---
description: >-
  The following documentation provides a standard guideline for web application
  penetration testing engagements.
---

# Web app pentesting methodology



{% embed url="https://github.com/OWASP/wstg/tree/master/document/4-Web_Application_Security_Testing" %}

{% stepper %}
{% step %}
### Reconnaisance/enumeration (active reconnaisance)

* [ ] _**1.1 Directory discovery**_&#x20;

**Manual**

* robots.txt
* sitemap.xml

**Tools**

* gobuster, wfuzz, ffuf, etc.
* ...

**Wordlists**

* usr/share/SecLists/Discovery/...
* /usr/share/wfuzz/...



Utilizing the word lists, common file extensions such as `.txt`, `.php`, `.pdf`, etc. can be appended  to discover specific named files.

```bash
$ gobuster dir -w ... -u https://example.com/path/FUZZ.txt # .txt
$ gobuster dir -w ... -u https://example.com/path/FUZZ.php # .php

```


{% endstep %}

{% step %}
### Exploitation techniques

* [ ] _**2.1 XSS**_
* [ ] _**2.2 Path traversal**_
* [ ] _**2.3 SQL Injections**_

Common ways to find out if the application is using a SQL database:

a) Fuzz with a few common SQL Injection inputs and observer the response

b) ...



* [ ] _**2.4 File upload vulnerabilities**_

a) Look for file upload features

b) Test with a valid input — observe the response

c) Test with malicious input such as `.php` extension — observe the response

...



* [ ] _**2.5 Misconfigurations**_

a) Default credentials for common known services

b) ...



* [ ] _**2.5 API hacking**_
{% endstep %}
{% endstepper %}
