Web Application Penetration Testing

Align the testing scope with client objectives, including PCI DSS compliance, determine assets and tester qualifications, and establish what, when, and how rules to prevent scope creep and legal issues.

Clarify the scope, objectives, and assets for the web application penetration test. Outline compliance needs, testing windows, start timing, retest terms, and communication channels.

Explains the rules of engagement for web application pentesting, detailing permissions, scope, and rules, with explicit approval required before testing.

Reconnaissance in web application testing gathers information about the target asset, combining passive public-resource research with active probing to reveal weaknesses that are illegal without authorization.

Asset discovery enables data-driven risk decisions, consolidates asset visibility across web applications and third-party software, and strengthens security posture for web application protection.

Explore asset discovery with Whoxy, a dominant search engine for querying databases of registered resources like domain names, including reverse lookup and history lookup, demonstrated in this lecture.

Demonstrates using whoxy to perform whois lookups and history, reveal registrant, admin, and technical details, search emails, and uncover a target's assets and domains.

Explore asset discovery with Google advanced search, using operators like site: to narrow results and enumerate assets and subdomains under a domain.

Demonstrates Google advanced search techniques to enumerate subdomains and assets for a target domain, showing how to filter results and widen the testing scope.

Shodan enables asset discovery as a search engine for internet-connected devices and service banners. It uses SSL common names, net blocks, and dork queries on assets like Facebook in 31.13.72.0/24.

Use Shodan to identify assets of facebook.com, listing hostnames, IPs, and organizations from SSL certificates. Filter by subnet and org, revealing subdomains owned by Facebook Ireland Ltd.

Explore autonomous system numbers and asset discovery by identifying an organization's ip prefixes, determining the target ip, and performing an asn lookup to reveal additional assets.

An autonomous system number demo shows how to use a target's autonomous system number to reveal assets, mapping Tesla domains, ip addresses, and related entities.

Explore asset discovery using Cloudflare, one of the internet's largest networks, to understand how DNS enumeration reveals assets owned by the target.

Enumerates subdomains and assets for a target using Cloudflare, after logging in, adding the site, and selecting the free plan, then reviews imported DNS records for tesla.com.

Discover how certificate transparency monitors, audits, and logs every ssl certificate to enable asset enumeration for your target.

Learn how to use certificate transparency to discover assets and subdomains of a target with search tools and Facebook’s certificate transparency monitoring, including subscribing to SSL certificate alerts.

Discover valid subdomains through asset discovery with subfinder, a project discovery tool. Install subfinder, use online sources, and run commands to enumerate subdomains.

Learn to quickly enumerate subdomains for a target domain using subfinder, perform recursive enumeration to find sub-subdomains, and save the results to an output file for downstream content discovery.

Explore content discovery by identifying publicly accessible assets, profiling technologies used, and enumerating directories and files, while learning the tools highlighted in this lesson.

Probe web content with httpx to identify accessible and inaccessible assets using the htp x tool from project discovery, implemented in go and installable via guided steps.

demonstrates using httpx to probe assets discovered by subfinder, reporting status codes, titles, and technologies to quickly validate accessibility across a target subnet.

Apply Aqua Tone for visual identification and content discovery across many assets to quickly map the attack surface, including Linux installation and targeting workflows.

Demonstrates using Aquatone for visual identification of assets, automatically scanning a target list, checking open ports, and generating screenshots and reports to verify login and billing pages.

Explore content discovery and technology profiling to identify software technologies and vulnerable stacks in a target asset, using BuiltWith and Wappalyzer to profile websites.

Use BuiltWith and Wappalyzer to profile Tesla.com’s technology stack, revealing Akamai Ampoules, Google Analytics, Google Optimize 360, Crazy Egg, Drupal CMS, Varnish, and Nginx.

Master fuzzing with ffuf for web content discovery and brute forcing, as the pre-installed tool on kylee machines, with live commands demonstrated in the next video.

Learn to fuzz a target website or asset with ffuf, enumerating directories, files, and parameters using wordlists and extensions, then filter results to identify a valid file parameter.

Learn to perform url extraction for content discovery using gau, explore resources like the Wayback Machine and Open Threat Exchange, and follow installation steps and sample commands.

Demonstrates using gau to extract URLs from a target domain, inspect results, and fetch subdomains, with options to save output to a file.

Extract endpoints and their parameters using link finder to perform content discovery in a target js file, with installation steps from GitHub.

Demonstrates using the Link Finder tool to extract endpoints from a JavaScript file, executing a command to reveal internal endpoints that could be vulnerable, with results shown in a browser.

Discover parameters in a target domain with Param Spider, a Python script for content discovery. Install requirements, run the tool with python3, and specify your target domain to see results.

demonstrates parameter discovery with param spider by targeting a domain, running the tool in python 3, and examining parameters for potential vulnerabilities, including subdomains and file extensions.

Open source scanners enable scanning the target asset to identify potential vulnerabilities, using tools like WP Scan for WordPress, Joomla, and Drupal.

