Wa3r-OffSec-Kit - 🔐 Offensive security knowledge base — 50+ docs cov

项目说明

Waer's Cybersecurity Knowledge Base

🔴 MIRAGE — OffSec Engine (LIVE)

> The repo was just the blueprint.
> This is the weaponized .

<p align="center">
<a href="
<img src=" />
</a>
</p>

> 50+ documents · 20 technique deep dives · 10 attack workflows · 8 real-world case studies · Built from the field, not the textbook.

---

👤 Who Am I

I'm Waer (Abdelrahman) — a cybersecurity researcher and bug bounty hunter focused on web application security, cloud exploitation, and security automation.

This repository is my brain, exported. E here comes from hands-on experience: breaking into bug bounty targets, solving CTF challenges, completing APT lab simulations, and building my own security tooling. I don't write about attacks I've only read about — I write about attacks I', debugged, and reported.

Areas I work in:

🎯 Bug Bounty Hunting — web app recon, discovery, and responsible disclosure

🔐 Penetration Testing — web, API, cloud infrastructure, and CMS-specific testing

🏴 CTF Competitions — web exploitation, forensics, steganography, and crypto

🤖 Security Automation — custom recon tools, JS crawlers, and AI-powered security agents

☁️ Cloud Security — AWS exploitation, Spring Boot misconfigurations, metadata attacks

🕵️ APT Emulation — simulating real-world threat actors (Star Blizzard, breach)

📬 Get in touch:

📧 Email:

💼 LinkedIn: linkedin.com/in/wa3r

---

🔥 What's Inside

This isn't a wiki dump or a copy-paste of OWASP pages. Every document here follows a battle-tested structure: detect it → exploit it → escalate it → report it, with real payloads, real tool commands, and real decision trees.

| Section | Count | What you'll find |
|---------|-------|-----------------|
| methodology/ | 5 docs | Full workflows from recon to exploitation to pri escalation |
| techniques/ | 20 docs | Deep dives into every major web class with working payloads |
| scenarios/ | 10 docs | Step-by-step attack playbooks you can follow during li |
| case-studies/ | 8 docs | Real findings and APT simulations — anonymized but fully detailed |
| web-/ | 6 docs | Index pages grouping vulns by category with cross-references |
| tools/ | 4 docs | Tool catalogs, 90+ Google dorks, curated payload lists |
| forensics/ | 3 docs | In workflows, image forensics, steganography detection |

co: SQL Injection · XSS · SSRF · SSTI · XXE · Command Injection · IDOR · File Upload · JWT Attacks · CORS · Cache Poisoning · Prototype Pollution · Race Conditions · Mass Assignment · Open Redirect · Password Reset Abuse · Deserialization RCE · WordPress Hacking · Spring Boot Actuator · AiTM MFA Bypass

---

🎯 Who This Is For

🏴‍☠️ Bug Bounty Hunters

You'll find ready-to-use attack playbooks with exact payloads, WAF bypass techniques, and chaining patterns (XSS + CORS = ATO, Open Redirect + OAuth = token theft). The methodology docs cover the full lifecycle: target selection → recon → exploitation → escalation → reporting. No fluff — just what works.

🔓 Penetration Testers

The pri escalation checklist covers web, Linux, Windows, and AWS in one document. Technique docs include detection commands, exploitation steps, and filter bypass tables you can reference mid-engagement. Scenarios serve as step-by-step checklists during assessments.

🏁 CTF Players

Case studies include CTF write-ups for SSTI, XXE, DNS zone transfers, and S3 bucket misconfigurations. The forensics section covers JPEG/PNG steganography workflows, and the tools section has the exact analysis order for forensics challenges. The SSTI workflow includes a decision tree for fingerprinting template engines.

🧪 CTF Challenge Makers

Understand how attackers approach your challenges. The scenario docs reveal the thought process and decision trees players use — from initial detection probes to full exploitation chains. Use this to design better, more realistic challenges.

📚 Security Students & Researchers

Every technique doc is structured as a learning path: what the is → when it happens → how to find it → how to exploit it → how to escalate impact → what tools to use. Start with methodology, then go deep into any technique that interests you.

🛡️ Blue Team / Defenders

Each technique doc includes what to look for from the attacker's perspecti how attackers chain helps you build better detections, write better rules, and prioritize hardening efforts.

