Skip to content

web-pentesting.md

Latest commit

聽

History

History
105 lines (73 loc) 路 1.68 KB

web-pentesting.md

File metadata and controls

105 lines (73 loc) 路 1.68 KB
Raw

Web Pentesting Guide

Methodology

1. Reconnaissance
   鈹斺攢> 2. Scanning
       鈹斺攢> 3. Exploitation
           鈹斺攢> 4. Post-Exploitation
               鈹斺攢> 5. Reporting

1. Reconnaissance

Subdomain Enumeration

# Quick enum
subfinder -d target.com -o subs.txt

# Probe alive hosts
cat subs.txt | httpx -silent > alive.txt

# Or use the alias
recon target.com

Technology Detection

whatweb https://target.com

2. Scanning

Port Scanning

nmap -sV -sC -T4 target.com

Vulnerability Scanning

# Nuclei (recommended)
nuclei -u https://target.com -severity high,critical

# Nikto
nikto -h https://target.com

# Or use the alias
webscan https://target.com

Directory Fuzzing

# Common directories
ffuf -u https://target.com/FUZZ -w /opt/wordlists/web/common.txt

# With extensions
ffuf -u https://target.com/FUZZ -w /opt/wordlists/web/common.txt -e .php,.html,.js

3. Exploitation

SQL Injection

sqlmap -u "https://target.com/page?id=1" --batch --dbs

XSS

dalfox url "https://target.com/search?q=test"

Authentication Bypass

Check for:

  • Default credentials
  • JWT vulnerabilities (jwt-hack)
  • Session management issues

4. Post-Exploitation

  • Extract sensitive data
  • Escalate privileges
  • Maintain access (if authorized)

5. Reporting

goat-report

Useful Wordlists

Wordlist Path
Common dirs /opt/wordlists/web/common.txt
Large dirs /opt/wordlists/web/directory-list-2.3-medium.txt
API endpoints /opt/wordlists/custom/api-endpoints.txt
Parameters /opt/wordlists/custom/api-params.txt