Vulnerability Patterns Reference

Purpose

Provide comprehensive knowledge of common web vulnerability patterns for whitebox penetration testing. Understanding these patterns enables identification of security flaws during code review and guides exploitation techniques.

When to Use

Activate this skill when:

• Analyzing potential vulnerabilities found during sink search
• Understanding how specific vulnerability classes work
• Determining exploitability of identified code patterns
• Learning attack techniques for specific vulnerability types

OWASP Top 10 Overview

See owasp-2025 skill for complete mapping with CWE references.

Core Vulnerability Categories

SQL Injection (SQLi)

Pattern: User input concatenated into SQL queries

Indicators:

• String concatenation in query construction
• Template literals/f-strings in SQL
• Missing parameterized queries
• Raw/native query methods

Exploitation Flow:

1. Identify injection point
2. Determine database type
3. Test with basic payloads
4. Extract data or escalate

Risk Impact: Data breach, authentication bypass, RCE (in some cases)

Command Injection

Pattern: User input passed to system command functions

Indicators:

• Command execution functions with user data
• Shell metacharacters not filtered
• Insufficient input validation

Exploitation Flow:

1. Identify command execution sink
2. Trace user input to sink
3. Test command separators
4. Chain commands for exploitation

Risk Impact: Remote Code Execution, full system compromise

Cross-Site Scripting (XSS)

Types:

• Reflected: Input reflected in response
• Stored: Input persisted and displayed
• DOM-based: Client-side JavaScript manipulation

Indicators:

• User input in HTML output without encoding
• Dynamic HTML insertion with user data
• Missing output encoding

Risk Impact: Session hijacking, credential theft, malware distribution

Path Traversal / LFI

Pattern: User input in file path operations

Indicators:

• File inclusion with user-controlled path
• File read/write with user input
• Missing path validation

Exploitation Flow:

1. Identify file operation with user input
2. Test traversal sequences
3. Target sensitive files
4. Chain with other vulnerabilities

Risk Impact: Information disclosure, source code leak, potential RCE

Deserialization

Pattern: Untrusted data passed to deserialization functions

Indicators:

• Deserialization functions with user data
• User-controlled serialized data
• Missing type validation

Exploitation Flow:

1. Identify deserialization sink
2. Find gadget chains
3. Craft malicious payload
4. Achieve code execution

Risk Impact: Remote Code Execution

Server-Side Request Forgery (SSRF)

Pattern: User-controlled URLs in server-side requests

Indicators:

• HTTP client with user-provided URL
• URL validation bypass possibilities
• Internal network access

Exploitation Flow:

1. Identify HTTP request with user URL
2. Test internal endpoints
3. Bypass URL validation
4. Access internal services

Risk Impact: Internal network access, cloud metadata exposure

SSRF Exfiltration Vectors

When SSRF response is not directly returned to the attacker, consider these exfiltration methods:

Cache-Based Exfiltration Pattern (commonly missed):

1. SSRF makes request to /sensitive-endpoint.png
2. Proxy caches response (thinks it's static file)
3. Attacker requests /sensitive-endpoint.png
4. Gets cached sensitive data

See cache-poisoning skill for detailed detection patterns.

Template Injection (SSTI)

Pattern: User input rendered in server-side templates

Indicators:

• Template rendering with user-controlled template
• Template syntax in user input

Exploitation Flow:

1. Identify template rendering point
2. Test template syntax
3. Determine template engine
4. Escalate to RCE

Risk Impact: Remote Code Execution

Vulnerability Identification Framework

Step 1: Sink Identification

Use the dangerous-functions skill to find security-sensitive functions.

Step 2: Source Tracing

Use the data-flow-tracing skill to trace user input to sinks.

Step 3: Pattern Matching

Match code patterns against known vulnerability types.

Step 4: Exploitability Assessment

Consider filters, authentication, impact, and bypass potential.

Additional Resources

Reference Files

For detailed exploitation techniques:

• references/injection-attacks.md - SQLi, Command Injection, LDAP Injection
• references/deserialization-attacks.md - PHP, Java, Python, .NET gadgets
• references/access-control.md - IDOR, privilege escalation, authorization bypass
• references/auth-bypass.md - Authentication bypass, session attacks, JWT flaws
• references/race-conditions.md - TOCTOU, double-spend, concurrency vulnerabilities

Integration with Other Skills

• Use dangerous-functions to identify sinks
• Use data-flow-tracing to trace sources to sinks
• Use exploit-techniques to develop working PoC