Introduction to Web Applications

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark HTTP Tech Fingerprinting as done
  Guide 5 min read

  HTTP Tech Fingerprinting

  Focus on #Fast Baseline with curl #HTTP Methods Check #TLS Certificate Triage #whatweb #httpx for Bulk Fingerprinting #nikto for Quick Misconfiguration Hints
• Mark HTTP Header Analysis as done
  Guide 4 min read

  HTTP Header Analysis

  Focus on #Full Header Dump #Security Header Assessment #Cookie Flag Analysis #CORS Header Check #Server and Technology Leakage
• Mark CMS Detection and Fingerprinting as done
  Guide 8 min read

  CMS Detection and Fingerprinting

  Focus on #whatweb #Manual Fingerprinting by CMS #Generator Meta Tag and HTTP Headers #Cookie Name Fingerprinting
• Mark Web Content Discovery as done
  Guide 8 min read

  Web Content Discovery

  Focus on #Check robots.txt and sitemap.xml #ffuf Baseline #Handle Custom 404s with Size Filtering #Stack-Matched Extensions #Recursive Discovery #Authenticated Discovery #Larger Wordlists for Deeper Web Content Discovery #Tech-Specific Wordlists #Gobuster and dirsearch as Alternatives
• Mark Web Crawling and Spidering as done
  Guide 6 min read

  Web Crawling and Spidering

  Focus on #Hakrawler #Katana #Gospider #JavaScript File Analysis
• Mark Virtual Host Enumeration as done
  Guide 5 min read

  Virtual Host Enumeration

  Focus on #ffuf Virtual Host Bruteforce #gobuster vhost Mode #HTTPS Virtual Hosts
• Mark API Endpoint Enumeration as done
  Guide 6 min read

  API Endpoint Enumeration

  Focus on #OpenAPI and Swagger Discovery #REST API Endpoint Bruteforce #HTTP Method Testing #GraphQL Enumeration
• Mark HTTP Parameter Crawling and Discovery as done
  Guide 4 min read

  HTTP Parameter Crawling and Discovery

  Focus on #Arjun: Parameter Discovery #x8: Parameter Bruteforce #ffuf for Manual Parameter Fuzzing #JavaScript Source Mining
• Mark Burp Suite as done
  Guide 4 min read

  Burp Suite

  Focus on #Proxy Setup #Intercept Tab #HTTP History #Repeater #Intruder #Decoder #Comparer
• Mark Login Page Enumeration as done
  Guide 7 min read

  Login Page Enumeration

  Focus on #Identify Authentication Mechanism #Assess Username Enumeration #Check Lockout Behavior #Credential Spraying with hydra