esi-injection

What problem does it solve?

Application-level security controls like web application firewalls cannot detect or block ESI and SSI injection attacks, as these tags are processed by CDN or cache layers before reaching the target application. This Skill enables security testers to exploit this gap to bypass defenses and achieve impact such as cross-site scripting, session cookie theft, and server-side request forgery.

Core Features & Use Cases

• ESI/SSI Detection: Identify vulnerable targets via response headers, file extensions, blind injection tests, and out-of-band callback checks.
• Multi-Vector Exploitation: Construct payloads for XSS (with WAF bypass techniques), HttpOnly cookie theft, SSRF to internal services, header injection, and chaining with XSLT injection for XXE escalation.
• Software-Specific Guidance: Includes capability matrices for common ESI processors (Squid, Varnish, Fastly, Akamai) to tailor payloads to the target's cache layer.
• Use Case: A red teamer testing an e-commerce application behind Akamai can use this Skill to confirm ESI processing, then exfiltrate admin session cookies to an attacker-controlled server via an ESI include tag.

Quick Start

Use the esi-injection skill to test if the target web app behind its CDN processes ESI tags and exfiltrate session cookies to your external callback server.