-bypass.md`** - Authentication bypass, session attacks, JWT flaws
- **`references/race-conditions.md`** - TOCTOU, double-spend, concurrency vulnerabilities

### Integration with Other Skills

- Use **dangerous-functions** to identify sinks
- Use **data-flow-tracing** to trace sources to sinks
- Use **exploit-techniques** to develop working PoC