Web Testing Techniques
Techniques are the concrete methods used to validate the weaknesses identified by methodology. For injection, understand how untrusted input reaching an interpreter (SQL, command, template) changes behaviour, and how to confirm it safely - error-based, boolean, and time-based signals. For XSS, know that reflected output returns in the same response, stored output persists and affects other users, and DOM-based occurs in client-side script. For access control, test with multiple roles and compare responses.
Know request manipulation concepts: parameters (query, body, headers, cookies), HTTP methods, and how servers may trust headers such as Host or X-Forwarded-For. Understand file upload risks (type, extension, execution location) and path traversal via encoded sequences. Recognize the value of comparing responses (status code, length, timing) to detect differences. Be precise about safe confirmation: prove the vulnerability without causing damage or accessing data you should not.
Trap: questions often present a payload and ask what it demonstrates. Read the context - where the input lands (HTML, attribute, script, SQL) determines the technique, not the payload alone. Also, a 200 status does not mean success; compare content.
Rule of thumb: change one variable at a time and compare against a baseline response. The difference between baseline and test response is your evidence.