Web pentesting: from the web to root

A short, hands-on path to get fluent with Burp and injections. Fits well before the OSCP or as prep for eWPT or BSCP.

Level
Beginner: you know HTTP and have used Burp before
Rough duration
4-6 weeks at about 8 h a week
By the end you will
Map an application, find the way in and turn it into a shell without relying on ready-made exploits.
Your progress 0 of 43 steps

Continue with the next step →

  1. Stage 1 Map the application 0/7

    Miss nothing: subdomains, paths, exposed repositories and versions.

    1. Checklist Web application pentest
    2. Cheat sheet Web enumeration
    3. Guide Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster
    4. Technique Vhost and subdomain fuzzing

      Pick one or two machines from this technique's list.

    5. Technique Exposed .git repository

      Pick one or two machines from this technique's list.

    6. Machine Devvortex easy linux

      A subdomain with a CMS and an information leak in its API.

    7. Machine Busqueda easy linux

  2. Stage 2 Injections 0/12

    SQLi, SSTI, LFI and commands: detect them by hand and exploit them.

    1. Guide SQL injection: from a single quote to dumping the database
    2. Cheat sheet SQL injection payloads
    3. Machine Usage easy linux

      SQLi in a password reset form.

    4. Guide SSTI: fingerprinting the template engine and getting RCE
    5. Cheat sheet LFI, SSTI, command injection and XXE › SSTI
    6. Machine Doctor easy linux
    7. Guide LFI: from reading /etc/passwd to running commands
    8. Cheat sheet LFI, SSTI, command injection and XXE › LFI
    9. Machine Tabby easy linux
    10. Cheat sheet LFI, SSTI, command injection and XXE › Command injection
    11. Guide OS command injection: detection, blind injection and filter bypasses
    12. Machine Precious easy linux

      Command injection in an HTML to PDF converter.

  3. Stage 3 Server side: SSRF, XXE and deserialization 0/8

    Make the server work for you: internal requests, XML and serialized objects.

    1. Technique SSRF

      Pick one or two machines from this technique's list.

    2. Guide SSRF: using the server to reach internal services and the cloud
    3. Machine Sau easy linux

      SSRF to an internal service with a known flaw.

    4. Cheat sheet LFI, SSTI, command injection and XXE › XXE
    5. Guide XXE: reading server files with XML external entities
    6. Machine BountyHunter easy linux
    7. Technique Insecure deserialization

      Pick one or two machines from this technique's list.

    8. Guide Insecure deserialization: spotting and exploiting it in Java, .NET, PHP, Python and Node.js

      Java, .NET, PHP, Python and Node.js: how to spot each format.

  4. Stage 4 Authentication, APIs and access control 0/8

    Tokens, roles and identifiers: the logic flaws scanners miss.

    1. Cheat sheet JWT analyser
    2. Guide JWT attacks: alg none, weak secrets, algorithm confusion and kid injection
    3. Technique JWT attacks

      Pick one or two machines from this technique's list.

    4. Technique IDOR

      Pick one or two machines from this technique's list.

    5. Guide IDOR, mass assignment and APIs: the access control flaws scanners miss
    6. Technique Mass assignment

      Pick one or two machines from this technique's list.

    7. Machine TwoMillion easy linux

      An API that lets you make yourself admin and then run commands.

    8. Machine Cap easy linux

  5. Stage 5 File uploads and CMSs 0/8

    Bypass upload filters and exploit CMSs and frameworks running old versions.

    1. Technique Malicious file upload

      Pick one or two machines from this technique's list.

    2. Guide Malicious file upload: bypassing upload filters to get a web shell
    3. Technique CMS exploitation

      Pick one or two machines from this technique's list.

    4. Guide Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub
    5. Machine Networked easy linux
    6. Machine Armageddon easy linux
    7. Cheat sheet Reverse shell generator
    8. Checklist Post-exploitation and privesc

      Once in, the post-exploitation checklist takes you to root.