HackIndex.io
Language
HTTP and HTTPS are the foundation of web services, running on TCP port 80 (HTTP), TCP port 443 (HTTPS), and common alternates like TCP 8080 and 8443. Nmap identifies them as http and https (or http-proxy, https-alt). Web servers include Apache, Nginx, IIS, and many application frameworks that serve HTTP directly.
Web services present the largest attack surface on most targets. Server misconfigurations, exposed admin panels, default credentials, directory listings, and outdated software are common findings. Application-level vulnerabilities like SQL injection, XSS, SSRF, and file inclusion extend the surface further.
Start with technology fingerprinting (Wappalyzer, WhatWeb), then enumerate directories and files with tools like feroxbuster or gobuster. Check for virtual hosts, review TLS certificates for hostnames, and inspect HTTP headers and response codes. Examine the application logic for authentication bypasses and injection points.
Subdomain brute force, passive recon, cert logs, and dorks
Enumerate subdomains and infrastructure by querying Certificate Transparency logs, leveraging publicly recorded TLS certificates to map attack surface during recon.
Leverage advanced Google search operators to uncover exposed files, misconfigs, login portals, and sensitive data indexed on target web infrastructure.
Techniques for gathering web infrastructure intel without direct interaction—DNS records, WHOIS, archived content, metadata, and OSINT sources.
Enumerate hidden subdomains via wordlist-based bruteforce using tools like gobuster, ffuf, and amass to expand attack surface during recon.
HTTP enum covering fingerprinting, vhosts, dirs, APIs, CMS, and headers
Discover hidden API endpoints via fuzzing, path traversal, JS analysis, and spec file leakage to map attack surface on HTTP/HTTPS services.
Intercept, inspect & manipulate HTTP/HTTPS traffic using Burp Suite's proxy, scanner & repeater for web app enumeration and vulnerability discovery.
Identifies CMS platforms (WordPress, Joomla, Drupal) via HTTP responses, meta tags, file paths, and headers to map attack surface during web enumeration.
Techniques for discovering hidden files, directories, and endpoints on web servers using fuzzing tools, wordlists, and response analysis.
Techniques for enumerating Drupal CMS installations, including version detection, module discovery, user enumeration, and identifying misconfigurations via droopescan and manual methods.
Analyze HTTP response headers to identify server technologies, security misconfigurations, and information disclosure vulnerabilities during web enumeration.
Web vuln checks: XSS, SQLi, SSRF, XXE, IDOR, JWT, and more
Tests HTTP/HTTPS endpoints for broken access control flaws, including privilege escalation, IDOR, and unauthorized resource access across authentication boundaries.
Tests HTTP/HTTPS authentication mechanisms for weaknesses including brute force, credential stuffing, session fixation, and broken auth logic flaws.
Detect exposed .git directories on web servers that may leak source code, credentials, and project history via misconfigured web root deployments.
Detect command injection vulnerabilities in HTTP/HTTPS services by identifying unsanitized input points that allow OS command execution on the target server.
Techniques for identifying CORS misconfigurations by probing Origin validation, wildcard usage, and credential exposure in cross-origin HTTP responses.
Analyze Content-Security-Policy headers to identify misconfigurations, unsafe directives, and bypasses that expose applications to XSS and injection attacks.
RCE, SQLi, XSS, LFI, SSRF, XXE, JWT, file upload and more
Exploit flaws in application workflow, authentication bypass, price manipulation, and privilege escalation by abusing intended business logic rather than technical vulnerabilities.
Exploiting UI redress attacks by overlaying transparent iframes to hijack user clicks, steal credentials, or trigger unauthorized actions on vulnerable web applications.
Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, bypass techniques, and OS command execution through user-supplied input.
Exploiting misconfigured CORS policies to bypass same-origin restrictions, steal credentials, and perform cross-origin requests using crafted malicious origins.
Exploiting CRLF injection to manipulate HTTP headers, inject malicious responses, perform response splitting, and achieve session hijacking or XSS attacks.
Exploit Cross-Site Request Forgery vulnerabilities to force authenticated users into executing unwanted actions via crafted malicious HTTP requests.
Web shell management, upgrades, and config credential harvesting
Techniques for extracting plaintext credentials and secrets from web application config files post-compromise, targeting HTTP/HTTPS services.
Covers deploying, managing, and upgrading web shells over HTTP/HTTPS for persistent post-exploitation access, including shell stabilisation and capability escalation.
Pivot from web servers to internal nets via proxies and tunneling
Exploit a compromised web server as a pivot point to enumerate and attack internal network segments using tunneling, proxychains, and port forwarding techniques.
HTTP exfil via curl, SQLi, and out-of-band DNS channels
Techniques for extracting database contents through SQL injection, covering UNION-based, blind, and out-of-band methods to retrieve sensitive data.
Covers techniques for tunnelling stolen data over HTTP/HTTPS traffic, exploiting trusted web protocols to bypass DLP controls and evade network detection.
Techniques for exfiltrating data covertly via HTTP/HTTPS using out-of-band channels, bypassing detection through encoded payloads, DNS queries, and indirect communication paths.
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.