🔎 Web Application Penetration Testing Methodology

📖 Table of Contents

• Subdomain Enumeration
• Port Scanning with Nmap
• Subdomain Takeover
• Check for Live Hosts
• Request Smuggling Check
• Directory & File Discovery (Dirsearch)
• Vulnerability Scanning (Nuclei)
• URL Gathering
• Analyze JS & PHP Files
• Analyze JavaScript Files
• Parameter Discovery with Arjun
• SQL Injection Testing with sqlmap
• Bonus: Get Resolved IPs
• WordPress-Specific Enumeration
• Bonus Tools

1. 🧐 Subdomain Enumeration

• Enumerate subdomains and save them:

  subfinder -d target.com -o subdomains.txt
  

• Remove duplicates:

  cat subdomains.txt | anew > unique_subdomains.txt
  

• Remove the original list:

  rm subdomains.txt
  

2. ⚡ Port Scanning with Nmap

• Perform a full port scan on all subdomains:

  nmap -iL unique_subdomains.txt -o scan.txt
  

• For a specific domain and port service version check:

  nmap -p21 -sV svfear.com
  

3. 🇴 Subdomain Takeover

• Run Subzy to check for takeover vulnerabilities:

  subzy run --targets unique_subdomains.txt --vuln --hide_fails
  

4. 🌐 Check for Live Hosts

• Discover live domains:

  cat unique_subdomains.txt | httpx -o httpx
  

• Filter live domains with status code 200:

  cat httpx | httpx -mc 200 -o httpx200.txt
  

5. 🪵 Request Smuggling Check

• Use smuggler.py to detect request smuggling:

  cat httpx | smuggler
  

6. 📂 Directory & File Discovery (Dirsearch)

• Scan for hidden directories and sensitive files:

  dirsearch -l $(pwd)/httpx -o dirsearch.txt -i 200 -e conf,config,bak,backup,swp,old,db,sql,asp,aspx,py,rb,php,bkp,cache,cgi,csv,html,inc,jar,js,json,jsp,lock,log,rar,sql.gz,sql.zip,tar,txt,wadl,zip,xml
  

7. 🚨 Vulnerability Scanning (Nuclei)

• Run nuclei on all live hosts:

  nuclei -l httpx -o nuclei.txt -t /root/nuclei-templates/
  

8. 🔗 URL Gathering

• With WaybackURLs:

  cat httpx200.txt | waybackurls >> allurls.txt
  

• With Katana:

  katana -list httpx200.txt -o katana.txt
  

• With Gospider:

  gospider -s httpx200.txt -o gospider_output
  

• Combine all results:

  cat waybackurls.txt katana.txt gospider_output/* >> allurls.txt
  

9. 🔍 Analyze JS & PHP Files

• Extract .js files:

  cat allurls.txt | grep -E "\.js" >> js.txt
  

• Extract .php files:

  cat allurls.txt | grep -E "\.php" >> php.txt
  

10. 🧬 Analyze JavaScript Files

• Detect API keys and secrets:

  cat js.txt | mantra
  

• Scan with Nuclei for JS exposures:

  nuclei -l js.txt -t /root/nuclei-templates/http/exposures/
  

11. 🔑 Parameter Discovery with Arjun

• For GET parameters:

  arjun -i php.txt -o arjun.txt
  

• For POST parameters:

  arjun -i php.txt -m POST -o arjun_post.txt
  

12. 🫸 SQL Injection Testing with sqlmap

Example 1: GET Request

Found from Arjun:
https://mars.com/file.php?id=*

Test with sqlmap:

sqlmap -u "https://mars.com/file.php?id=*" --risk 3 --level 5 --random-agent --banner --batch --dbs --ignore-code 403

Example 2: POST Request

Arjun output:

POST / HTTP/1.1
Host: google.com
Origin: google.com
Content-Length: 120

id=1&name=ahmed&x=test

Test with sqlmap:

sqlmap -u "https://google.com" --data="id=*&name=*&x=*" --dbs --banner --batch

🧠 Bonus: Get Resolved IPs

• Resolve IPs from alive subdomains:

  cat alive.txt | httpx -o ip.txt -silent
  

🧰 WordPress-Specific Enumeration

• WordPress user enumeration:

  wpscan --url target.com --enumerate u
  

• WordPress plugin enumeration:

  wpscan --url target.com --enumerate p
  

• WordPress theme enumeration:

  wpscan --url target.com --enumerate t
  

• WordPress version detection:

  wpscan --url target.com --enumerate v
  

🔧 Bonus Tools

• subfinder - Subdomain discovery
• httpx - Fast HTTP toolkit
• nuclei - Fast vulnerability scanner
• Amass - DNS enumeration tool
• ffuf - Web fuzzing tool
• truffleHog - Detect secrets in code
• arjun - HTTP parameter discovery
• sqlmap - Automated SQL injection tool