webapps attack methods

This list below fits in category Parameter manipulation Arbitary File Deletion Code Execution Cookie Manipulation ( meta http-equiv & crlf injection ) CRLF Injection ( HTTP response splitting ) Cross Frame Scripting ( XFS ) Cross-Site Scripting ( XSS ) Directory traversal Email Injection File inclusion Full path disclosure LDAP Injection PHP code injection PHP curl_exec() url is controlled by user PHP invalid data type error message PHP preg_replace used on user input PHP unserialize() used...

webapps attack methods

This list below fits in category Parameter manipulation Arbitary File Deletion Code Execution Cookie Manipulation ( meta http-equiv & crlf injection ) CRLF Injection ( HTTP response splitting ) Cross Frame Scripting ( XFS ) Cross-Site Scripting ( XSS ) Directory traversal Email Injection File inclusion Full path disclosure LDAP Injection PHP code injection PHP curl_exec() url is controlled by user PHP invalid data type error message PHP preg_replace used on user input PHP unserialize() used...

tamper scripts sqlmap

Tamper scripts modify the request and bypass WAF (Web Application Firewall) rules.REFER  https://github.com/sqlmapproject/sqlmap/tree/master/tamper USAGE You can check valid and usable tamper scripts in the tamper/ directory. Example against a MySQL target assuming that > character, spaces and capital SELECT string are banned: $ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \ tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3 [hh:mm:03]...