Advanced Web Application Penetration Testing
Advanced web testing assumes you already know OWASP basics and now asks you to reason about why a control fails. The core concepts cluster into four areas. First, injection beyond the textbook: SQL injection in ORDER BY clauses, second-order injection where input is stored then reused in a different query context, and NoSQL operator injection ($ne, $gt) where a JSON body changes query semantics rather than breaking syntax. Second, access-control logic: IDOR/BOLA, forced browsing, and privilege escalation where the flaw is a missing server-side authorization check, not a hidden link. Third, modern auth and session mechanics: JWT alg:none and algorithm-confusion attacks, weak HMAC secrets, unsigned claims trusted by the backend, and OAuth misconfigurations like missing state or open redirect_uri. Fourth, client-side and template issues: DOM XSS via innerHTML/eval sinks, SSTI in Jinja2/Twig/Freemarker where {{7*7}} returning 49 proves evaluation, and deserialization gadgets.
Traps in questions: confusing reflected with stored XSS, assuming a WAF blocks a payload class (encoding and case variation still matter), and treating authentication bypass as authorization bypass. A frequent trap is a payload that works in the browser but is filtered server-side, or vice versa.
Rule of thumb: always identify the sink and the trust boundary before choosing a payload. Prove impact minimally - a boolean oracle or a single arithmetic result - rather than dumping data.
Worked example: a login endpoint returns different timing for valid vs invalid users. That is a blind boolean/timing oracle; escalate carefully and document the inference method rather than brute-forcing credentials.