terminal TRYHACKME PRACTICAL LEARNING (CYBER 101 / JR PENTESTER)

Web Application Security Fundamentals

OWASP Top 10 concepts, SQL injection, XSS, parameter tampering (IDOR), and Burp Suite proxy testing.

Overview

Web Application Security addresses the identification, validation, and remediation of security vulnerabilities within web-facing applications, APIs, and microservices. Because web applications directly accept untrusted user input across public networks, understanding attack surfaces such as the OWASP Top 10 is critical for modern security practitioners.

Core Concepts

Input Validation vs Sanitization: Input validation enforces strict whitelisting of accepted data types, while sanitization neutralizes dangerous characters (such as HTML entities or SQL escape sequences).
OWASP Top 10 Vulnerability Classes:
- Injection (SQLi, Command Injection): Untrusted data is concatenated directly into query or shell interpreters.
- Cross-Site Scripting (XSS): Malicious scripts are injected into web pages viewed by other users (Reflected, Stored, or DOM-based).
- Broken Object Level Authorization (IDOR): Applications expose internal database keys without validating whether the requesting user owns the object.
- Security Misconfigurations: Default credentials, exposed debug pages, and missing security headers.
Proxy Interception: Analyzing and tampering with HTTP requests and responses between the browser and web server.

Tools & Requirements

The primary tools for authorized web application security assessments are Burp Suite Community Edition and ffuf (Fast Web Fuzzer).

BASH // TOOL INSTALLATIONAPT & GO

$ sudo apt update && sudo apt install -y burpsuite ffuf

Commands & Practical Examples

1. Web Directory & Endpoint Fuzzing with ffuf

Fuzz for hidden directories, sensitive admin portals, and backup files using a standard wordlist:

BASH // ENDPOINT FUZZINGFFUF DIRECTORY DISCOVERY

$ ffuf -w /usr/share/wordlists/dirb/common.txt -u http://192.168.1.10/FUZZ -mc 200,301,302

2. Fuzzing with File Extensions

Search for specific file types such as PHP source code, backups, or configuration files:

BASH // EXTENSION FUZZINGFFUF MULTI-EXTENSION

$ ffuf -w /usr/share/wordlists/dirb/common.txt -u http://192.168.1.10/FUZZ -e .php,.html,.bak,.txt

3. Burp Suite Proxy Interception Workflow

Configure your browser to route traffic through Burp Suite proxy (127.0.0.1:8080) to capture and modify parameters:

HTTP // SAMPLE INTERCEPTED REQUESTBURP REPEATER

POST /login.php HTTP/1.1
Host: 192.168.1.10
Content-Type: application/x-www-form-urlencoded
Content-Length: 35

username=admin&password=' OR 1=1-- -

4. Header Inspection via cURL

Examine response headers, cookies, and server banners without rendering browser scripts:

BASH // HEADER INSPECTIONCURL

$ curl -I http://192.168.1.10
$ curl -s -D - -o /dev/null http://192.168.1.10/admin

Practical Workflow

Application Mapping: Navigate target application systematically through an intercepting proxy to map all pages, input forms, and parameters.
Directory Discovery: Run ffuf to discover unlinked endpoints and API routes.
Input Point Analysis: Test forms and URL parameters for boundary violations, unexpected data types, and special characters (', ", <, >).
Vulnerability Verification: Use Burp Repeater to iteratively test for SQL injection or access control bypasses.
Remediation Advisory: Document root cause and supply defensive code recommendations (parameterized queries, output encoding).

Common Mistakes & Troubleshooting

Relying on Client-Side Validation: HTML form constraints and JavaScript checks can be bypassed completely using Burp Suite or cURL. Always enforce server-side validation.
Aggressive Fuzzing Rates: High-rate fuzzing can saturate web server worker threads and cause denial-of-service in lab environments. Adjust rate limits using ffuf -rate 20.

Security Considerations & Scoping

Web security assessments must remain strictly within agreed URL hostnames and paths. Never tamper with shared or production databases.