wstg-web-pentest

# WSTG Web Application Pentest Full OWASP WSTG-aligned testing methodology. Each phase maps to a WSTG category and provides concrete commands, expected outputs, pitfalls, and verification criteria. The 12 phases: ```text 1. Information Gathering WSTG-INFO 2. Configuration & Deployment WSTG-CONF 3. Identity Management WSTG-IDNT 4. Authentication WSTG-ATHN 5. Authorization WSTG-ATHZ 6. Session Management WSTG-SESS 7. Input Validation WSTG-INPV 8. Error Handling WSTG-ERRH 9. Weak Cryptography WSTG-CRYP 10. Business Logic WSTG-BUSL 11. Client-side WSTG-CLNT 12. API Testing WSTG-APIT ``` Classify every observation: | State | Meaning | |---|---| | Signal | Observation justifies follow-up | | Exposed | Service or behavior reachable in tested context | | Vulnerable | Security property failed under controlled test | | Exploitable | Controlled test demonstrated concrete impact | --- ## When to Use - Starting a web application pentest with a defined scope - Auditing a web application against the OWASP testing standard - Building a test plan from observed technology and behavior - When the engagement requires methodology documentation - Converting automated scanner output into validated findings ## Prerequisites - In-scope domains, IPs, APIs, and test accounts - Exclusions, rate limits, test windows, and abort conditions - Permitted actions: passive, active read-only, intrusive, destructive - Tools installed: `curl`, `subfinder`, `dnsx`, `httpx`, `katana`, `nuclei`, `nmap`, `ffuf`, `jq`, `python3`, `openssl`, `tlsx`, `wappalyzer` or `whatweb` - Browser with intercepting proxy configured for authenticated testing - Test accounts for two distinct identities (for authorization testing) --- ## How to Run ```bash TARGET="example.com" OUTPUT_DIR="${OUTPUT_DIR:-./output}/${TARGET}" mkdir -p "$OUTPUT_DIR"/{assets,http,urls,evidence,reports} # Run phases sequentially, stopping at scope boundaries: # 1. INFO -> 2. CONF -> 3. IDNT -> 4. ATHN -> 5. ATHZ -> # 6. SESS -> 7. INPV -> 8. ERRH -> 9. CRYP -> 10. BUSL -> # 11. CLNT -> 12. APIT -> Report ``` --- ## Procedure ### Phase 1: Information Gathering (WSTG-INFO-01 through INFO-10) Map the attack surface before testing. #### 1.1 Search Engine Discovery (WSTG-INFO-01) ```bash # Google dorks (manual in browser) site:${TARGET} site:${TARGET} filetype:pdf site:${TARGET} inurl:admin site:${TARGET} intitle:"index of" # GitHub code search gh search code "example.com" --limit 100 2>/dev/null ``` **Pitfalls:** Search results include third-party references. Verify ownership before treating a result as in-scope. #### 1.2 Fingerprint Web Server (WSTG-INFO-02) ```bash curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \ | grep -iE 'server|x-powered-by|x-aspnet-version|x-generator' whatweb --max-redirects 2 --no-errors "https://${TARGET}" 2>/dev/null ``` **Expected output:** Server header, technology stack hints. **Pitfalls:** Headers can be suppressed or spoofed by reverse proxies. Cross-reference with response behavior and error pages. **Verification:** At least two independent signals agree on the technology. #### 1.3 Review Metafiles (WSTG-INFO-03) ```bash for path in robots.txt sitemap.xml security.txt .well-known/security.txt; do code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \ "https://${TARGET}/${path}" 2>/dev/null) printf '%-30s %s\n' "$path" "$code" done ``` **Pitfalls:** Disallowed paths in robots.txt are hints, not hidden secrets. sitemap.xml sometimes lists admin or staging endpoints. #### 1.4 Attack Surface Discovery (WSTG-INFO-04) ```bash subfinder -d "$TARGET" -silent | tee "$OUTPUT_DIR/assets/hostnames.txt" curl -sS --max-time 30 \ "https://crt.sh/?q=%.${TARGET}&output=json" 2>/dev/null \ | jq -r '.[].name_value' 2>/dev/null \ | sed 's/^\*\.//' | sort -u \ >> "$OUTPUT_DIR/assets/hostnames.txt" sort -u "$OUTPUT_DIR/assets/hostnames.txt" -o "$OUTPUT_DIR/assets/hostnames.txt" ``` **Pitfalls:** Wildcard entries are patterns, not hosts. Third-party names appear in SANs. Classify scope and ownership before probing. #### 1.5 Resolve and Probe (WSTG-INFO-04 continued) ```bash dnsx -l "$OUTPUT_DIR/assets/hostnames.txt" -silent -a -json \ -o "$OUTPUT_DIR/assets/dns.jsonl" httpx -l "$OUTPUT_DIR/assets/hostnames.txt" \ -silent -rate-limit 2 \ -status-code -title -tech-detect -server -ip -cname -json \ -o "$OUTPUT_DIR/http/services.jsonl" # Live URLs only jq -r '.url // empty' "$OUTPUT_DIR/http/services.jsonl" | sort -u \ > "$OUTPUT_DIR/http/live-urls.txt" ``` #### 1.6 Review Page Content (WSTG-INFO-05) ```bash while IFS= read -r url; do curl -sS --max-time 10 "$url" 2>/dev/null \ | grep -oPi '(email|password|secret|key|token|api[_-]?key|authorization|bearer)[^a-z0-9]*[=:]\s*["\x27]?