Web Application Attacks
What to know
Web is usually the widest attack surface. Core families: injection (SQLi, command injection, LDAP/NoSQL injection), file inclusion and path traversal, file upload flaws, authentication and session problems (default credentials, IDOR, missing function-level access control, weak JWT handling), XSS (reflected, stored, DOM), SSRF, XXE, and deserialization. Tooling: Burp Suite as an intercepting proxy, ffuf/gobuster for content and parameter discovery, sqlmap for SQLi once a parameter is proven injectable, Nikto for a quick baseline.
Method: map the application by hand, note every parameter, cookie, header and hidden field, then probe each one. For SQLi, start with a quote and an arithmetic expression to distinguish string from numeric context; then UNION with a matching column count; then boolean and time-based blind. For LFI, vary traversal depth, try null bytes on older PHP, use php://filter to read source, and consider log poisoning for execution. For uploads, test extension blacklists (.php5, .phtml, .phar), content-type checks, magic bytes, and whether the upload directory actually executes code.
Traps
- Firing sqlmap without proving injectability and without knowing the DBMS.
- Forgetting URL encoding, double encoding, and case variation that bypasses naive filters.
- Abandoning after a WAF block instead of trying comment insertion, alternate whitespace, or a different parameter.
- Ignoring parameters inside JSON bodies, XML, and custom headers.
Rule of thumb
Change one variable per request and keep the baseline response for comparison; a finding you cannot reproduce with a single curl command is not a finding yet.