Web application pentest

Proxy everything through Burp from the start and walk the app like a normal user before attacking: almost everything below comes from that map.

Target 0 of 27

Hide completed

Commands use the values you typed in the cheat sheets (your IP, the target's, the domain...).

Map the application 0/5

Look for APIs and their docs (/api, /swagger, /graphql, /v1)

ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -ac

Read the JavaScript: hidden routes, keys and endpoints
Check for an exposed .git and dump it
```
git-dumper http://box.htb/.git/ repo
```
Guide →

Default credentials and user enumeration through error messages
Bypass the login: SQLi, NoSQLi, type juggling and tampered responses
```
' OR 1=1-- -
```
Password reset: predictable tokens, Host header and reuse
JWT: alg none, weak secret, RS256/HS256 confusion, kid and jku

Cheat sheet → Guide →
Cookies: flags, decodable content and signature

IDOR: swap other users' ids in URLs, bodies and APIs

Guide →
Reach admin functions with a normal user
Mass assignment: add fields like role or isAdmin on signup or profile edit

Guide →

SQLi in every parameter (error, boolean, time, UNION)
```
sqlmap -r peticion.txt --batch --level 3 --risk 2
```
Cheat sheet → Guide →
Command injection (; | && $() and newlines)

Cheat sheet → Guide →
SSTI: try {{7*7}} and ${7*7} wherever text is reflected

Cheat sheet → Guide →
LFI and path traversal in parameters that take file names
```
curl 'http://box.htb/index.php?page=../../../../etc/passwd'
```
Cheat sheet → Guide →
XXE in any XML input (also SVG, DOCX and SOAP)

Cheat sheet → Guide →
SSRF in URL parameters: internal services and cloud metadata

Guide →
XSS where an admin or bot will view what you submit
Deserialization: objects in cookies or parameters (Java, PHP, .NET, Python)

Guide →

Bypass the extension filter (double extension, case, .phtml, .htaccess)

Guide →
Change the Content-Type and magic bytes

Guide →
Find where the file is stored and whether it runs