Gadgets

Gadgets index

• Open redirect - Low alone. High when it leaks an OAuth code, a session token, or feeds a server-side fetch.
• CORS reflection - Worthless with ACAO: * and no credentials. Dangerous when ACAO reflects Origin AND ACAC: true on an authenticated API.
• postMessage wildcard - Listener with origin '*' or a weak startsWith check plus a DOM / auth sink is a classic SPA gadget.
• Unkeyed header / cache key - If a header changes the response but is not in the cache key, you poison everyone who shares that key.
• Debug / actuator / env endpoint - Information leak alone is P4. Env with cloud keys, heap dumps, or gateway routes is a foothold.
• Leaked token in URL, JS, or Referer - A password-reset or OAuth token in a URL is an ATO gadget if it is reusable, long-lived, or logged.
• IDOR parameter - The param is inventory until you prove a second user can read or write the object.
• DOM sink (innerHTML / html() / v-html) - A sink without a source is inventory. A sink plus any attacker-controlled source is XSS.
• JSONP / callback parameter - Legacy JSONP with a reflected callback and cookies is an XSS/CORS-bypass gadget on old APIs.
• Framable authenticated page - Usually P5. Becomes real when a sensitive state-changing UI is framable (disable 2FA, OAuth approve, delete, wire).
• Cookie on parent domain - A session cookie scoped to .target.com is an XSS-to-ATO gadget from any sibling subdomain you can script.
• Public source map - Almost never paid alone. It is how you find hidden endpoints, feature flags, and the real sinks.
• Prototype pollution gadget - Pollution without a gadget is often P4/informational. Pollution plus a sink (innerHTML, template, fetch URL, child_process) is the bug.
• WebSocket IDOR / missing auth - Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
• Host header / password reset poisoning - If the Host (or X-Forwarded-Host) is copied into a reset email, you steal accounts. If it is copied into asset URLs and cached, you poison the cache.
• CRLF / header injection - Set-Cookie, Location, or a second response on a shared connection. Often a cache or XSS gadget, not a standalone RCE.
• OAuth redirect_uri mismatch - A loose redirect_uri is an ATO gadget. This is one of the highest-converting chains on SSO-heavy programs.
• JWT algorithm / key confusion - alg=none, RS-to-HS confusion, kid pointing at a file or a JWK URL you control, or a wildcard jku.
• Server-side URL fetch (unfurl / PDF / image / webhook) - Any feature that fetches a user-supplied URL is an SSRF gadget. Impact is where it can go (metadata, internal admin, file://).
• File upload gadget - XSS if it is served as HTML/SVG from a cookie domain. RCE if the server parses it (ImageMagick, LibreOffice, FFMpeg, unzip). ATO if it overwrites an avatar consumed as HTML.
• Race / limit overrun - Coupon once, gift-card drain, extra votes, extra MFA tries, extra password-reset, extra invitations.
• Mass assignment / extra JSON field - role, isAdmin, verified, balance, price, tenantId, twoFactorEnabled in a request the client never sends.
• Weak CSP / missing nonce - CSP is not a vuln. A weak CSP is a gadget that turns a hard XSS into a working one.
• Well-known / security.txt / OIDC discovery - Recon only, unless a key or an admin panel is sitting there.
• Email / SMS parser confusion - Register victim@target.com as victim@target.com@attacker.com, or use unicode dots, or plus-tags, depending on what the IdP vs the app vs the mailer treat as the same mailbox.
• CSRF without a real origin check - State-changing cookie-auth requests that accept a cross-site POST become account or billing actions. JSON plus a missing CORS preflight is the modern shape.
• Server-side template evaluation - A reflection that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with a harmless arithmetic or unique marker first.
• XML external entity / DTD fetch - A parser that loads a DTD from a URL you control is at least SSRF. File read and billion-laughs are extra, not the first proof.
• GraphQL node(id) / alias batch - Relay-style node(id) and aliased batch queries skip the UI's object graph. Same as IDOR, with a nicer query language.
• HTTP request smuggling desync - Front-end and origin disagree on Content-Length vs Transfer-Encoding. That desync is a request queue gadget, not a party trick.
• SAML ACS / recipient confusion - If the SP accepts an assertion meant for another ACS, or does not bind Recipient / Audience / Destination, you mint a session.
• DOM clobbering named element - HTML with id/name that shadows a JS global turns a sanitizer or URL check into attacker-controlled data. Often the missing piece in a DOM XSS chain.
• TOCTOU / last-write race - Limit, coupon, MFA, balance, or unique-constraint checks that are check-then-act without a transaction. HTTP/2 single-packet makes this cheap.
• Passkey recovery skips WebAuthn - Low alone, and it becomes account takeover when a recovery path issues a full session even though primary login requires a passkey.
• OAuth mix-up across authorization servers - Low alone when the app has one identity provider, and it becomes code theft or account linking when the client does not bind the response to the issuer that started the request.
• DPoP sender constraint dropped - Low alone if the access token never leaves the client, and it becomes replay of a stolen token when the resource server accepts it without a DPoP proof.
• Tenant id trusted by an export - Low alone when the worker re-checks membership, and it becomes a cross-tenant data leak when the export trusts a client-supplied tenant id.
• Web cache deception via path confusion - Low alone if the cache never stores the private body, and it becomes disclosure when a personalized response is saved under a URL the cache treats as static.
• Cookie scoped to the parent domain - Low alone, and it becomes account takeover when any sibling host can receive that cookie or write a shadowing one.
• Partitioned cookie gap - Low alone while the browser blocks the cross-site send, and it becomes session confusion when an embed still receives an unpartitioned cookie or the server trusts the wrong jar.
• Refresh token survives logout - Low alone when the refresh token is short-lived and device-bound, and it becomes a session that outlives logout when refresh still mints a new access token.
• pull_request_target checks out pull request code - Low alone when the workflow does not run pull request code, and it becomes exposure of secrets or a repository write when pull_request_target checks out that code and runs it with base-repository privileges.
• MCP token wider than the tool - Low alone when the token can only do what that user already can, and it becomes cross-tool or cross-tenant access when every tool accepts a wider credential.
• RAG chunk from another tenant - Low alone when the index holds only public text, and it becomes cross-tenant disclosure when another tenant's chunk is retrieved into a context you are allowed to see.
• App link host claim - Low alone when the link only opens the app, and it becomes token theft when a claimed host or an unverified scheme carries an auth callback.
• Persisted query allowlist bypass - Low alone when unknown hashes are rejected, and it becomes a hidden operation when the server accepts a query document that was not in the trusted set.
• Webhook signature is optional - Low alone when the URL is unguessable and unsigned calls are rejected, and it becomes a forged event when the handler trusts the body without a required signature.
• Archive entry escapes the extract root - Low alone when the product only lists entry names, and it becomes a file overwrite or a later read when an entry resolves outside the extract root.
• Feature flag hides a live route - Low alone when the handler still checks role, and it becomes broken access control when the flag is the only gate or it fails open.