Learn to use wp scan, a black box WordPress vulnerability scanner, to scan a remote WordPress installation for security issues; it ships pre-built on Kali and is demonstrated with options.

Explore how to run the WPScan tool against a WordPress target, identify out-of-date themes and plugins and potential vulnerabilities, and enumerate users, backups, and configurations.

Explore Joomscan, an open source tool that automates vulnerability detection and reliability assurance for web apps; learn to run it with a target asset and follow the Daily Bugle demonstration.

Demonstrates Joomscan scanning a Joomla site, identifying version 3.7.0, exposed directories and admin login, and locating a coms field injection vulnerability affecting Joomla 3.7.0.

Explore how Droopescan uses a scanner to identify issues in group installations; install from GitHub and run with a target asset, and learn about Groupon.

Demonstrate droopescan on a Drupal CMS by enumerating plugins, modules, and versions, locating the login page, and assessing the target site on HackerOne's bug bounty program.

Explore CMSeeK, a tool for detection and exploitation, able to scan over 100 ATMs including WordPress and Joomla, with steps to clone the tool and a demo of its use.

Demonstrate CMSeeK performing a deep scan of a WordPress site, identifying the theme version 5.3 and plugins like WP Advanced Search, Social Warfare, and WP File Upload.

explore nuclei, a template-based, fast scanner for many targets, offering zero false positives and protocol support such as dns and htp, powered by a community of researchers.

Explore using nuclei to scan web apps with default and targeted templates, filters, and workflows. Detect WordPress fingerprinting, vulnerabilities like infinite wp port bypass, and associated CVEs.

Burp Suite is the standard tool for testing website security, offering community, professional, and enterprise editions, with proxy, target, intruder, repeater, decoder, extender, scanner, and collaborator.

Explore the OWASP top 10 vulnerabilities for web and mobile, including injection, broken access control, data exposure, and cross-site scripting, along with MITRE and CWE frameworks.

Learn to identify domain and subdomain takeover vulnerabilities by misconfigured dns pointing to third party services, with github as a common target, and implement cleanup to prevent exploitation.

Demonstrates domain and subdomain takeovers by illustrating vulnerability indicators on a demo site using GitHub Pages, highlighting how misconfigured subdomains can be exploited.

Explain path traversal and local file inclusion vulnerabilities and how attackers access local files such as passwords by traversing directories.

Examine remote file inclusion vulnerabilities that allow remote code execution by altering file parameters to load malicious files on the server, threatening confidentiality, integrity, and availability.

Explore os command injection, a vulnerability that lets attackers execute system commands on the target app, with chaining techniques and prevention like input validation and web application firewalls.

Explore cross-site scripting, reflected, stored, dom-based attacks, and how injected scripts exploit input to steal cookies or alter data. Learn defenses with input filtering, output encoding, and content security policy.

Learn SQL injection overview: attackers exploit vulnerable web apps to read, modify, or delete data and even run commands, using error-based, union-based, time-based, and blind techniques.

Learn how git repository exposure in production leaks source code and credentials, teaches vulnerability analysis with tools like git extensions and git tools, and highlights protecting the git folder.

Explore how information exposure leaks sensitive data such as database backups, credentials, and API keys through misconfigurations and error messages. Learn reconnaissance and privacy impact assessments to prevent leaks.

Explore information exposure through Google and GitHub dorks, demonstrating how exposed backups, log files, and credentials like secret access keys and SMTP credentials can appear online.

Explore how brute force attacks compromise login pages and OTPs, and implement defenses like rate limiting, account lockout, minimum-length passwords, non-default admin usernames, and OTP-based verification.

Explore unrestricted file upload vulnerabilities in web apps, learn bypass techniques (extension tricks, content type, magic bytes), and implement defenses like white lists, server-side validation, and web application firewalls.

Identify insecure direct object references by showing how real keys or ids expose resources, enabling unauthorized access, modification, or deletion, and emphasize applying access control for authorized data actions.

Explore XML external entities (XXE) vulnerabilities, see how attackers read files and access backends via XML parsers, and trigger denial-of-service, with hands-on lab examples and mitigation tips.

Explore server-side request forgery (ssrf) vulnerabilities, how attackers access internal services, and practical mitigations like input validation and whitelisting to protect confidentiality and integrity.

Explore server-side template injection vulnerabilities, how template engines render data, and how attackers detect, identify, and exploit SSTI using payloads.

Apply severity levels to each vulnerability using the common vulnerabilities scoring system version 3.1, prioritizing fixes by eight metrics: attack vector, complexity, privileges, user interaction, scope, confidentiality, integrity, and availability.

Learn how to craft a structured penetration testing report that documents findings, severity, scope, methodology, and remediation recommendations to help executives decide on security controls.

Explore practical certification paths for web application penetration testing, including the practical ewpt and ewpt x with black-box exams, and the offensive security web expert with white-box testing.

Explore a free web application penetration testing course for government employees and discounted access for students, with blog write-ups on bugs and CTFs and updates via Discord, LinkedIn, and Twitter.