Web Application Penetration Testing
Foundations
Web testing starts with understanding HTTP: methods, status codes, headers, cookies, and how state is maintained. Map the application manually and with a proxy such as Burp Suite or ZAP, then enumerate directories, parameters, hidden fields, API endpoints, and authentication flows. Know the OWASP Top 10 categories and how they appear in practice: injection, broken access control, authentication failures, misconfiguration, and vulnerable components are recurring themes.
Common vulnerability classes
SQL injection manipulates query structure; test with a single quote and look for errors or behavior changes, then confirm with boolean or time-based techniques. Cross-site scripting comes in reflected, stored, and DOM-based forms; context determines the payload, and output encoding plus CSP are the defenses. Access control flaws include IDOR and missing function-level checks: change an object identifier and see whether another user's data returns. Also review file upload restrictions, path traversal and local file inclusion, command injection, CSRF protections, session cookie flags, and security headers.
Traps candidates hit
Questions often confuse reflected and stored XSS, or assume a payload that fires in one context works in another. Blind SQL injection requires inference through timing or boolean responses, not visible output. A WAF blocking a payload does not mean the vulnerability is absent; it means the test needs adjustment. Avoid reporting a finding based only on a scanner alert. Encoding matters: URL encoding, HTML entities, and double encoding change payload behavior, and parameter pollution can bypass naive filters.
Rule of thumb
For access control, always test with two accounts and swap identifiers; for injection, prove impact with a controlled, minimal payload. Record the request and response pair as evidence.