27/03/2025, 16:59 Intro to Web App Pentesting | INE Training Notes - by syselement
INE Training Notes - by Home Blog
syselement
COURSES EJPT - PTSV2 📒 3. WEB APPLICATION PENETRATION TESTING
Intro to Web App Pentesting
⚡ Prerequisites
• Basic Network and Cybersecurity Concepts
📕 Learning Objectives
• Understand Web protocols
• Perform webapps enumeration
• Perform SQL injection, XSS and brute-force attacks
🔬 Training list - PentesterAcademy/INE Labs
subscription required
• Web Application Basics
• Web Apps Tools of Trade
Web application penetration testing is a process of identifying and
exploiting vulnerabilities in web applications to assess their security posture.
Web and HTTP Protocol
🔗 📝 Some Web Applications Basics notes are already covered here
(from the PTSv1 Course)
🗒️ HTTP(HyperText Transfer Protocol) is a protocol used for
communication between web servers and clients, such as web browsers.
HTTP key features are:
1
27/03/2025, 16:59 Intro to Web App Pentesting | INE Training Notes - by syselement
• Client-Server Architecture
• Stateless Protocol
• Request Methods
• Status Codes ( 200 , 404 , 500 , etc)
• Headers (additional information about the request/response)
• Cookies (store info on the client-side)
• Encryption ( HTTPS )
📌 RFC 9110 - HTTP Semantics
Request Methods
HTTP defines a set of request methods to indicate the desired action to be
performed for a given resource. Commonly used HTTP requests are:
GET - retrieve data from the server
HEAD - retrieve metadata about a resource from the server
POST - submit data to the server
PUT - update an existing resource on the server
DELETE - delete a specified resource
CONNECT - establish a tunnel to the server identified by the target resource
OPTIONS - describe the communication options for a resource
TRACE - perform a message loop-back test along the path to the resource
PATCH - apply partial modifications to a resource
Response Status Codes
2
27/03/2025, 16:59 Intro to Web App Pentesting | INE Training Notes - by syselement
HTTP response status codes indicate whether a specific HTTP request has
been successfully completed. They are grouped in five classes:
• 100-199 - Informational responses
• 200-299 - Successful responses
• 300-399 - Redirection messages
• 400-499 - Client error responses
• 500-599 - Server error responses
Cookies
An HTTP cookie is a small piece of data that a server sends to a user's web
browser. The web browser may store the cookie and send it back to the
same server with later requests. Cookies are mainly used for these purposes:
• Session management
• Personalization
• Tracking
HTTPS
🗒️ HTTPS (HTTP Secure) is the encrypted version of that uses a HTTP
combination of Transport Layer Security ( TLS ) or Secure Sockets Layer
( SSL ) protocol and HTTP protocol to provide secure communication.
When a client connects to an HTTPS-enabled website, the server sends its
SSL / TLS certificate to the client. The client verifies the certificate to
ensure that it is issued by a trusted certificate authority and that it is valid. If
the certificate is valid, the client and the server establish a secure connection
using a unique session key.
🔬 There are many vulnerable testing web apps like:
• Juice Shop - Kali Install
3
27/03/2025, 16:59 Intro to Web App Pentesting | INE Training Notes - by syselement
• DVWA - Kali Install
• bWAPP
• Mutillidae II
📝 Check the HackerSploit's Web App Penetration Testing Tutorials
# bWAPP with Docker - by HackerSploit
sudo docker pull hackersploit/bwapp-docker
sudo docker run -d -p 80:80 hackersploit/bwapp-docker
# Open http://127.0.0.1/install.php
sudo docker container ls
sudo docker container stop <CONTAINER_NAME>
sudo docker container start <CONTAINER_NAME>
nmap -sV -p 80,443,3306 demossl.ine.local
Scanning & Enumeration
Directory Enumeration - Gobuster
Gobuster - a tool used to brute-force URIs including directories and files as
well as DNS subdomains.
# Kali Linux Install
sudo apt update && sudo apt install -y gobuster
# Go Install
go install github.com/OJ/gobuster/v3@latest
Directory Enumeration - BurpSuite
BurpSuite - an integrated platform for performing security testing of web
applications.
4
27/03/2025, 16:59 Intro to Web App Pentesting | INE Training Notes - by syselement
# Kali Linux Install
sudo apt update && sudo apt install -y burpsuite
🔬 Check HTTP Web App Enumeration lab covering HTTP Method and
Directory Enumeration Techniques
Scanning WebApp - ZAProxy
Zaproxy - OWASP Zed Attack Proxy (ZAP) is an easy to use integrated
penetration testing tool for finding vulnerabilities in web applications.
# Kali Linux Install
sudo apt update && sudo apt install -y zaproxy
Scanning WebApp - Nikto
Nikto - a pluggable web server and CGI scanner written in Perl, using rfp’s
LibWhisker to perform fast security or informational checks.
# Kali Linux Install
sudo apt update && sudo apt install -y nikto
🔬 Check HTTP Web App Scanning lab covering Web Apps scanning
techniques
Attacks
SQLMap - an open source penetration testing tool that automates the process
of detecting and exploiting SQL injection flaws and taking over of database
servers.
5
27/03/2025, 16:59 Intro to Web App Pentesting | INE Training Notes - by syselement
# Kali Linux Install
sudo apt update && sudo apt install -y sqlmap
XSSer (Cross-Site Scripter) - an automatic framework to detect, exploit and
report XSS vulnerabilities in web-based applications.
# Kali Linux Install
sudo apt update && sudo apt install -y xsser
SQLi
🗒️ SQL Injection attacks consist of insertion or “injection” of a query SQL
via the input data from the client to the application, allowing an attacker to
interfere with the database queries of the vulnerable web application.
• What is a SQLi? - PortSwigger
XSS
🗒️ Cross-Site Scripting (XSS) attacks are a type of injection, in which
malicious scripts are injected into otherwise benign and trusted websites,
allowing an attacker to compromise the interactions that users have with a
vulnerable application.
• How does XSS Work? - PortSwigger
🔬 Check Web App Attacks lab covering Web Apps Attacking techniques
Previous
📒 3. Web Application Penetration Testing
Next
🔬 HTTP Enumeration
6
27/03/2025, 16:59 Intro to Web App Pentesting | INE Training Notes - by syselement
Last updated 1 year ago Was this helpful?
