The Web Application Penetration Testing Guide

Introduction

In today’s digital landscape, web applications are the backbone of countless services, from banking and e-commerce to social media and enterprise tools. Their ubiquity also makes them targets for attackers seeking to exploit vulnerabilities, steal sensitive data, or disrupt services. Web Application Penetration Testing is a proactive approach to identifying and mitigating security weaknesses before malicious actors can exploit them.

This guide provides a structured, practical approach to assessing web application security. It covers key concepts, methodologies, tools, and techniques used by ethical hackers and security professionals. By understanding how attackers think and operate, testers can identify issues such as SQL injection, Cross-Site Scripting (XSS), insecure authentication, and more, helping organizations strengthen their defenses and protect critical assets.

Whether you are new to application security or an experienced professional refining your skills, this guide can serve as a roadmap for web application penetration testing.

TryHackMe learning paths

TryHackMe offers web application penetration testing paths such as Web Fundamentals and Web Application Pentesting.

PortSwigger Web Security Academy

PortSwigger Academy is a free resource for learning web application security. Its structured modules progress from basic concepts to advanced topics and provide practical labs for safe, controlled practice.

Hack The Box Academy

Hack The Box Academy combines theory with hands-on labs, simulating scenarios in which learners investigate and test web application vulnerabilities.

Hackersploit

Hackersploit is a cybersecurity training and consulting platform founded by Alexis Ahmed. It is known for practical tutorials and training material on ethical hacking, penetration testing, Linux security, and red-team operations.

Applications to test on

Practice in intentionally vulnerable applications, local labs, or platforms where you have permission to test.

1. DVWA (Damn Vulnerable Web Application)

Purpose: A beginner-friendly platform for practicing common vulnerabilities such as SQL injection, XSS, CSRF, and file inclusion.

Notes: Useful for learning fundamentals and experimenting with tools such as SQLMap, Burp Suite, and XSStrike.

Website: DVWA project

2. OWASP Juice Shop

Purpose: A modern, intentionally vulnerable application covering OWASP Top 10 vulnerabilities and more.

Notes: Challenges cover SQL injection, XSS, authentication bypass, and other topics. The application also includes a gamified scoreboard.

Website: OWASP Juice Shop

3. WebGoat

Purpose: OWASP’s educational project for hands-on web application security lessons.

Notes: Lessons cover injection, broken access control, and insecure deserialization, emphasizing the concepts behind vulnerabilities.

Website: OWASP WebGoat

4. bWAPP (Buggy Web Application)

Purpose: A practice platform with more than 100 web vulnerabilities, including SQL injection, XSS, and CSRF.

Notes: Useful for beginner and intermediate learners; it can be run locally or in a virtual machine.

Website: bWAPP project

5. Security Shepherd

Purpose: A simulated application environment with realistic security weaknesses.

Notes: Focuses on topics such as business logic flaws, authentication, and session security.

Website: OWASP Security Shepherd

6. Hack The Box and TryHackMe web machines

Purpose: Interactive labs and machines designed to teach web security testing.

Notes: Hack The Box includes web-focused machines such as Laboratory, Passage, and Developer. TryHackMe offers structured learning paths such as OWASP Top 10 and Web Fundamentals.

Platforms: Hack The Box · TryHackMe

7. OWASP Mutillidae II

Purpose: An intentionally vulnerable web application for practicing OWASP Top 10 topics.

Notes: Its straightforward interface is useful for learning SQL injection, XSS, and CSRF.

Website: OWASP Mutillidae II

Web application penetration testing tools

Use tools only against systems within your authorized scope. Automated findings should be validated manually and reported responsibly.

1. Reconnaissance and information gathering

• Nmap: Network scanning, service enumeration, and port discovery.
• Amass: Subdomain enumeration and asset discovery.
• theHarvester: Gathering email addresses, subdomains, and host names from OSINT sources.
• Sublist3r: Subdomain enumeration using multiple search engines.
• Assetfinder: Lightweight discovery of related domains and subdomains.
• Subfinder: Passive subdomain discovery using multiple data sources.
• Knockpy: Wordlist-based subdomain discovery.

2. Web proxy and manual testing

• Burp Suite: An intercepting proxy for analyzing and testing HTTP/S requests.
• OWASP ZAP (Zed Attack Proxy): An open-source option for intercepting traffic and supporting web application assessments.

