# Full Web Application Assessment

> Run a full web assessment end to end: chain vulnerabilities, review source, and apply the additional attack classes that round out the OSWA skill set.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 3
- **Published:** 2026-09-26
- **Updated:** 2026-09-27

A real assessment is not a checklist of isolated bugs: it is combining enumeration and individual vulnerabilities into a chain that reaches the objective. This capstone covers the methodology for running a full web application assessment end to end, prioritizing attack paths, and chaining findings (traversal to database access, SQLi to RCE, SSRF to cloud compromise, XSS to admin, IDOR to escalation). It also collects the additional attack classes that round out a web assessment beyond the core WEB-200 topics.

## Web Application Assessment Methodology

Work an application systematically: map and enumerate, test each input against every applicable vulnerability class, then chain what you find. When you have source access, sink-first and entry-point-driven review speed up finding the exploitable path. Out-of-band techniques (HTTP, DNS) confirm and exfiltrate from blind vulnerabilities across SQLi, command injection, and XXE.

## Authentication, Session, and Token Attacks

Authentication is a frequent weak point: username enumeration, brute force and rate-limit bypass, password reset flaws, MFA bypass, and session fixation. JSON Web Tokens carry their own flaws (none algorithm, weak secrets, RS256-to-HS256 confusion, kid injection), and PHP type juggling breaks loose-comparison authentication and HMAC checks.

## Additional Web Attacks

Beyond the core classes, a thorough assessment tests business logic flaws, GraphQL abuse, prototype pollution (including server-side RCE), host header injection, CRLF injection, HTTP parameter pollution, and WebSocket security. These fill the gaps that standard vulnerability categories miss and often provide the decisive link in a chain.

## Recon and Misconfiguration

Passive recon (Google dorking), information disclosure checks, automated misconfiguration scanning, CSP analysis, and regex restriction bypasses surface the low-effort, high-value findings that seed the rest of the assessment.

## Study material

- [Web Assessment Methodology](https://hackindex.io/services/web/exploitation/web-assessment-methodology.md) (read, core)
- [Source Code Review for Web Vulnerabilities](https://hackindex.io/services/web/exploitation/source-code-review-methodology.md) (read, core)
- [Out-of-Band Data Exfiltration](https://hackindex.io/services/web/data-exfiltration/out-of-band-data-exfiltration.md) (read, core)
- [Authentication Vulnerability Testing](https://hackindex.io/services/web/vulnerability-discovery/authentication-vulnerability-testing.md) (read, core)
- [JWT Vulnerability Testing](https://hackindex.io/services/web/vulnerability-discovery/jwt-vulnerabilities.md) (read, core)
- [JWT Exploitation](https://hackindex.io/services/web/exploitation/jwt-exploitation.md) (read, core)
- [PHP Type Juggling](https://hackindex.io/services/web/exploitation/php-type-juggling.md) (read, core)
- [Business Logic Exploitation](https://hackindex.io/services/web/exploitation/business-logic-exploitation.md) (read, core)
- [GraphQL Exploitation](https://hackindex.io/services/web/exploitation/graphql-exploitation.md) (read, core)
- [Prototype Pollution](https://hackindex.io/services/web/exploitation/prototype-pollution.md) (read, core)
- [Host Header Injection](https://hackindex.io/services/web/exploitation/host-header-injection.md) (read, core)
- [CRLF Injection](https://hackindex.io/services/web/exploitation/crlf-injection.md) (read, core)
- [HTTP Parameter Pollution](https://hackindex.io/services/web/exploitation/http-parameter-pollution.md) (read, core)
- [WebSocket Security Testing](https://hackindex.io/services/web/vulnerability-discovery/websocket-security-testing.md) (read, core)
- [Google Dork Reconnaissance](https://hackindex.io/services/web/reconnaissance/google-dork-recon.md) (read, core)
- [Information Disclosure Checks](https://hackindex.io/services/web/vulnerability-discovery/information-disclosure-checks.md) (read, core)
- [Web Misconfiguration Scan](https://hackindex.io/services/web/vulnerability-discovery/misconfiguration-scan.md) (read, core)
- [CSP Check](https://hackindex.io/services/web/vulnerability-discovery/csp-check.md) (read, core)
- [Bypassing Regex Restrictions](https://hackindex.io/services/web/exploitation/regex-restriction-bypass.md) (read, core)