# Exploitation

> RCE, SQLi, XSS, LFI, SSRF, XXE, JWT, file upload and more

- **URL:** https://hackindex.io/services/web/exploitation
- **Service:** [HTTP/HTTPS](https://hackindex.io/services/web.md)
- **Tags:** initial-access, execution
- **Published:** 2025-12-28
- **Updated:** 2026-03-29

Web exploitation takes confirmed vulnerabilities and turns them into impact. This covers the full range of web attacks: SQL injection (union, blind, error-based, time-based), cross-site scripting, server-side request forgery, server-side template injection, XXE, command injection, local and remote file inclusion, insecure deserialization, authentication bypass, and file upload abuse.

Each technique has its own tooling and methodology. sqlmap handles automated SQL injection, but manual union queries give you precision. SSTI payloads vary by template engine (Jinja2, Twig, Freemarker). XXE exploitation depends on parser behavior and whether out-of-band channels are available. File upload attacks chain with path traversal or webshell execution depending on server configuration.

The subpages walk through each vulnerability class from identification to achieving a shell, data access, or further pivot point into the target environment.

## Guides

- [Business Logic Exploitation](https://hackindex.io/services/web/exploitation/business-logic-exploitation.md): Exploit flaws in application workflow, authentication bypass, price manipulation, and privilege escalation by abusing intended business logic rather than technical vulnerabilities.
- [Clickjacking](https://hackindex.io/services/web/exploitation/clickjacking.md): Exploiting UI redress attacks by overlaying transparent iframes to hijack user clicks, steal credentials, or trigger unauthorized actions on vulnerable web applications.
- [Command Injection Exploitation](https://hackindex.io/services/web/exploitation/command-injection.md): Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, bypass techniques, and OS command execution through user-supplied input.
- [CORS Exploitation](https://hackindex.io/services/web/exploitation/cors-exploitation.md): Exploiting misconfigured CORS policies to bypass same-origin restrictions, steal credentials, and perform cross-origin requests using crafted malicious origins.
- [CRLF Injection](https://hackindex.io/services/web/exploitation/crlf-injection.md): Exploiting CRLF injection to manipulate HTTP headers, inject malicious responses, perform response splitting, and achieve session hijacking or XSS attacks.
- [CSRF Exploitation](https://hackindex.io/services/web/exploitation/csrf-exploitation.md): Exploit Cross-Site Request Forgery vulnerabilities to force authenticated users into executing unwanted actions via crafted malicious HTTP requests.
- [CVE-2025-54068 Livewire RCE Exploitation](https://hackindex.io/services/web/exploitation/cve-2025-54068-livewire-rce.md): Exploits CVE-2025-54068, a critical Livewire RCE vulnerability via malicious component payloads over HTTP/HTTPS to achieve remote code execution.
- [Directory Traversal](https://hackindex.io/services/web/exploitation/directory-traversal.md): Exploit path traversal vulnerabilities in web apps to access files outside the webroot using encoded sequences like ../to read sensitive system files.
- [DOM-Based XSS Exploitation](https://hackindex.io/services/web/exploitation/dom-based-xss-exploitation.md): Exploit client-side DOM vulnerabilities by injecting malicious scripts into unsafe sinks via tainted sources, bypassing server-side filters in web applications.
- [File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion.md): Exploit Local and Remote File Inclusion vulnerabilities in web apps to read sensitive files, achieve RCE, and bypass filters via path traversal and log poisoning.
  - [Command Injection Bypasses](https://hackindex.io/services/web/exploitation/file-inclusion/command-injection-bypasses.md): Techniques to bypass command injection filters and WAFs, including encoding, delimiter abuse, whitespace evasion, and chained payloads for OS command execution.
  - [File Upload Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/file-upload-exploitation.md): Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validation, and content checks to deploy web shells.
