{"id":21400629,"url":"https://github.com/cybersecurityup/web-pentest-resume-tips","last_synced_at":"2026-01-02T08:48:42.354Z","repository":{"id":41440217,"uuid":"493449004","full_name":"CyberSecurityUP/Web-PenTest-Resume-Tips","owner":"CyberSecurityUP","description":null,"archived":false,"fork":false,"pushed_at":"2022-05-18T17:07:01.000Z","size":276,"stargazers_count":19,"open_issues_count":0,"forks_count":5,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-23T02:45:36.567Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CyberSecurityUP.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-05-17T23:57:02.000Z","updated_at":"2024-03-12T16:20:34.000Z","dependencies_parsed_at":"2022-09-01T13:40:41.957Z","dependency_job_id":null,"html_url":"https://github.com/CyberSecurityUP/Web-PenTest-Resume-Tips","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FWeb-PenTest-Resume-Tips","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FWeb-PenTest-Resume-Tips/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FWeb-PenTest-Resume-Tips/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FWeb-PenTest-Resume-Tips/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CyberSecurityUP","download_url":"https://codeload.github.com/CyberSecurityUP/Web-PenTest-Resume-Tips/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243893905,"owners_count":20364916,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-22T15:23:20.133Z","updated_at":"2026-01-02T08:48:42.323Z","avatar_url":"https://github.com/CyberSecurityUP.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"#  Web PenTest Resume by Joas\n\n## Test Upload of Malicious Files\n\n### \"- Identify the file upload functionality.\n\n### - Review the project documentation to identify what file types are considered acceptable, and what types would be considered dangerous or malicious.\n\n### - Determine how the uploaded files are processed.\n\n### - Obtain or create a set of malicious files for testing.\n\n### - Try to upload the malicious files to the application and determine whether it is accepted and processed.\"\n\n## Testing for XPath Injection\n\n### - Identify XPATH injection points.\n\n## Default pages with interesting info\n\n### /robots.txt\n\n### /sitemap.xml\n\n### /crossdomain.xml\n\n### /clientaccesspolicy.xml\n\n### /.well-known/\n\n### Check also comments in the main and secondary pages.\n\n## Testing for IMAP SMTP Injection\n\n### \"- Identify IMAP/SMTP injection points.\n\n### - Understand the data flow and deployment structure of the system.\n\n### - Assess the injection impacts.\"\n\n## Test Business Logic Data Validation\n\n### \"- Identify data injection points.\n\n### - Validate that all checks are occurring on the back end and can't be bypassed.\n\n### - Attempt to break the format of the expected data and analyze how the application is handling it.\"\n\n## Testing for Code Injection\n\n### \"- Identify injection points where you can inject code into the application.\n\n### - Assess the injection severity.\"\n\n## Testing for Command Injection\n\n### - Identify and assess the command injection points.\n\n## Testing Directory Traversal File Include\n\n### \"- Identify injection points that pertain to path traversal.\n\n### - Assess bypassing techniques and identify the extent of path traversal.\"\n\n## Scan log4j using BBRF\n\n## S3 Buckets\n\n### Using wappalyzer browser plugin\n\n### Using BURP (spidering the web) or by manually navigating through the page all resources loaded will be save in the History.\n\n### Enumerating AWS User\n\n### Get User Policies\n\n### Get Snapshots\n\n### https://hacktricks.boitatech.com.br/pentesting/pentesting-web/buckets/aws-s3\n\n## Testing for Bypassing Authentication Schema\n\n### - Ensure that authentication is applied across all services that require it.\n\n## Testing GraphQL\n\n### \"- Assess that a secure and production-ready configuration is deployed.\n\n### - Validate all input fields against generic attacks.