Skip to main content
Category: Pentest
Load this context Ask your agent: 
get the web-app-pentest context

​
Summary

A complete web application penetration test methodology from passive recon to structured reporting.
  • Phase 1 covers passive and active reconnaissance: subdomain enumeration, JS file analysis, directory brute-force, and technology fingerprinting
  • Phase 2 tests authentication: default credentials, brute-force protection, password reset flaws, MFA bypass, OAuth misconfiguration, and JWT attacks
  • Phase 3 tests authorization: IDOR, privilege escalation, HTTP method bypass, and parameter tampering
  • Phase 4 covers all injection classes: SQLi, XSS, SSTI, command injection, XXE, and SSRF
  • Phases 5–6 assess session management and business logic flaws
  • Phase 7 produces structured findings referencing OWASP Top 10

​
CONTEXT.md

​
When to Use This Context

Load this context when:
  • Starting a web application pentest engagement
  • Testing authentication, session management, or authorization
  • Looking for injection vulnerabilities (SQLi, XSS, SSTI, etc.)
  • Testing business logic flaws
  • Reviewing API endpoints exposed by a web app
Key focus areas: OWASP Top 10, authentication bypass, IDOR/BAC, injection, session management, business logic, client-side attacks.

​
Phase 1 Reconnaissance

Passive recon:
  • Enumerate subdomains: subfinder -d target.com, amass enum -d target.com
  • Check robots.txt, sitemap.xml, .well-known/
  • Google dorks: site:target.com filetype:pdf, site:target.com inurl:admin
  • Check Wayback Machine for old endpoints
  • Review JS files for hardcoded secrets, API keys, internal endpoints
Active recon:
  • Directory brute-force: ffuf -w wordlist.txt -u https://target.com/FUZZ
  • Technology fingerprinting: whatweb, wappalyzer, response headers
  • Port scan: nmap -sV -p 80,443,8080,8443 target.com

​
Phase 2 Authentication Testing

  • Default credentials (admin/admin, admin/password)
  • Username enumeration via response timing or error messages
  • Brute-force protection test rate limiting, account lockout
  • Password reset flaws token predictability, host header injection
  • MFA bypass code reuse, response manipulation, backup codes
  • OAuth misconfiguration state parameter, redirect_uri bypass
  • JWT attacks use jwt-cracker skill if available

​
Phase 3 Authorization Testing

  • IDOR access other users’ objects by changing IDs (use idor-hunter skill if available)
  • Privilege escalation access admin functions with low-privilege account
  • Horizontal escalation access another user’s data with same role
  • Path-based access control bypass: /admin/../user/profile
  • HTTP method bypass: GET blocked → try POST, HEAD, OPTIONS
  • Parameter tampering: role=user → role=admin

​
Phase 4 Injection Testing

SQL Injection: 
# Manual probes
' OR '1'='1
'; DROP TABLE users;--

# Automated
sqlmap -u "https://target.com/page?id=1" --dbs
XSS use xss-hunter skill if available:
  • Reflected: inject <script>alert(1)</script> in every input
  • Stored: comment fields, profile names, file names
  • DOM: check JS for innerHTML, document.write, eval
Other injections:
  • SSTI: {{7*7}}, ${7*7}, <%= 7*7 %> use ssti-hunter skill if available
  • Command injection: ; id, | whoami
  • XXE: inject <!ENTITY xxe SYSTEM "file:///etc/passwd">
  • SSRF: replace URLs with http://169.254.169.254/ (AWS metadata)

​
Phase 5 Session Management

  • Session token entropy is it predictable?
  • Session fixation can attacker set a known session ID?
  • Session after logout does the token still work?
  • Cookie flags missing HttpOnly, Secure, SameSite
  • CSRF test state-changing requests without CSRF token

​
Phase 6 Business Logic

  • Skip steps in multi-step flows (checkout, onboarding)
  • Negative values in quantity/price fields
  • Race conditions on limited resources (coupons, transfers)
  • Mass assignment send extra fields in JSON body
  • File upload bypass extension checks, upload webshells

​
Phase 7 Reporting

Each finding must include: Title, Severity (Critical / High / Medium / Low / Info), Affected URL, Steps to reproduce, Evidence (request/response), Impact, and Recommendation. Use finding-writer skill to structure raw notes into a complete finding.

cloud-audit

AWS, Azure, and GCP security IAM, storage, networking, secrets, and loggingRifteo-Community/contexts

code-audit

Source code security review secrets, auth logic, injection sinks, crypto, dependenciesRifteo-Community/contexts