Web Application and Database Exploitation
This domain tests exploitation of web applications and databases: injection, broken access control, authentication flaws, and safe proof-of-concept work. The exam favors precise requests and minimal data extraction over destructive exploitation.
Core rules and concepts
- Map the attack surface: parameters, cookies, headers, APIs, file uploads, and hidden fields. Use an intercepting proxy and keep a request log.
- Injection families include SQL, NoSQL, command, LDAP, and template injection. Test with boolean, time-based, and error-based probes, then confirm with a controlled query.
- Access control flaws include IDOR, forced browsing, and missing function-level checks. Authentication flaws include weak session handling, MFA bypass, and credential stuffing exposure.
- XSS types are reflected, stored, and DOM-based; each needs a different proof. CSRF requires a state-changing action and missing anti-CSRF defenses.
- Database exploitation should respect least privilege: prove read access, do not dump personal data, and avoid write or delete operations.
Worked example
A parameter returns a database error when given a single quote. You send two requests that compare true and false boolean conditions and observe different responses. You then extract only the database version and current user, not table contents. The reasoning: the version and user demonstrate injection and privilege level with minimal data exposure. You recommend parameterized queries and least-privilege database accounts.
Traps
Do not run destructive SQL or drop tables. Do not test third-party payment or identity providers outside scope. Avoid calling reflected XSS stored without evidence. A WAF block is not proof of safety; it may only change the payload encoding.