  - [LFI to Remote Code Execution](https://hackindex.io/services/web/exploitation/file-inclusion/lfi-to-remote-code-execution.md): Exploit Local File Inclusion vulnerabilities to achieve RCE via log poisoning, PHP wrappers, /proc/self/environ, and session file injection techniques.
  - [Local File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/local-file-inclusion-exploitation.md): Exploit LFI vulnerabilities to read sensitive files, achieve log poisoning, and escalate to RCE via path traversal and PHP wrapper abuse.
  - [Remote File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/remote-file-inclusion-exploitation.md)
- [Git Repository Exploitation](https://hackindex.io/services/web/exploitation/git-repository-exploitation.md): Exploit exposed .git directories to reconstruct source code, extract credentials, and uncover sensitive application logic from misconfigured web servers.
- [GraphQL Exploitation](https://hackindex.io/services/web/exploitation/graphql-exploitation.md): Exploit GraphQL APIs via introspection abuse, query batching, field stuffing, and injection attacks to extract data or escalate privileges.
- [Host Header Injection](https://hackindex.io/services/web/exploitation/host-header-injection.md): Exploiting misconfigured HTTP Host headers to manipulate web app logic, bypass access controls, poison caches, and trigger SSRF or password reset vulnerabilities.
- [HTTP Parameter Pollution](https://hackindex.io/services/web/exploitation/http-parameter-pollution.md): Exploiting duplicate HTTP parameters to bypass WAFs, override values, and manipulate backend logic through inconsistent multi-layer parameter parsing.
- [IDOR Exploitation](https://hackindex.io/services/web/exploitation/idor-exploitation.md): Exploit Insecure Direct Object Reference vulnerabilities by manipulating parameter values to access unauthorised resources via HTTP requests.
- [Insecure Deserialization](https://hackindex.io/services/web/exploitation/insecure-deserialization.md): Exploiting insecure deserialization over HTTP/HTTPS to achieve RCE, privilege escalation, or authentication bypass via crafted serialized payloads.
- [JavaScript for XSS](https://hackindex.io/services/web/exploitation/javascript-for-xss.md): Core JavaScript concepts for crafting XSS payloads: DOM manipulation, event handlers, data exfiltration, and bypassing input sanitisation filters.
- [JWT Exploitation](https://hackindex.io/services/web/exploitation/jwt-exploitation.md): Covers attacking JWT authentication flaws including signature bypass, algorithm confusion (none/RS256→HS256), weak secret cracking, and claim manipulation to escalate privileges.
- [Laravel Ignition Remote Code Execution - CVE-2021-3129](https://hackindex.io/services/web/exploitation/laravel-ignition-rce-cve-2021-3129.md): Exploiting CVE-2021-3129 in Laravel Ignition to achieve RCE via malicious log file deserialization through the debug mode endpoint.
- [NoSQL Injection](https://hackindex.io/services/web/exploitation/nosql-injection.md): Exploit NoSQL databases via malformed queries, operator abuse, and authentication bypass targeting MongoDB, CouchDB, and similar non-relational backends.
- [PHP Type Juggling](https://hackindex.io/services/web/exploitation/php-type-juggling.md): Exploiting PHP's loose type comparison operators to bypass authentication and logic checks via unexpected type coercion behaviours.
- [Prototype Pollution](https://hackindex.io/services/web/exploitation/prototype-pollution.md): Exploiting prototype pollution vulnerabilities in JavaScript to manipulate object inheritance chains via HTTP, enabling privilege escalation and remote code execution.
- [Race Condition Exploitation](https://hackindex.io/services/web/exploitation/race-condition-exploitation.md): Exploit time-of-check to time-of-use (TOCTOU) flaws in web apps via concurrent HTTP requests to bypass auth, duplicate transactions, or escalate privileges.
- [React2Shell - CVE-2025-55182 + CVE-2025-66478](https://hackindex.io/services/web/exploitation/react2shell-cve-2025-55182.md)
- [Reflected XSS Exploitation](https://hackindex.io/services/web/exploitation/reflected-xss-exploitation.md)
