CoreQ Academy4.5 Given a scenario, perform web application attacks using the appropriate tools.
Web apps are the most common test target. Know each attack, the evidence it leaves and the fix you will recommend.
Attack types
- Brute-force attack
- Guessing credentials, IDs or paths repeatedly.
- Collision attack
- Finding two inputs with the same hash to forge data or bypass checks.
- Directory traversal
- ../ sequences to read files outside the web root.
- Server-side request forgery (SSRF)
- Making the server request internal URLs (e.g. cloud metadata).
- Cross-site request forgery (CSRF)
- Tricking a logged-in user's browser into submitting a request. Defence: anti-CSRF tokens, SameSite cookies.
- Deserialization attack
- Untrusted serialized objects trigger code execution when deserialized.
- Injection attacks
- Untrusted input interpreted as code or commands.
- Structured Query Language (SQL) injection
- Manipulating database queries.
- Command injection
- Injecting OS commands through app input.
- Cross-site scripting (XSS)
- Injecting script that runs in other users' browsers.
- Server-side template injection
- Injecting template syntax that the server evaluates, often leading to code execution.
- Insecure direct object reference
- Changing an ID (e.g. /invoice/1001 to 1002) to access other users' data. Defence: server-side authorisation checks.
- Session hijacking
- Stealing or predicting session tokens to impersonate users.
- Arbitrary code execution
- Running attacker code on the server.
- File inclusions
- Making the app include files it should not.
- Remote file inclusion (RFI)
- Including a file from an attacker-controlled URL.
- Local file inclusion (LFI)
- Including local server files, such as configs or logs.
- Web shell
- A script uploaded to the server that gives remote command access.
- API abuse
- Exploiting weak API authorisation, missing rate limits or excessive data exposure.
- JSON Web Token (JWT) manipulation
- Tampering with tokens: "alg: none", weak secrets or key confusion. Defence: strict algorithm and signature validation.
Tools
- TruffleHog
- Finds secrets exposed in web app repos and assets.
- Burp Suite
- Intercepting proxy and testing suite for web apps.
- Zed Attack Proxy (ZAP)
- Open-source intercepting proxy and scanner from OWASP.
- Postman
- API client for crafting and replaying API requests.
- sqlmap
- Automates detection and exploitation of SQL injection.
- Gobuster/DirBuster
- Brute-force discovery of directories, files and subdomains.
- Wfuzz
- Web fuzzer for parameters, headers and paths.
- WPScan
- WordPress vulnerability scanner for core, plugins and themes.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.5 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.