Web application penetration testing of internal platforms and customer-facing applications. Assessment scope includes authentication systems, API endpoints, file upload functionality, session management, and business logic controls.
Phase 1: Reconnaissance
- Technology fingerprinting (Wappalyzer, HTTP headers)
- Directory enumeration (ffuf, Gobuster)
- JavaScript endpoint extraction (LinkFinder, GAP Burp extension)
Phase 2: Automated Scanning
- Burp Suite Professional active scan
- Nuclei with web CVE templates
- OWASP ZAP supplementary scan
Phase 3: Manual Testing (OWASP TG v4)
- Authentication and session management
- Access control / IDOR testing
- Injection (SQLi, XSS, SSTI)
- Business logic flaws
- API security testing
Phase 4: Exploitation and PoC
- Confirm exploitability with minimal impact
- Document evidence (screenshots, videos)
Phase 5: Reporting
- CVSS 3.1 risk rating
- Business impact analysis
- Remediation guidance| OWASP Category | Test Technique | Status |
|---|---|---|
| A01 Broken Access Control | IDOR, forced browsing, JWT manipulation | Tested |
| A02 Cryptographic Failures | TLS config, data in transit/rest | Tested |
| A03 Injection | SQLi (manual + SQLMap), XSS, SSTI | Tested |
| A05 Security Misconfiguration | Default creds, debug endpoints, CORS | Tested |
| A07 Auth Failures | Brute force, password reset, account enum | Tested |
| A09 Logging Failures | Log review, event monitoring check | Tested |
| A10 SSRF | URL parameter testing, redirect abuse | Tested |
Penetration testing output directly feeds the detection engineering pipeline. Each confirmed finding generates a corresponding detection rule to identify similar exploitation attempts in production traffic. This creates a virtuous cycle between offensive and defensive security operations.