eWPT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Rules of engagement

The written agreement defining in-scope targets, allowed techniques, test windows, credentials provided, prohibited actions, and emergency contacts. Penetration testing without it is unauthorized access regardless of intent.

Black-box versus white-box testing

Black-box gives the tester no internal knowledge and mimics an external attacker. White-box provides source code, credentials, and architecture, yielding deeper coverage. Their results are not directly comparable when assessing risk.

Burp Intruder attack types

Sniper cycles one payload set through one position at a time. Battering ram uses the same payload in all positions. Pitchfork pairs payload sets in parallel. Cluster bomb tries every combination of payload sets.

OWASP WSTG categories

The Web Security Testing Guide organizes tests into INFO, CONF, IDNT, ATHN, ATHZ, SESS, INPV, ERRH, CRYP, BUSL, CLNT, and APIT, covering information gathering through client-side and API testing.

Username enumeration

Observing differences in response content, status code, or timing between valid and invalid usernames. It enables targeted password attacks and is a finding even without a successful login.

Session fixation

An attack where the tester forces a known session identifier on the victim and the application does not issue a new identifier after authentication, allowing the attacker to reuse the victim's authenticated session.

Cookie security attributes

Secure restricts the cookie to HTTPS. HttpOnly blocks JavaScript access, mitigating XSS cookie theft. SameSite=Strict or Lax limits cross-site sending, reducing CSRF exposure. These limit impact, not vulnerability existence.

CVSS v3.1 base metrics

Base score combines Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, and Availability. The vector string must reflect preconditions actually observed during testing.

Certificate transparency recon

Certificate transparency logs such as crt.sh record issued TLS certificates. Querying them by domain reveals subdomains and hostnames passively, without sending any traffic to the target's infrastructure.

DNS zone transfer

An AXFR query to an authoritative nameserver returns all records for a zone. If unrestricted, it discloses every hostname and IP in the domain. Test with dig AXFR against each nameserver.

Technology fingerprinting signals

Headers like Server and X-Powered-By, cookie names such as PHPSESSID or JSESSIONID, error page formats, favicon hashes, and default file paths reveal the framework and server version in use.

Content discovery status codes

During directory brute forcing, 200 indicates existence, 403 indicates existence but restricted access, 301 or 302 indicates a redirect worth following, and 404 indicates absence. Filter by response size to reduce noise.

Backup file extensions

Common backup suffixes include .bak, .old, .orig, .save, .swp, .zip, .tar.gz, and trailing tilde. When served by the web server, these files can disclose application source code and credentials.

Source map disclosure

JavaScript bundles often ship with a .map file referencing original source. Fetching it reconstructs readable code, exposing API endpoints, internal logic, and sometimes hardcoded secrets or keys.

Google dork operators

site: restricts to a domain, inurl: matches URL substrings, filetype: or ext: matches extensions, intitle: matches page titles. Combined, they locate exposed configs, admin panels, and directory listings.

API documentation enumeration

Common specification paths include /swagger.json, /openapi.json, /api-docs, and /v2/api-docs. GraphQL endpoints can be introspected to list types, queries, and mutations when introspection is enabled.

WAF detection

Identify a web application firewall by response headers, blocking pages, cookie challenges, and differing behavior on encoded payloads. A WAF changes bypass strategy but does not remove the underlying vulnerability.

Virtual host enumeration

Sending requests with different Host headers to the same IP reveals additional applications hosted on one server. Responses differing in content, size, or status indicate a distinct virtual host.

UNION-based SQL injection

Appending UNION SELECT requires the same column count and compatible data types as the original query. Determine column count with ORDER BY n incrementally or by adding NULL placeholders until errors stop.

Blind SQL injection

When output is not reflected, infer data from boolean true/false response differences or time delays such as SLEEP or pg_sleep. Time-based testing is slower but works without visible output.

NoSQL operator injection

MongoDB-style applications accepting JSON can be bypassed with query operators. A login payload of username {"$ne":null} and password {"$ne":null} matches the first document, authenticating without valid credentials.

DOM-based XSS sinks

DOM XSS occurs when attacker-controlled sources reach dangerous sinks such as innerHTML, document.write, eval, or location assignment. The payload never reaches the server, so server-side filtering does not help.

XSS output context

The injection context determines the payload: HTML body, attribute value, JavaScript string, URL, or CSS. Breaking out of the context requires matching quotes, brackets, and encoding rules for that specific location.

CSRF preconditions

Cross-site request forgery requires a state-changing action, authentication via cookies or other automatically sent credentials, and no unpredictable token or SameSite protection. A cross-origin auto-submitting form demonstrates impact.

SSRF cloud metadata target

Server-side request forgery can reach the instance metadata service at 169.254.169.254, which may return temporary credentials. Filter bypasses include decimal IP notation, redirects, and DNS rebinding.

XXE out-of-band testing

When entity output is not reflected, define an external parameter entity pointing to a tester-controlled host. DNS or HTTP callbacks confirm the parser resolves external entities even without visible response changes.

Local file inclusion wrappers

PHP stream wrappers extend LFI: php://filter/convert.base64-encode/resource=index.php discloses source, php://input reads the request body, and data:// embeds payloads when allow_url_include is enabled.

IDOR testing method

Change object identifiers such as user IDs or document numbers in requests, then compare responses between two accounts with different privilege levels. The flaw is missing authorization, not predictable identifiers.

JWT algorithm confusion

If a server accepts HS256 after issuing RS256 tokens, the attacker signs a forged token using the public key as the HMAC secret. Also test alg:none and weak secret cracking with hashcat.

Insecure deserialization tooling

Gadget chain generators include ysoserial for Java, ysoserial.net for .NET, and PHPGGC for PHP. Look for serialized blobs in cookies, hidden fields, and ASP.NET ViewState parameters.

Report finding structure

Each finding contains a title, severity with CVSS vector, affected endpoint and parameter, reproduction steps, request and response evidence, business impact, and specific remediation guidance. Order findings by severity.

Retest verification

A retest confirms the fix addresses the root cause rather than only the reported payload. Document residual risk, variant bypasses still working, and any regressions introduced by the remediation.