ctf-weblisted

# CTF web methodology ## 1. Recon (always) ```bash # Always start with these — in parallel curl -sI http://target/ # headers run_tool("ffuf", "-w wordlist -u http://target/FUZZ") # dir bust run_tool("gobuster", "dir -u http://target -w wordlist") run_tool("whatweb", "http://target") # tech stack nikto -h http://target # web scanner ``` Source view: - `view-source:` — comments, hidden inputs, JS files - `/robots.txt`, `/sitemap.xml`, `/.git/`, `/.env`, `/.DS_Store` - `wappalyzer` / `whatweb` for stack — frameworks dictate attack class ## 2. Map the attack surface For each endpoint: - Method (GET/POST/PUT/PATCH) - Parameters (URL, body, headers, cookies) - Auth requirements - Reflection points (does input echo back?) - Storage points (does input persist?) ## 3. Decision tree by symptom | Symptom | Likely class | Tool | | --- | --- | --- | | Input echoed in HTML | XSS | manual + `XSStrike` | | Error contains SQL | SQLi | `sqlmap` (registry) | | URL parameter triggers fetch | SSRF | manual + `gopherus` for protocols | | Template syntax `{{7*7}}` → `49` | SSTI | `tplmap`, manual jinja2/twig payloads | | Numeric ID in URL/body | IDOR | manual enum + Burp Repeater | | Login form, error tells "user not found" vs "wrong pass" | User enum | manual | | File upload | Upload bypass | `BurpSuite`, manual extension/MIME tricks | | `Cookie:` with base64/JSON | Cookie tampering | manual | | `Auth