Gadgets

Gadgets index

• Open redirect - Low alone. High when it leaks an OAuth code, a session token, or feeds a server-side fetch.
• CORS reflection - Worthless with ACAO: * and no credentials. Dangerous when ACAO reflects Origin AND ACAC: true on an authenticated API.
• postMessage wildcard - Listener with origin '*' or a weak startsWith check plus a DOM / auth sink is a classic SPA gadget.
• Unkeyed header / cache key - If a header changes the response but is not in the cache key, you poison everyone who shares that key.
• Debug / actuator / env endpoint - Information leak alone is P4. Env with cloud keys, heap dumps, or gateway routes is a foothold.
• Leaked token in URL, JS, or Referer - A password-reset or OAuth token in a URL is an ATO gadget if it is reusable, long-lived, or logged.
• IDOR parameter - The param is inventory until you prove a second user can read or write the object.
• DOM sink (innerHTML / html() / v-html) - A sink without a source is inventory. A sink plus any attacker-controlled source is XSS.
• JSONP / callback parameter - Legacy JSONP with a reflected callback and cookies is an XSS/CORS-bypass gadget on old APIs.
• Framable authenticated page - Usually P5. Becomes real when a sensitive state-changing UI is framable (disable 2FA, OAuth approve, delete, wire).
• Cookie on parent domain - A session cookie scoped to .target.com is an XSS-to-ATO gadget from any sibling subdomain you can script.
• Public source map - Almost never paid alone. It is how you find hidden endpoints, feature flags, and the real sinks.
• Prototype pollution gadget - Pollution without a gadget is often P4/informational. Pollution plus a sink (innerHTML, template, fetch URL, child_process) is the bug.
• WebSocket IDOR / missing auth - Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
• Host header / password reset poisoning - If the Host (or X-Forwarded-Host) is copied into a reset email, you steal accounts. If it is copied into asset URLs and cached, you poison the cache.
• CRLF / header injection - Set-Cookie, Location, or a second response on a shared connection. Often a cache or XSS gadget, not a standalone RCE.
• OAuth redirect_uri mismatch - A loose redirect_uri is an ATO gadget. This is one of the highest-converting chains on SSO-heavy programs.
• JWT algorithm / key confusion - alg=none, RS-to-HS confusion, kid pointing at a file or a JWK URL you control, or a wildcard jku.
• Server-side URL fetch (unfurl / PDF / image / webhook) - Any feature that fetches a user-supplied URL is an SSRF gadget. Impact is where it can go (metadata, internal admin, file://).
• File upload gadget - XSS if it is served as HTML/SVG from a cookie domain. RCE if the server parses it (ImageMagick, LibreOffice, FFMpeg, unzip). ATO if it overwrites an avatar consumed as HTML.
• Race / limit overrun - Coupon once, gift-card drain, extra votes, extra MFA tries, extra password-reset, extra invitations.
• Mass assignment / extra JSON field - role, isAdmin, verified, balance, price, tenantId, twoFactorEnabled in a request the client never sends.
• Weak CSP / missing nonce - CSP is not a vuln. A weak CSP is a gadget that turns a hard XSS into a working one.
• Well-known / security.txt / OIDC discovery - Recon only, unless a key or an admin panel is sitting there.
• Email / SMS parser confusion - Register victim@target.com as victim@target.com@attacker.com, or use unicode dots, or plus-tags, depending on what the IdP vs the app vs the mailer treat as the same mailbox.