- [Bypassing Regex Restrictions](https://hackindex.io/services/web/exploitation/regex-restriction-bypass.md): Techniques to bypass regex-based input validation in web apps, including pattern manipulation, encoding tricks, and edge cases to exploit filtering weaknesses.
- [Source Code Review for Web Vulnerabilities](https://hackindex.io/services/web/exploitation/source-code-review-methodology.md): Manually auditing web application source code to identify exploitable vulnerabilities including SQLi, XSS, SSRF, and insecure deserialization during exploitation phase.
- [SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection.md): Exploit SQL injection vulnerabilities to extract data, bypass authentication, and escalate privileges through malicious query manipulation in web applications.
  - [Blind SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/blind-sqli.md)
  - [Database-Specific SQLi Syntax](https://hackindex.io/services/web/exploitation/sql-injection/database-specific-sqli-syntax.md): Covers database-specific SQL injection syntax variations across MySQL, MSSQL, Oracle, and PostgreSQL for crafting targeted exploitation payloads.
  - [Error-Based SQLi](https://hackindex.io/services/web/exploitation/sql-injection/error-based-sqli.md): Exploit SQL error messages to extract database information by injecting functions that force verbose errors revealing schema, tables, and data.
  - [SQLi to Remote Code Execution](https://hackindex.io/services/web/exploitation/sql-injection/sqli-to-rce.md): Leverage SQL injection vulnerabilities to achieve RCE via techniques like INTO OUTFILE, xp_cmdshell, or UDF injection on web-facing database services.
  - [sqlmap Usage Guide](https://hackindex.io/services/web/exploitation/sql-injection/sqlmap-usage.md): Automates SQL injection detection and exploitation against HTTP/HTTPS targets, covering tamper scripts, risk/level tuning, database enumeration, and data extraction techniques.
  - [Stacked Queries SQLi](https://hackindex.io/services/web/exploitation/sql-injection/stacked-queries-sqli.md): Leverage stacked query SQLi to execute multiple SQL statements in sequence, enabling data exfiltration, schema enumeration, and command execution via HTTP.
  - [Union-Based SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/union-based-sqli.md)
- [SSRF Exploitation](https://hackindex.io/services/web/exploitation/ssrf-exploitation.md)
- [SSTI Exploitation](https://hackindex.io/services/web/exploitation/ssti-exploitation.md): Exploit Server-Side Template Injection vulnerabilities to achieve RCE by identifying template engines, crafting payloads, and escaping sandbox restrictions.
- [Stored XSS Exploitation](https://hackindex.io/services/web/exploitation/stored-xss-exploitation.md): Exploit stored XSS vulnerabilities in web apps by injecting persistent malicious scripts into HTTP/HTTPS endpoints to hijack sessions, exfiltrate data, or compromise users.
- [Subdomain Takeover](https://hackindex.io/services/web/exploitation/subdomain-takeover.md): Exploit dangling DNS records pointing to unclaimed cloud/SaaS resources to hijack subdomains, serve malicious content, or steal session cookies.
- [Web Assessment Methodology](https://hackindex.io/services/web/exploitation/web-assessment-methodology.md): Techniques for exploiting web application vulnerabilities including authentication bypass, injection flaws, and logic errors targeting HTTP/HTTPS services.
- [WebDAV Exploitation](https://hackindex.io/services/web/exploitation/webdav-exploitation.md)
- [WordPress Exploitation](https://hackindex.io/services/web/exploitation/wordpress-exploitation.md): Covers exploiting WordPress vulnerabilities including plugin/theme CVEs, xmlrpc abuse, credential attacks, and achieving RCE via malicious plugin uploads.
- [XSS Filter Bypass](https://hackindex.io/services/web/exploitation/xss-filter-bypass.md): Techniques for bypassing client-side and server-side XSS filters using encoding, obfuscation, polyglots, and DOM manipulation to achieve script execution.
- [XXE Exploitation](https://hackindex.io/services/web/exploitation/xxe-exploitation.md): Exploit XML External Entity injection to read local files, perform SSRF, and achieve RCE via malicious DTD payloads in XML-parsing web applications.