/web-pentest

name: web-pentest
description: Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race
metadata:
  type: offensive
  phase: exploitation
  tools: burpsuite, sqlmap, ffuf, feroxbuster, nuclei, httpx, curl, wfuzz, dalfox, commix, jwt_tool, ysoserial, http-request-smuggler
  mitre: [T1190, T1059, T1552.005, T1078, T1539, T1505.003]
kill_chain:
  phase: [delivery, exploit]
  step: [3, 4]
  attck_tactics: [TA0001, TA0002]
  attck_techniques: [T1190, T1059.007, T1552.005, T1078, T1539, T1505.003, T1557]
depends_on: [recon-osint, vulnerability-analysis]
feeds_into: [exploit-development, cloud-security, network-attack]
inputs: [attack_surface_map, technology_fingerprint]
outputs: [finding_record, web_vulnerability_list]
references:
  - references/injection-sqli-cmdi.md
  - references/xss-csp-clientside.md
  - references/ssrf-cloud-metadata.md
  - references/http-desync-cache.md
  - references/ssti-deserialization.md
  - references/auth-api-access-control.md
  - references/business-logic-abuse.md
  - references/waf-bypass.md
  - references/xxe.md
  - references/proxy-mcp-integration.md
scripts:
  - scripts/desync_probe.py
  - scripts/jwt_forge.py
  - scripts/ssrf_toolkit.py
  - scripts/proto_ssti_gadgets.py
  - scripts/graphql_audit.py
  - scripts/race_single_packet.py
  - scripts/xss_csp_forge.py
  - scripts/session_entropy.py

Web Application Penetration Testing

When to Activate

• Web application security assessment (black/grey/white box)
• API security testing (REST, GraphQL, WebSocket)
• Authentication & session management testing (JWT, OAuth/OIDC, SAML)
• Business-logic and race-condition hunting
• WAF/CSP bypass, filter evasion, and CDN-layer attacks (desync, cache)
• Validating modern 2024-2026 vectors: HTTP/1.1 desync (0.CL/TE.0), SSRF->cloud

metadata, prototype-pollution->RCE, SSTI sandbox escapes

Input-Signal Routing (what to test when you see X)

Fast test selection — map an observed parameter/behavior to the right deep-dive:

| Input signal you observe | Test for | Go to | |--------------------------|----------|-------| | `id`, `uid`, `order_id`, `account`, GUID/sequential ref | IDOR/BOLA, access control | references/auth-api-access-control.md | | `url`, `next`, `callback`, `dest`, `webhook`, `image_url` | SSRF + cloud metadata, open redirect, OAuth chain | references/ssrf-cloud-metadata.md | | `price`, `qty`, `coupon`, `balance`, `status`, state change | business logic + single-packet race | references/http-desync-cache.md (race) | | template/preview/name reflected in output | SSTI -> RCE, reflected XSS | references/ssti-deserialization.md | | search/filter/sort reflected; `q=`, error echoes input | SQLi, XSS, command injection | references/injection-sqli-cmdi.md | | `token`, `jwt`, `Authorization`, `Cookie`, OAuth `state` | JWT forgery, session/OAuth flaws | references/auth-api-access-control.md | | empty/missing/`session=`; login accepts no creds; `user[$ne]=` | auth-check tampering (empty/null/NoSQL/type-juggle/HPP), token prediction | references/auth-api-access-control.md | | serialized blob / base64 object / `__proto__` | deserialization, prototype pollution | references/ssti-deserialization.md | | behind CDN/cache; `X-Forwarded-*`; keyed params | desync (0.CL/TE.0), cache poisoning | references/http-desync-cache.md |

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | SQL injection (UNION/blind/NoSQL) | T1190 | CWE-89 | references/injection-sqli-cmdi.md | scripts/ssrf_toolkit.py (probe pattern) / sqlmap | | OS command / argument injection | T1059 | CWE-78 / CWE-88 | references/injection-sqli-cmdi.md | - | | Reflected/stored/DOM XSS | T1059.007 | CWE-79 | references/xss-csp-clientside.md | scripts/xss_csp_forge.py | | CSP bypass / script gadgets | T1059.007 | CWE-1021 | references/xss-csp-clientside.md | scripts/xss_csp_forge.py | | Client-side prototype pollution -> XSS | T1059.007 | CWE-1321 | references/xss-csp-clientside.md | scripts/xss_csp_forge.py | | SSRF + cloud metadata theft | T1552.005 | CWE-918 | references/ssrf-cloud-metadata.md | scripts/ssrf_toolkit.py | | IMDSv2 bypass (Axios gadget) | T1552.005 | CWE-113 | references/ssrf-cloud-metadata.md | scripts/proto_ssti_gadgets.py | | HTTP request smuggling / desync | T1190 | CWE-444 | references/http-desync-cache.md | scripts/desync_probe.py | | Web cache poisoning / deception | T1557 | CWE-525 | references/http-desync-cache.md | scripts/desync_probe.py | | SSTI -> RCE (Jinja2/Twig/FM/...) | T1059 | CWE-1336 | references/ssti-deserialization.md | scripts/proto_ssti_gadgets.py | | Server-side prototype pollution -> RCE | T1059 | CWE-1321 | references/ssti-deserialization.md | scripts/proto_ssti_gadgets.py | | Insecure deserialization (Java/.NET/PHP) | T1059 | CWE-502 | references/ssti-deserialization.md | ysoserial / ysoserial.net | | JWT forgery (none/confusion/jku/jwk/kid) | T1078 | CWE-347 | references/auth-api-access-control.md | scripts/jwt_forge.py | | Auth-check tampering (empty/null/NoSQL-op/type-juggle/HPP) | T1556 | CWE-287 / CWE-697 / CWE-943 | references/auth-api-access-control.md | - | | Session token prediction (weak PRNG/entropy) | T1539 | CWE-330 | references/auth-api-access-control.md | scripts/session_entropy.py | | OAuth/OIDC/SAML auth bypass | T1078 | CWE-287 | references/auth-api-access-control.md | scripts/jwt_forge.py | | GraphQL abuse (batch/alias/depth) | T1190 | CWE-770 | references/auth-api-access-control.md | scripts/graphql_audit.py | | IDOR / BOLA / mass assignment | T1078 | CWE-639 / CWE-915 | references/auth-api-access-control.md | - | | Race condition (single-packet) | T1190 | CWE-362 | references/auth-api-access-control.md | scripts/race_single_packet.py | | Business-logic abuse (price/refund/workflow/race) | T1539 | CWE-841 | references