Common Web Application Attacks

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark Directory Traversal Detection as done
  Guide 7 min read

  Directory Traversal Detection

  Focus on #Identifying Suggestive Parameters #Relative Path Traversal #Absolute Path Traversal #Filter Bypass Techniques #OS-Specific Targets
• Mark Directory Traversal as done
  Guide 5 min read

  Directory Traversal

  Focus on #Relative Path Traversal #Common Target Files #Bypass Techniques #URL Encoding #Nested Traversal Sequences #Null Byte Truncation #Fuzzing with Wfuzz
• Mark HTTP File Inclusion Fuzzing as done
  Guide 5 min read

  HTTP File Inclusion Fuzzing

  Focus on #Fuzz Common LFI Paths #Fuzz PHP File Names #Fuzz Log and Config Files #Automated LFI Scanning
• Mark Local File Inclusion Exploitation as done
  Guide 2 min read

  Local File Inclusion Exploitation

  Focus on #Basic Path Traversal #PHP Filter Wrapper for Source Disclosure #High-Value File Targets #Filter Bypass Techniques
• Mark Remote File Inclusion Exploitation as done
  Guide 3 min read

  Remote File Inclusion Exploitation

  Focus on #Confirm RFI is Active #Deploy a Web Shell #Get a Reverse Shell #Filter Bypasses
• Mark LFI to Remote Code Execution as done
  Guide 4 min read

  LFI to Remote Code Execution

  Focus on #LFI to RCE via Log Poisoning #PHP Session File Injection #PHP Stream Wrappers #Reverse Shell Delivery
• Mark File Upload Validation Testing as done
  Guide 5 min read

  File Upload Validation Testing

  Focus on #Extension Bypass #Content-Type Spoofing #Magic Byte Bypass #Null Byte Bypass
• Mark File Upload Exploitation as done
  Guide 4 min read

  File Upload Exploitation

  Focus on #Deliver the Web Shell #Locate the Upload Path #ASPX Web Shell for IIS Targets #.htaccess Upload #Polyglot Files
• Mark Command Injection Detection as done
  Guide 4 min read

  Command Injection Detection

  Focus on #Time-Based Command Injection Detection #Out-of-Band Detection #In-Band Detection #POST Parameter and Header Testing #Windows Command Injection
• Mark Command Injection Exploitation as done
  Guide 7 min read

  Command Injection Exploitation

  Focus on #Confirming Execution #Choosing a Reverse Shell #No Outbound TCP #Blind Command Injection to Interactive
• Mark Command Injection Bypasses as done
  Guide 2 min read

  Command Injection Bypasses

  Focus on #Space Bypass #Slash Bypass #Command Injection Filter Bypass for Keyword Blacklists #Base64 Encoding #Windows Bypass Techniques
• Mark Reflected XSS Checks as done
  Guide 5 min read

  Reflected XSS Checks

  Focus on #Confirm Reflection First #Check the Injection Context #Test a Basic Payload #Check for CSP #Automated Scanning with dalfox
• Mark Reflected XSS Exploitation as done
  Guide 5 min read

  Reflected XSS Exploitation

  Focus on #Cookie Theft #Session Hijacking #HttpOnly Cookie Bypass via XHR #Credential Capture via Fake Login Form
• Mark Stored XSS Checks as done
  Guide 5 min read

  Stored XSS Checks

  Focus on #Identify Storage Points #Inject a Unique Marker #Test HTML Injection and Script Execution #Blind XSS
• Mark Stored XSS Exploitation as done
  Guide 9 min read

  Stored XSS Exploitation

  Focus on #Cookie Theft Payload #Fetch-Based Exfiltration #Keylogger Payload #CSP Bypass via JSONP #Chaining XSS with CSRF
• Mark DOM-Based XSS Checks as done
  Guide 6 min read

  DOM-Based XSS Checks

  Focus on #Identifying Sources #Identifying Sinks #Browser DevTools Approach #DOM Invader (Burp Suite) #Testing SPAs
• Mark DOM-Based XSS Exploitation as done
  Guide 5 min read

  DOM-Based XSS Exploitation

  Focus on #Hash-Based Payloads #postMessage Exploitation #Client-Side Routing Abuse #Bypassing Client-Side Sanitization
• Mark XSS Filter Bypass as done
  Guide 2 min read

  XSS Filter Bypass

  Focus on #Tag and Event Handler Alternatives #Encoding Tricks #Polyglot Payloads #WAF-Specific Bypasses
• Mark JavaScript for XSS as done
  Guide 4 min read

  JavaScript for XSS

  Focus on #Cookie Theft #Session Token and localStorage Theft #Making Authenticated Requests on Behalf of the Victim #Loading an External Payload

Practice

Apply the module hands-on.