Full Web Application Assessment

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark Web Assessment Methodology as done
  Guide 6 min read

  Web Assessment Methodology

  Focus on #Assessment Flow #Chaining Vulnerabilities #Directory Traversal to Database Access #SQL Injection to Remote Code Execution #SSRF to Cloud Account Compromise #XSS to Administrative Access #IDOR to Privilege Escalation #Prioritizing Attack Paths #Common Chains in CTF and Exam Environments
• Mark Source Code Review for Web Vulnerabilities as done
  Guide 6 min read

  Source Code Review for Web Vulnerabilities

  Focus on #Bottom-Up: Sink-First Review #Top-Down: Entry-Point-Driven Review #Dangerous Sinks by Language #PHP #Python #Java #.NET (C#) #JavaScript / Node.js #Grep Patterns for Rapid Discovery #Using Semgrep #Tracing User Input to Sink #Building Exploit Chains
• Mark Out-of-Band Data Exfiltration as done
  Guide 2 min read

  Out-of-Band Data Exfiltration

  Focus on #HTTP Callback Listener #Blind Command Injection Exfiltration #Blind SQLi Out-of-Band Exfiltration #Blind XXE Out-of-Band Exfiltration #DNS Exfiltration for Strict Egress Environments
• Mark Authentication Vulnerability Testing as done
  Guide 6 min read

  Authentication Vulnerability Testing

  Focus on #Username Enumeration #Brute-Force Attacks #Rate Limit Bypass #Password Reset Flaws #Multi-Factor Authentication Bypass #Session Fixation #Default and Weak Credentials
• Mark JWT Vulnerability Testing as done
  Guide 3 min read

  JWT Vulnerability Testing

  Focus on #Decode and Inspect the Token #None Algorithm Test #Algorithm Confusion: RS256 to HS256 #Weak Secret Brute Force #kid Header Injection
• Mark JWT Exploitation as done
  Guide 8 min read

  JWT Exploitation

  Focus on #JWT Token Forgery via None Algorithm #Weak Secret: Resign with Cracked Key #Algorithm Confusion: RS256 to HS256 #Modify User ID Claim
• Mark PHP Type Juggling as done
  Guide 4 min read

  PHP Type Juggling

  Focus on #Magic Hashes #Authentication Bypass #HMAC Bypass #strcmp Bypass #is_numeric Bypass #JSON-Based Type Juggling
• Mark Business Logic Exploitation as done
  Guide 8 min read

  Business Logic Exploitation

  Focus on #Price Manipulation #Multi-Step Process Bypass #Client-Side Control Bypass #Insufficient Workflow Validation #Race Conditions #Identifying Application-Specific Logic Flaws
• Mark GraphQL Exploitation as done
  Guide 4 min read

  GraphQL Exploitation

  Focus on #Introspection Query #Unauthorized Data Access #IDOR via GraphQL #Mutation Abuse #Batching and Alias Attacks
• Mark Prototype Pollution as done
  Guide 5 min read

  Prototype Pollution

  Focus on #Identifying Prototype Pollution #Server-Side RCE via child_process #EJS Template Engine RCE #Access Control Bypass
• Mark Host Header Injection as done
  Guide 3 min read

  Host Header Injection

  Focus on #Password Reset Poisoning #Header Variations #Web Cache Poisoning via Host Header
• Mark CRLF Injection as done
  Guide 7 min read

  CRLF Injection

  Focus on #HTTP Response Splitting #Session Fixation via CRLF #XSS via CRLF #Log Poisoning
• Mark HTTP Parameter Pollution as done
  Guide 8 min read

  HTTP Parameter Pollution

  Focus on #Server Behavior #Server-Side HPP #Client-Side HPP #WAF Bypass via HPP #HPP in REST APIs #JSON Duplicate Key Injection
• Mark WebSocket Security Testing as done
  Guide 6 min read

  WebSocket Security Testing

  Focus on #Intercepting WebSocket Traffic with Burp Suite #Cross-Site WebSocket Hijacking (CSWSH) #SQL Injection via WebSocket Messages #Command Injection via WebSocket Messages #Message Manipulation and Replay
• Mark Google Dork Reconnaissance as done
  Guide 3 min read

  Google Dork Reconnaissance

  Focus on #Admin and Login Panels #Exposed Configuration and Backup Files #Directory Listings #Sensitive Document and Data Exposure
• Mark Information Disclosure Checks as done
  Guide 10 min read

  Information Disclosure Checks

  Focus on #Error Message Analysis #Debug Pages and Endpoints #Spring Boot Actuator #Django Debug Mode #Backup and Temporary Files #Source Code Exposure
• Mark Web Misconfiguration Scan as done
  Guide 3 min read

  Web Misconfiguration Scan

  Focus on #Nuclei Baseline Scan #Narrow to Relevant Template Tags #Manual Security Header Check #nikto as Fallback
• Mark CSP Check as done
  Guide 5 min read

  CSP Check

  Focus on #Identifying Weak Directives #Base Tag Injection #script-src 'self' Bypass #Nonce Bypass #data: URI Bypass #unsafe-eval Exploitation
• Mark Bypassing Regex Restrictions as done
  Guide 5 min read

  Bypassing Regex Restrictions

  Focus on #Anchoring Issues #Newline Injection #Multiline Flag Abuse #URL Encoding and Double Encoding #Null Byte Injection #Backtracking Limit (ReDoS as Bypass)

Practice

Apply the module hands-on.