Automation of the reconnaissance phase during Web Application Penetration Testing III

This article is a continuation of the previous one available at this link and is the final article in the reconnaissance automation trilogy. After enumerating subdomains, selecting one of them, and further enumerating to find endpoints and queries, it is time to look for bugs.

In this episode, you will learn about the various techniques and tools that will help you detect those misconfigurations of the application being tested. You will also learn how to use them and automate the entire process.

Described research is based on the OWASP methodology and the methodology in the book “Hack Tricks” by Carlos Polop.

One thing to mension — I will not describe those vulnerabilities in this article. Rather I will focus on automation processs. If you are not familiar in described vulnerabilities click on the below links to learn more about each of them and practice how to find and exploit.

1. Cross-Site Request Forgery (CSRF)
2. Cryptographic issues in TLS/SSL servers
3. Cross-Site Scripting (XSS):
   a) Reflected XSS
   b) DOM XSS
   c) Blind XSS
4. URL rewriting via request header:
   a) X-Rewrite-Url
   b) X-Original-Url
5. Out-of-bounds interaction (OOB):
   a) Blind Remote Code Execution (RCE)
   b) Blind Cross-Site Scripting (XSS)
   c) Blind SQL injection (SQLi)
   d) Blind Server Side Request Forgery (SSRF)
6. Server-Side Template Injection (SSTI)
7. Java insecure deserialization
8. Carriage Return Line Feed Injection (CRLF)
9. Reflected Open Redirect (OR)
10. Bypassing 403/401 endpoints
11. WordPress flaws:
    a) Broken Authentication
    b) Sensitive Data Exposure
    c) Enumeration of Components with Known Vulnerabilities
    d) Scanning Internal Network
    e) Server-side Request Forgery (SSRF)
12. HTTP request smuggling
13. Hop-by-hop deletion
14. Broken links enumeration
15. SQL injection (SQLi)
16. JSON Web Tokens flaws (JWT)
17. Directory Traversal / Path Traversal