server-side

Files (50)

• SKILL.md
• INDEX.md · reference/
• file-upload-resources.md · reference/
• http-host-header-resources.md · reference/
• http-request-smuggling-resources.md · reference/
• insecure-deserialization-resources.md · reference/
• protocol-coercion.md · reference/
• dotnet-deserialization.md · reference/scenarios/deserialization/
• java-deserialization.md · reference/scenarios/deserialization/
• nodejs-deserialization.md · reference/scenarios/deserialization/
• php-deserialization.md · reference/scenarios/deserialization/
• python-and-ruby.md · reference/scenarios/deserialization/
• react-server-components-flight.md · reference/scenarios/deserialization/
• aspnet_viewstate_build.py · reference/scenarios/deserialization/tools/
• content-type-and-magic-bytes.md · reference/scenarios/file-upload/
• defense-evasion-and-yara.md · reference/scenarios/file-upload/
• extension-bypass.md · reference/scenarios/file-upload/
• ntfs-junction-write-redirect.md · reference/scenarios/file-upload/
• ntlm-hash-leak-via-media-upload.md · reference/scenarios/file-upload/
• path-traversal-and-htaccess.md · reference/scenarios/file-upload/
• polyglot-and-metadata-injection.md · reference/scenarios/file-upload/
• python-module-shadowing-via-so.md · reference/scenarios/file-upload/
• race-conditions.md · reference/scenarios/file-upload/
• web-shell-payloads.md · reference/scenarios/file-upload/
• auth-bypass-localhost.md · reference/scenarios/host-header/
• cache-poisoning-via-host.md · reference/scenarios/host-header/
• password-reset-poisoning.md · reference/scenarios/host-header/
• routing-ssrf-and-flawed-parsing.md · reference/scenarios/host-header/
• cl-te.md · reference/scenarios/http-smuggling/
• cl-zero-and-pause-based.md · reference/scenarios/http-smuggling/
• exploitation-patterns.md · reference/scenarios/http-smuggling/
• h2-downgrade.md · reference/scenarios/http-smuggling/
• te-cl.md · reference/scenarios/http-smuggling/
• te-te-obfuscation.md · reference/scenarios/http-smuggling/
• basic-payloads-and-encoding.md · reference/scenarios/path-traversal/
• filter-bypass-techniques.md · reference/scenarios/path-traversal/
• lfi-to-rce.md · reference/scenarios/path-traversal/
• nbconvert-jupyter-notebook.md · reference/scenarios/path-traversal/
• platform-specific.md · reference/scenarios/path-traversal/
• target-files.md · reference/scenarios/path-traversal/
• blind-detection-and-portscan.md · reference/scenarios/ssrf/
• cloud-metadata.md · reference/scenarios/ssrf/
• localhost-and-ip-bypass.md · reference/scenarios/ssrf/
• protocol-exploitation-gopher.md · reference/scenarios/ssrf/
• proxy-path-traversal.md · reference/scenarios/ssrf/
• redis-inline-via-header-name.md · reference/scenarios/ssrf/
• stored-connector-url-ssrf.md · reference/scenarios/ssrf/
• url-parser-and-allowlist-bypass.md · reference/scenarios/ssrf/
• utf8-binary-loss-limit.md · reference/scenarios/ssrf/
• server-side-principles.md · reference/

SKILL.md (first lines)

# Server-Side

Test for server-side vulnerabilities that allow unauthorized access, RCE, or data exfiltration.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **SSRF** | Internal service access, cloud metadata, protocol smuggling |
| **HTTP Smuggling** | CL.TE, TE.CL, TE.TE, CL.0, H2.CL, h2c, multi-layer proxy chains, connection pooling desync |
| **Path Traversal** | Directory traversal, null bytes, encoding bypass |
| **File Upload** | Extension bypass, content-type manipulation, polyglot files |
| **Deserialization** | Java, PHP, Python, .NET gadget chains |
| **Host Header** | Password reset poisoning, cache poisoning, routing-based SSRF |
| **CUPS / cups-browsed** | CVE-2024-47076/47175/47176/47177 — UDP browse → IPP injection → PPD injection → foomatic-rip RCE (see `skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md`) |

## Workflow

1. Identify server-side processing points
2. Test for vulnerability class indicators
3. Bypass protections (WAF, allowlists, encoding filters)
4. Demonstrate impact (file read, RCE, internal access)
5. Capture evidence with PoC

## Reference

- `reference/scenarios/ssrf/*.md` - SSRF techniques and labs
- `reference/http-request-smuggling*.md` - Smuggling techniques
- `reference/scenarios/path-traversal/*.md` - Path traversal bypass methods
- `reference/file-upload*.md` - File upload exploitation
- `reference/insecure-deserialization*.md` - Deserialization attacks
- `reference/http-host-header*.md` - Host header injection
- `skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md` - CUPS RCE chain (CVE-2024-47076/175/176/177); ipptool false positives vs libcups runtime parser; ippserver Python lib version-1.1 hardcode bug

From transilienceai/communitytools, MIT.

More from transilienceai/communitytools