3. Vulnerability scanners

• Nikto: Web server scanner for outdated versions, misconfigurations, and known issues.
• Nessus: Vulnerability scanning for web and network environments.
• OpenVAS: An open-source vulnerability assessment platform.

4. Exploitation and testing tools

• SQLMap: Supports authorized testing for SQL injection issues.
• XSStrike: XSS detection and testing tool.
• Commix: Helps assess command-injection vulnerabilities in authorized labs.
• Dalfox: XSS scanning tool that can identify reflected, stored, and DOM-based cases.

5. Password and authentication testing

• Hydra: Supports authentication testing against various protocols; use only within an approved test plan with explicit rate limits.
• Hashcat: Password-recovery tool for authorized offline hash auditing.
• John the Ripper: Password-recovery tool that supports many hash formats and is often used for authorized offline audits.

6. Fuzzing and content discovery

• Dirb, Gobuster, FFUF, and DirBuster: Tools for discovering directories and files in explicitly in-scope web applications.
• Wfuzz: Flexible web application fuzzing tool.
• Arjun: Parameter discovery tool for identifying GET and POST parameters.

7. Specialized tools

• Postman: Useful for testing APIs and constructing custom HTTP requests.
• JWT Tool: Supports analysis and testing of JSON Web Tokens.
• Subjack: Detects potential subdomain takeover issues.

Tips and tricks

1. Reconnaissance and information gathering

Enumerate in-scope assets: Document subdomains, directories, parameters, headers, and cookies. Hidden endpoints may reveal additional test areas. Tools include Amass, Sublist3r, Dirb, Gobuster, and Arjun.

Inspect manually: Do not rely exclusively on automated scans. Use browser developer tools to review JavaScript, comments, and hidden form fields.

Check robots.txt and sitemap.xml: They can reveal application paths that merit review, though their presence does not imply a vulnerability.

Identify outdated software: Version information can help determine whether known vulnerabilities may apply. Review CMSs, frameworks, plugins, and libraries carefully.

2. Testing and validation

Start with low-impact checks: Begin with safe tests and increase impact only when the rules of engagement permit it.

Use varied test cases: In a lab or approved assessment, use controlled test inputs and the agreed scope. Fuzzing tools such as Wfuzz and FFUF can help test edge cases.

Assess vulnerability chains: Multiple weaknesses can combine into a larger risk. Document each step and its impact, and avoid actions outside the approved scope.

Select tools intentionally: Use tools appropriate to the hypothesis, and manually verify their results rather than treating scanner output as proof.

3. Web application mindset

Think like a user and a tester: Exercise expected workflows as well as edge cases and unusual application states.

Check business logic: Some high-impact issues arise from how an application handles payments, roles, or sessions rather than from a single technical flaw.

Validate input paths: Review GET and POST parameters, headers, cookies, hidden fields, and JSON or XML request bodies where relevant.

4. Practical CTF and lab advice

Take structured notes: Record URLs, parameters, headers, test inputs, and observed responses to make findings reproducible.

Isolate your environment: Use virtual machines, snapshots, or containers to keep potentially disruptive testing separate from your host environment.

Use walkthroughs thoughtfully: Try to solve a challenge before reading a writeup; reviewing one afterward can help reinforce the underlying concepts.

Manage time: If one test path stalls, move to another and return later with a fresh perspective.

5. Tool tips

Burp Suite:

• Use Repeater to inspect individual requests in a controlled way.
• Use Intruder for bounded fuzzing when permitted by the lab or assessment plan.
• Extensions such as ActiveScan++ and Logger++ can support analysis.

SQLMap:

• Select testing techniques according to the lab and assessment scope.
• Use data extraction features only when explicitly authorized and necessary; minimize access to sensitive information.

Dalfox and Arjun:

• Use parameter discovery to identify in-scope inputs, then assess them with appropriate test cases.
• Correlate results with proxy observations and manually validate findings.

6. General advice

Think end to end: Track the issue from discovery through validation, impact assessment, reporting, and cleanup.

Learn the vulnerability patterns, not only the tools: Tools change, but the underlying security principles remain useful.

Stay current: Follow security advisories, responsible disclosure reports, and community research.

Be ethical: Test only on systems you own, designated CTF/lab machines, or systems for which you have explicit authorization.

Extra tip

When you are stuck, HackTricks is a broad, community-maintained reference for security techniques and concepts. Use it responsibly and within your authorized environment.

I hope this guide helps you as much as it has helped me!

---

Originally published on Medium.