HTTP/HTTPS:
Vulnerability Discovery
Web vuln checks: XSS, SQLi, SSRF, XXE, IDOR, JWT, and more
WebSocket Security Testing
Covers WebSocket handshake hijacking, message tampering, origin validation bypass, and authentication flaws using Burp Suite and custom tooling.
Web vulnerability discovery is the systematic process of finding exploitable weaknesses in a web application. This goes beyond running a scanner. It means testing every input for injection (SQL, command, LDAP, XPath), fuzzing parameters with tools like ffuf and Burp Intruder, and probing authentication and session management for logic flaws.
Access control testing checks whether horizontal and vertical privilege escalation is possible by manipulating IDs, roles, or request parameters. Business logic testing targets flaws that automated tools miss entirely: race conditions, price manipulation, workflow bypasses, and multi-step process abuse.
The subpages cover manual and automated techniques for identifying injection points, testing authentication mechanisms, mapping access control boundaries, and discovering the application-specific vulnerabilities that generic scanners overlook.