web-pentest

# Web Application Penetration Testing ## When to Activate - Web application security assessment (black/grey/white box) - API security testing (REST, GraphQL, WebSocket) - Authentication & session management testing (JWT, OAuth/OIDC, SAML) - Business-logic and race-condition hunting - WAF/CSP bypass, filter evasion, and CDN-layer attacks (desync, cache) - Validating modern 2024-2026 vectors: HTTP/1.1 desync (0.CL/TE.0), SSRF->cloud metadata, prototype-pollution->RCE, SSTI sandbox escapes ## Input-Signal Routing (what to test when you see X) Fast test selection — map an observed parameter/behavior to the right deep-dive: | Input signal you observe | Test for | Go to | |--------------------------|----------|-------| | `id`, `uid`, `order_id`, `account`, GUID/sequential ref | IDOR/BOLA, access control | references/auth-api-access-control.md | | `url`, `next`, `callback`, `dest`, `webhook`, `image_url` | SSRF + cloud metadata, open redirect, OAuth chain | references/ssrf-cloud-metadata.md | | `price`, `qty`, `coupon`, `balance`, `status`, state change | business logic + single-packet race | references/http-desync-cache.md (race) | | template/preview/name reflected in output | SSTI -> RCE, reflected XSS | references/ssti-deserialization.md | | search/filter/sort reflected; `q=`, error echoes input | SQLi, XSS, command injection | references/injection-sqli-cmdi.md | | `token`, `jwt`, `Authorization`, `Cookie`, OAuth `state` | JWT forgery, session/OAuth flaws | references/auth...