eWPTXv3 Notes Part1

I take notes while I study for the eWPTXv3. I separated all the notes according to INE’s six main topics.

Intro to Advanced Web Application Penetration Testing Notes

Web App Pentest Methodology

There are plenty of methodologies that used by professionals. (PTES, WSTG)

Instructor recommends WSTG’s pdf version as a resource.

1- Pre-Engagement

• Define the scope and objectives of the penetration test.
• Obtain permission from the application owner to conduct the test.
• Establish a set of Rules of Engagement(RoE) that outline the specific rules, constraints, and guidelines for the testing process.
• Sign necessary contracts and non-disclosure agreements (NDAs) with the organization to protect sensitive information and ensure confidentiality.
• Define start date and timeline.

2- Information Gathering & Reconnaissance

• Passive Reconnaissance (security.txt, robots.txt, sitemap.xml etc.)
• Active Reconnaissance (Subdomain enumeration, directory enumeration, file and sensitive data discovery)
• Port Scanning (Nmap or Rustscan)
• Google Dorking
• Version, Tech and Framework Control (Wappalyzer, BuiltWith,whatweb)
• WAF control (wafw00f)
• Screenshots (Eyewitness)
• Email harvesting (theHarvester)

3- Threat Modeling

• Analyze the application’s architecture to identify potential threats and attack vectors.
• Analyze attack surface to understand how attackers can interact with the application.

4- Vulnerability Scanning

• Use automated web application vulnerability scanners. (Burp Suite, OWASP ZAP)

5- Manual Testing & Exploitation

• Perform manual tests. Test for input validation issues, authentication bypass, authorization flaws, and business logic vulnerabilities.

6- Authentication & Authorization Testing

• Test authentication mechanisms.
• Test logout mechanisms.
• Test authorization mechanism. (for example can unauthorized user access sensitive info)

7- Session Management Testing

• Test session management mechanism. (Session Hijacking, Session-related attacks)
• Test session token handling and timeout mechanism.

8- Information Disclosure

• Observe error messages, server responses and page source codes.
• Review sensitive information handling process of the application. (user data)

9- Business Logic Testing

• Test business logic related flaws.

10- Client-Side Testing

• Test XSS, CSRF and Dom-based flaws.

11- Reporting & Remediation

• Document the identified security vulnerabilities and risks.
• Provide a report to developers and stakeholders, including recommendations for remediation.
• Check the identified vulnerabilities after the customers fixes. Ensure that the fixes were successful.

12- Post-Engagement

• Conduct a post-engagement meeting to discuss the test results with the customers.

Recommendation: HackTricks — External Recon Methodology