\n\n### - Ensure that proper access controls are applied.\"\n\n## Login Page Identified\n\n### Testing for Default Credentials\n\n# Enumerate the applications for default credentials and validate if they still exist.\n# Review and assess new user accounts and if they are created with any defaults or identifiable patterns.\n\n## Review the HSTS header and its validity.\n\n## Review Webpage Content for Information Leakage\n\n## Tools\n\n### https://github.com/qazbnm456/awesome-web-security\n\n### https://book.hacktricks.xyz/pentesting-web/web-vulnerabilities-methodology\n\n### https://book.hacktricks.xyz/pentesting/pentesting-web\n\n### https://github.com/KingOfBugbounty/KingOfBugBountyTips\n\n### https://book.hacktricks.xyz/other-web-tricks\n\n### Amass\n\n### Anew\n\n### Anti-burl\n\n### Assetfinder\n\n### Axiom\n\n### Bhedak\n\n### CF-check\n\n### Chaos\n\n### Cariddi\n\n### Dalfox\n\n### DNSgen\n\n### Filter-resolved\n\n### Findomain\n\n### Fuff\n\n### Gargs\n\n### Gau\n\n### Gf\n\n### Github-Search\n\n### Gospider\n\n### Gowitness\n\n### Hakrawler\n\n### HakrevDNS\n\n### Haktldextract\n\n### Haklistgen\n\n### Html-tool\n\n### Httpx\n\n### Jaeles\n\n### Jsubfinder\n\n### Kxss\n\n### LinkFinder\n\n### log4j-scan\n\n### Metabigor\n\n### MassDNS\n\n### Nuclei\n\n### Naabu\n\n### Qsreplace\n\n### Rush\n\n### SecretFinder\n\n### Shodan\n\n### ShuffleDNS\n\n### SQLMap\n\n### Subfinder\n\n### SubJS\n\n### Unew\n\n### WaybackURLs\n\n### Wingman\n\n### Notify\n\n### Goop\n\n### Tojson\n\n### GetJS\n\n### X8\n\n### Unfurl\n\n### XSStrike\n\n### Page-fetch\n\n### Burp Suite\n\n### OWASP-ZAP\n\n### Nikto\n\n### Waybackurl\n\n### Wfuzz\n\n### SecList\n\n### TurboSearch\n\n## CVE Scans\n\n## Content Discovery\n\n## File Backups\n\n## Type of CMS\n\n### JBoss\n\n### ColdFusion\n\n### Weblogic\n\n### Tomcat\n\n### Railo\n\n### Axis2\n\n### Glassfish\n\n### Wordpress\n\n### Drupal\n\n### Joomla\n\n### vbulletin\n\n### Moodle\n\n### https://book.hacktricks.xyz/network-services-pentesting/pentesting-web\n\n## Google Dorks\n\n### https://www.exploit-db.com/google-hacking-database\n\n## Shodan Check URL\n\n## Waybackup Machine\n\n## Check Web Directorys\n\n## Check .git \n\n## Check .env\n\n## Hidden Parameters Discovery\n\n## Server Vulnerabilities Identificaiton\n\n## Search CORS\n\n## Verificy CERT SSL\n\n## Spoofcheck\n\n## Extract .js in Subdomains\n\n## API Endpoints\n\n## Web Spidering\n\n## Server Version Identification\n\n## Check if you have any WAF\n\n### Imperva\n\n### Cloudflare\n\n### Sucuri\n\n### Fortiweb\n\n### AWS WAF\n\n### Barracuda\n\n## DNS Transfer Zone\n\n## Extract Subdomains\n\n## API Keys\n\n## Forcing Erros\n\n## Robots.txt\n\n## CMS Scanners\n\n## Github Recon and Sensitive Information\n\n## ASN Identification\n\n## Tomcat Discovery information Sensitive\n\n## Cloud Discovery\n\n## Whois\n\n## Plugins and Libraries Vulnerable\n\n## Old Content\n\n## Tomcat Admin Page\n\n## Data Input \n\n### Data Input Parameters Testing\n\n## Asset Identification\n\n## CGI Server Scanner\n\n## Misconfigurations in Server and Application\n\n## Parser Logics\n\n## Database Identified\n\n### MySQL\n\n### MSSQL\n\n### Oracle\n\n## phpmyadmin Identified\n\n## Phpinfo\n\n### Exact PHP version.\n\n### Exact OS and its version.\n\n### Details of the PHP configuration.\n\n### Internal IP addresses.\n\n### Server environment variables.\n\n### Loaded PHP extensions and their configurations.\n\n## Review Webserver Metafiles for Information Leakage\n\n## OSINT Framework\n\n### https://osintframework.com/\n\n##  Enumerate supported HTTP methods.\n\n##  Test for access control bypass.\n\n##  Test XST vulnerabilities.\n\n##  Test HTTP method overriding techniques.\n\n## Testing for Privilege Escalation\n\n### \"- Identify injection points related to privilege manipulation.\n\n### - Fuzz or otherwise attempt to bypass security measures.\"\n\n## Testing for Reflected Cross Site Scripting\n\n### \"- Identify variables that are reflected in responses.