Web Application Enumeration and Exploitation
Web Application Enumeration and Exploitation
This domain tests web recon, authentication logic, and common injection and file flaws. CPTS expects you to map an application before attacking it and to prove exploitability with minimal damage.
Core rules
- Fingerprint the stack: server headers, cookies, error pages, JavaScript frameworks, and exposed files. Check robots.txt, sitemap.xml, .git, backups, and API docs.
- Discover content and parameters: ffuf or feroxbuster for directories, vhost fuzzing, arjun for hidden parameters, and manual review of JavaScript for endpoints.
- Test authentication and authorization: default creds, registration, password reset, JWT handling, IDOR, and privilege boundaries. Compare responses as different users.
- Cover the core flaw classes: SQLi, command injection, file inclusion, file upload, SSRF, XXE, deserialization, and XSS. Use Burp Suite Repeater to isolate one variable at a time.
- Validate with a safe proof: sleep timing, a benign file read, or an out-of-band callback. Do not dump entire databases or upload a destructive webshell when a proof suffices.
Worked example
A login page returns a generic error. You enumerate with ffuf and find /api/v1/login and /api/v1/users. The users endpoint returns 401 but leaks a role field in an error. You register a normal account, capture the JWT, and decode it: the payload has 'role':'user'. Changing it to 'admin' fails signature validation, so you test IDOR on /api/v1/users/2 instead. It returns another user's data. The reasoning is: discover endpoints, understand auth, test the weakest control, and stop at a reproducible impact.
Traps
Brute-forcing directories before reading the page source, trusting 403/302, missing vhosts, ignoring URL encoding and parameter pollution, testing only GET, and using SQLMap without understanding the injection point. Also: no evidence of the request/response pair.