[^\s"'\''<>&]+' \ | head -5 sleep 1 done < "$OUTPUT_DIR/http/live-urls.txt" ``` **Pitfalls:** Comments, inline scripts, and HTML data attributes frequently contain false leads. Confirm in context before reporting. #### 1.7 Identify Entry Points (WSTG-INFO-06) ```bash katana -list "$OUTPUT_DIR/http/live-urls.txt" \ -silent -jc -c 2 -p 2 -rl 2 \ -o "$OUTPUT_DIR/urls/katana.txt" # Historical URLs echo "$TARGET" | waybackurls 2>/dev/null > "$OUTPUT_DIR/urls/wayback.txt" gau "$TARGET" --subs 2>/dev/null > "$OUTPUT_DIR/urls/gau.txt" # Merge and classify cat "$OUTPUT_DIR/urls/katana.txt" \ "$OUTPUT_DIR/urls/wayback.txt" \ "$OUTPUT_DIR/urls/gau.txt" \ | sort -u > "$OUTPUT_DIR/urls/all.txt" grep -iE '/api/|/graphql|/rest/|swagger|openapi|/v[0-9]+/' \ "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/api-candidates.txt" grep -iE 'login|logout|register|reset|oauth|saml|callback|session|token|mfa|2fa' \ "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/auth-candidates.txt" grep -iE '\.js(\?.*)?$' \ "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/javascript.txt" grep -E '[?&][a-zA-Z0-9_.-]+=' \ "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/parameterized.txt" ``` #### 1.8 Fingerprint Framework (WSTG-INFO-08) ```bash httpx -l "$OUTPUT_DIR/http/live-urls.txt" \ -silent -tech-detect -json \ | jq -r '[.url, (.tech // [] | join(","))] | @tsv' \ > "$OUTPUT_DIR/http/frameworks.tsv" ``` **Verification:** Confirm framework fingerprint with at least two signals: a header, a cookie name (e.g. `laravel_session`, `JSESSIONID`), a path pattern (`/wp-content/`, `/_next/`), or a unique error page. #### 1.9 Map Application Architecture (WSTG-INFO-10) ```bash # TLS inspection tlsx -l "$OUTPUT_DIR/http/live-urls.txt" -silent -san -nc -json \ -o "$OUTPUT_DIR/assets/tls.jsonl" # Port scan (when in-scope IPs are provided) nmap -sT --top-ports 100 --open -T3 \ -oA "$OUTPUT_DIR/assets/nmap-top100" \ -iL in-scope-ips.txt 2>/dev/null ``` **Pitfalls:** Port scanning is active and detectable. Run only on in-scope IPs and with conservative timing. --- ### Phase 2: Configuration and Deployment (WSTG-CONF-01 through CONF-14) Test infrastructure and platform configuration. #### 2.1 Network Infrastructure (WSTG-CONF-01) ```bash # Check for common admin panels for path in admin administrator admin.php admin.aspx console manager \ phpmyadmin pma phppgadmin webmin cpanel:2082 whm:2086; do code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \ "https://${TARGET}/${path}" 2>/dev/null) [ "$code" != "404" ] && printf '%-25s %s\n' "$path" "$code" sleep 1 done ``` #### 2.2 Application Platform Configuration (WSTG-CONF-02) ```bash # Common config files for path in .env .env.local .env.production .env.development \ config.json config.yml config.yaml settings.py wp-config.php \ web.config .htaccess Dockerfile docker-compose.yml; do code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \ "https://${TARGET}/${path}" 2>/dev/null) [ "$code" = "200" ] && echo "[!] EXPOSED: $path (HTTP $code)" sleep 1 done ``` **Pitfalls:** A 200 response with a generic shell or redirect is not a config leak. Always inspect the body. **Verification:** Body contains configuration keys, database credentials, API keys, or environment variables. #### 2.3 File Extensions (WSTG-CONF-03) ```bash # Check how the server handles backup and alternate extensions for ext in bak old backup orig save swp tmp ~; do code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \ "https://${TARGET}/index.html.${ext}" 2>/dev/null) [ "$code" != "404" ] && echo "[*] index.html.${ext}: $code" sleep 1 done ``` #### 2.4 Backup and Unreferenced Files (WSTG-CONF-04) ```bash ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-small-words.txt \ -u "https://${TARGET}/FUZZ" \ -e .bak,.old,.backup,.zip,.tar.gz,.sql,.tgz \ -mc 200,301,302,403 \ -rate 5 -t 5 \ -o "$OUTPUT_DIR/evidence/ffuf-backup.json" 2>/dev/null ``` **Pitfalls:** Archive files from public sources (GitHub releases, CDN) are not leaks. Confirm the file contains source or configuration before reporting. #### 2.5 Admin Interfaces (WSTG-CONF-05) ```bash ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common-admin.txt \ -u "https://${TARGET}/FUZZ" \ -mc 200,301,302,403 -rate 5 -t 5 \ -o "$OUTPUT_DIR/evidence/ffuf-admin.json" 2>/dev/null ``` #### 2.6 HTTP Methods (WSTG-CONF-06) ```bash for method in GET POST PUT DELETE PATCH OPTIONS HEAD TRACE CONNECT; do code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \ -X "$method" "https://${TARGET}/" 2>/dev/null) printf '%-8s %s\n' "$method" "$code" sleep 1 done # OPTIONS response often lists allowed methods curl -sS -D - --max-time 10 -X OPTIONS "https://${TARGET}/" 2>/dev/null \ | grep -i 'allow:' ``` **Pitfalls:** TRACE is informational unless combined with cookie-bearing requests. PUT without authentication is high.