1---2name: seclens-enterprise-web3description: Professional web application and API security testing workflows using OWASP Top 10 methodologies.4---56# Pentest Enterprise Web78## Purpose9Perform comprehensive vulnerability assessments on web applications and APIs (REST/GraphQL) to identify security flaws, logic errors, and compliance issues.1011## Prerequisites1213### Authorization Requirements14- **Written authorization** (scope document signed by asset owner)15- **Target environment classification**: Internal / External / Hybrid16- **Rules of Engagement**: Testing hours, notification procedures, emergency contacts1718### Evasion Profile Selection19| Profile | Use Case | Characteristics |20|---------|----------|-----------------|21| **Quiet** | Production systems, WAF-protected targets | Low request rate, header rotation, timing jitter |22| **Standard** | Staging environments, time-limited tests | Balanced speed/stealth |23| **Aggressive** | Internal networks, comprehensive coverage | Maximum parallelism, full payloads |2425### Environment Setup26- Docker container with `network_mode: host` for complete network access27- Volume mount for persistent reports: `./reports:/data`28- Minimum 4GB RAM allocated2930## Core Workflow311. **Scope & Recon**: Identify target scope, technologies, and entry points using `httpx` and `whatweb`.322. **Content Discovery**: Enumerate endpoints, hidden directories, and API routes using `dirsearch`, `ffuf`, and `katana`.333. **Vulnerability Scanning**: Automated scanning for common flaws (XSS, SQLi, CVEs) using `nuclei` and `nikto`.344. **Authentication Testing**: Test login flows, JWT handling, session management, MFA bypass vectors.355. **Business Logic Testing**: Manual testing for price manipulation, race conditions, IDOR, workflow bypass.366. **Dependency Scanning**: Analyze third-party components for known CVEs using `pip-audit`, `trivy`.377. **Manual Verification**: Verify automated findings and test complex business logic using `burpsuite` or `zap`.388. **Exploitation (Safe)**: Demonstrate impact of critical findings (e.g., SQLi, RCE) using `sqlmap` or custom scripts.399. **Reporting**: Aggregate findings into structured report using `references/report-template.md`.4041## OWASP Top 10 (2021) Coverage4243| Category | Workflow | Primary Tools | Status |44|----------|----------|---------------|--------|45| **A01** Broken Access Control | `business_logic_testing` | browser_agent, http_repeater, IDOR enumeration | ✅ |46| **A02** Cryptographic Failures | `vulnerability_assessment` | nuclei (crypto tags), manual TLS review | ✅ |47| **A03** Injection | `vulnerability_assessment` | sqlmap, dalfox, nuclei (injection templates) | ✅ |48| **A04** Insecure Design | `business_logic_testing` | manual testing, race condition scripts | ✅ |49| **A05** Security Misconfiguration | `web_reconnaissance` | nuclei (misconfig tags), nikto, httpx | ✅ |50| **A06** Vulnerable Components | `dependency_scanning` | pip-audit, npm-audit, trivy | ✅ |51| **A07** Auth Failures | `authentication_testing` | jwt_analyzer, http_intruder, browser_agent | ✅ |52| **A08** Software/Data Integrity | `dependency_scanning` | trivy (image scan), gitleaks | ✅ |53| **A09** Logging Failures | `vulnerability_assessment` | manual review, log injection testing | ⚠️ Partial |54| **A10** SSRF | `vulnerability_assessment` | nuclei (ssrf tags), interactsh (OOB) | ✅ |5556## Tool Categories5758| Category | Tools | Purpose |59|----------|-------|---------|60| Reconnaissance | httpx, katana, gau, waybackurls | Asset discovery, technology fingerprinting |61| Content Discovery | dirsearch, ffuf, gobuster, feroxbuster | Hidden endpoints, directories |62| Vulnerability Scanning | nuclei, nikto, jaeles | Automated CVE/misconfiguration detection |63| Injection Testing | sqlmap, dalfox, xsser | SQL, XSS, command injection |64| API Security | arjun, graphql_scanner, jwt_analyzer | API-specific vulnerabilities |65| Auth Testing | http_intruder, browser_agent | Credential stuffing, session attacks |66| Dependency Scanning | pip-audit, npm-audit, trivy | Third-party component CVEs |67| OOB Detection | interactsh | Blind SSRF, RCE, XXE verification |68| Interactive | burpsuite, zaproxy, browser_agent | Manual testing, complex flows |69| Reporting | pandoc, wkhtmltopdf | PDF/HTML report generation |7071## References72- `references/tools.md` - Tool function signatures and parameters73- `references/workflows.md` - Attack pattern definitions74- `references/report-template.md` - Vulnerability report template
jd-opensource