Offensive methodology
Web exploitation
The main classes of web vulnerabilities, how to recognise them and how to fix them. Organised by the OWASP Top 10. Test only on applications you are allowed to attack.
Approach
- MapPages, parameters, roles, technologies, entry points.
- InterceptBurp Suite as a proxy: see and change every request.
- Test inputsEvery parameter, header and cookie is an input to probe.
- Prove impactShow the real consequence, reproducibly.
Injection (OWASP A03)
| Vulnerability | Principle and fix |
|---|---|
| SQL injection | Input changes the SQL query (data read, authentication bypass). Fix: parameterised queries. |
| Command injection | Input reaches a system shell. Fix: never concatenate, allow-lists, safe APIs. |
| NoSQL injection | Operators injected into a MongoDB-style query. Fix: validate types, typed queries. |
| XSS | JavaScript runs in a victim's browser (reflected, stored, DOM). Fix: output encoding, CSP. |
Recognising SQL injectionAn apostrophe that triggers an SQL error, an
' OR 1=1-- - that changes the response, a delay with SLEEP() (blind injection). Automatable with sqlmap once the injection point is confirmed.Access control (A01)
- IDOR: changing an identifier in the URL or body gives access to another user's data.
- Vertical escalation: reaching an admin function without having the role.
- Unprotected paths: a sensitive page reachable with no server-side check.
- Fix: check rights server-side on every request, per resource.
Files and inclusion
Inclusion / traversal
- LFI: read arbitrary files via
../or a controlled path. - RFI: include a remote file, sometimes up to code execution.
- Fix: file allow-lists, no user-supplied path.
File upload
- Weak check on type or extension: dropping an executable file.
- Fix: check the real content, rename, store outside the web root.
Server-side and logic
- SSRF (A10): force the server to send requests to internal targets.
- Unsafe deserialisation (A08): an attacker-controlled object runs code when loaded.
- Business logic bugs: chaining steps in an unexpected order, negative prices, race conditions.
- Broken authentication (A07): brute force, weak reset, predictable tokens, missing MFA.
APIs and modern applications
- REST and GraphQL APIs: enumerate the endpoints, test rights on every object (BOLA/IDOR).
- GraphQL: introspection reveals the whole schema; beware of expensive nested queries.
- Common applications: look for CVEs and default credentials (CMS, admin tools).
ReferencesThe OWASP Top 10 sheet for the detail of each category. On the defensive side, these attacks show up in the web server logs: see SOC and SIEM.