---

📂 Repository Structure

📋 methodology/

Processes and playbooks from recon to pri escalation:

Web Recon Methodology — 11-phase structured recon pipeline

Ja Endpoint Discovery — JS-focused recon with automated crawling

Bug Bounty Playbook — Program selection, recon-to-exploit flow, reporting tips

Exploitation Methodology — Systematic exploitation, impact escalation, and chaining

Pri Escalation Checklist — Web, Linux, Windows, and AWS cloud privesc

🎯 techniques/

20 technique-focused deep dives with working payloads:

SQL Injection — UNION, blind, time-based, OOB, WAF bypasses, SQLi→RCE

XSS Techniques and Payloads — Context-aware payloads, filter bypasses, WAF e

Command Injection — Operators, reverse shells, filter bypass techniques

SSRF (Ser Request Forgery) — Cloud metadata, protocol smuggling, DNS rebinding

Ser Template Injection — Engine fingerprinting, Jinja2/Twig/Freemarker RCE

XXE Injection — File read, SSRF, blind/OOB extraction

IDOR (Insecure Direct Object Reference) — Horizontal/ escalation, UUID techniques

JWT Attacks and Misconfigurations — Algorithm confusion, key injection, brute force

File Upload — Extension/magic byte bypasses, webshells, S

Race Conditions — Turbo Intruder, HTTP/2 single-packet, financial exploitation

CORS Misconfigurations — Origin reflection, null origin, subdomain trust abuse

Web Cache Poisoning — Unkeyed headers, cache deception

Password Reset Abuse — Token leakage, host header injection, email parameter pollution

Mass Assignment — Role injection, price manipulation

Client-Side Prototype Pollution — Source-gadget model, DOM XSS via PP

Ser Parameter Pollution — Query string and REST path injection

JSON Deserialization RCE — Ja, Node, PHP, .NET gadget chains

WordPress Hacking Methodology — XML-RPC, REST API, plugin/theme exploitation

Spring Boot Actuator Exploitation — Heap dump, en route injection

Open Redirect — Filter bypasses, OAuth/phishing/SSRF chaining

🔄 scenarios/

10 step-by-step attack workflows with decision trees:

SQL Injection Testing

File Upload to RCE

IDOR Discovery and Escalation

SSTI Detection and Exploitation

JWT Authentication Bypass

Race Condition Exploitation

Reflected XSS Testing

SSRF Pingback

Logic Flaw: Unauthorized Checkout

Spring Boot Actuator to Cloud Compromise

📖 case-studies/

Real findings and APT simulations — fully anonymized:

SSRF XML-RPC — Real bug bounty finding

Checkout Password Leak — Client-side auth bypass

WordPress REST API Enumeration — API surface mapping

SSTI to Database Access (CTF) — Flask/Jinja2 exploitation

XXE File Read (CTF) — Firmware update XML injection

DNS Zone Transfer & S3 Bucket (CTF) — Infrastructure misconfig

Spring Boot Actuator — Simulation — Heap dump → AWS → Secrets Manager

MFA Bypass via AiTM — Star Blizzard APT — Russian APT session cookie theft

🌐 web-/

Index pages grouping related content:

XSS · SSRF · Auth & Session Issues

Injection · Access Control & Logic · File Upload & Deserialization

🛠️ tools/

Recon Tools · Forensics Tools · Wordlists & Payloads · Google Dorking (90+ dorks)

🔍 forensics/

Forensics Workflow · JPEG Forensics · PNG Forensics

---

🗺️ How to Na

If you're new here

If you're mid-assessment

If you're solving a CTF

---

⚠️ Disclaimer

All case studies are fully anonymized — real target domains, IPs, credentials, and personally identifiable information have been removed or replaced with placeholders. This repository is intended for educational purposes and ethical security research only. Always obtain proper authorization before testing any system.

🤝 Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines on adding new techniques, case studies, or improving existing content.

📄 License

This project is licensed under the MIT License — see LICENSE for details.

---

<p align="center">
<b>Built by <a href=" ·
<a href="mailto:"></a> ·
<a href="
</p>

项目信息

开发语言：未知

Star 数：244

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🔐 Offensive security knowledge base — 50+ docs covering web exploitation, bug bounty, privilege escalation, CTF writeups, APT emulation, and forensics. Real payloads, real workflows, built from the field.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。