\n\n### - Assess the input they accept and the encoding that gets applied on return (if any).\"\n\n## Testing for Stored Cross Site Scripting\n\n### \"- Identify stored input that is reflected on the client-side.\n\n### - Assess the input they accept and the encoding that gets applied on return (if any).\"\n\n## Testing for HTTP Verb Tampering\n\n## Testing for HTTP Parameter Pollution\n\n### \"- Identify the backend and the parsing method used.\n\n### - Assess injection points and try bypassing input filters using HPP.\"\n\n## Testing for SQL Injection\n\n### \"- Identify SQL injection points.\n\n### - Assess the severity of the injection and the level of access that can be achieved through it.\"\n\n## Testing for LDAP Injection\n\n## Testing for XML Injection\n\n### \"- Identify XML injection points.\n\n### - Assess the types of exploits that can be attained and their severities.\"\n\n## Testing for SSI Injection\n\n### \"- Identify SSI injection points.\n\n### - Assess the severity of the injection.\"\n\n## Testing for Format String Injection\n\n### - Assess whether injecting format string conversion specifiers into user-controlled fields causes undesired behaviour from the application.\n\n## Testing for Incubated Vulnerability\n\n### \"- Identify injections that are stored and require a recall step to the stored injection.\n\n### - Understand how a recall step could occur.\n\n### - Set listeners or activate the recall step if possible.\"\n\n## Testing for HTTP Splitting Smuggling\n\n### \"- Assess if the application is vulnerable to splitting, identifying what possible attacks are achievable.\n\n### - Assess if the chain of communication is vulnerable to smuggling, identifying what possible attacks are achievable.\"\n\n## Testing for HTTP Incoming Requests\n\n### \"- Monitor all incoming and outgoing HTTP requests to the Web Server to inspect any suspicious requests.\n\n### - Monitor HTTP traffic without changes of end user Browser proxy or client-side application.\"\n\n## Testing for Host Header Injection\n\n### \"- Assess if the Host header is being parsed dynamically in the application.\n\n### - Bypass security controls that rely on the header.\"\n\n## Testing for Server-side Template Injection\n\n## Testing for Server-Side Request Forgery\n\n## Forcing errors\n\n### Access fake pages like /whatever_fake.php (.aspx,.html,.etc)\n\n### Add \"[]\", \"]]\", and \"[[\" in cookie values and parameter values to create errors\n\n### Generate error by giving input as /~randomthing/%s at the end of URL\n\n### Try different HTTP Verbs like PATCH, DEBUG or wrong like FAKE\n\n## Map Application Architecture\n\n### - Generate a map of the application at hand based on the research conducted.\n\n## Search .json subdomain\n\n## Checking invalid certificate\n\n## Search to files using assetfinder and ffuf\n\n## Using shodan to jaeles\n\n## Browser Extensions\n\n### Postman Interceptor\n\n### EditThisCookie\n\n### d3coder\n\n## Reporting Tool\n\n### template-generator\n\n### bountyplz\n\n### dradisframework\n\n### Serpico\n\n## Proxies\n\n### Abusing hop-by-hop headers\n\n### Cache Poisoning/Cache Deception\n\n### HTTP Request Smuggling\n\n### H2C Smuggling\n\n### Server Side Inclusion/Edge Side Inclusion\n\n### Uncovering Cloudflare\n\n### XSLT Server Side Injection\n\n## PortScanner Identification\n\n## Check Response HTTP/HTTPS\n\n## Test for Subdomain Takeover\n\n###  Enumerate all possible domains (previous and current).\n\n### Identify forgotten or misconfigured domains.\n\n## Bypasses\n\n### Bypass Payment Process\n\n### Captcha Bypass\n\n### Login Bypass\n\n### Race Condition\n\n### Rate Limit Bypass\n\n### Reset Forgotten Password Bypass\n\n### Registration Vulnerabilities\n\n### 2FA/OPT Bypass\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcybersecurityup%2Fweb-pentest-resume-tips","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcybersecurityup%2Fweb-pentest-resume-tips","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcybersecurityup%2Fweb-pentest-resume-tips/lists"}