Beyond the OWASP Top 10
While the OWASP Top 10 provides an excellent foundation, real-world web application security testing requires going deeper. This guide covers advanced techniques used by professional penetration testers.
The Limitations of Automated Scanning
Automated scanners miss:
Business logic vulnerabilities
Complex authentication bypasses
Chained vulnerabilities
Context-specific issues
Race conditions
Advanced Injection Techniques
SQL Injection: Beyond Basic UNION
Time-Based Blind SQLi:
When no output is visible, use time delays to extract data character by character.
Second-Order SQLi:
Payload stored in database, executed when retrieved by different functionality.
Out-of-Band SQLi:
Use DNS or HTTP requests to exfiltrate data when no direct response channel exists.
Server-Side Template Injection (SSTI)
Modern frameworks use templates that can be exploited:
Jinja2 (Python): Template expressions leading to RCE
Freemarker (Java): Object injection to code execution
Twig (PHP): Filter bypass techniques
Detection: Inject mathematical expressions and observe output
Server-Side Request Forgery (SSRF)
Force the server to make requests:
Access internal services (metadata APIs, admin panels)
Port scanning internal networks
Reading local files via file:// protocol
Bypassing firewall restrictions
Bypass Techniques:
DNS rebinding
URL encoding
Alternative IP representations
Redirect chains
Authentication & Authorization Testing
JWT Vulnerabilities
Algorithm Confusion:
Change RS256 to HS256 and sign with public key.
None Algorithm:
Some libraries accept "none" as valid algorithm.
Key Injection:
JWK header injection to use attacker-controlled key.
Claim Tampering:
Modify claims after decoding without proper verification.
OAuth 2.0 Attacks
Authorization code theft: Open redirect in callback URL
CSRF on authorization: Missing state parameter
Token leakage: Referrer header exposure
Scope escalation: Requesting more permissions
Session Management
Session fixation vulnerabilities
Insufficient session expiration
Session token in URL
Concurrent session handling
Session puzzling attacks
Business Logic Vulnerabilities
Common Patterns
Price Manipulation:
Modifying prices in client-side requests before checkout.
Quantity Abuse:
Negative quantities, floating point quantities, integer overflow.
Race Conditions:
Simultaneous requests to bypass once-only actions.
Workflow Bypass:
Skipping steps in multi-stage processes.
Privilege Escalation:
IDOR to access other users' resources.
Testing Methodology
1Map all application functionality
2Identify trust boundaries
3Test each boundary crossing
4Look for assumptions in business rules
5Test edge cases and error conditions
API Security Testing
GraphQL Specific
Introspection: Query schema structure
Batching attacks: Multiple operations in one request
Nested query DoS: Deeply nested queries causing resource exhaustion
Field suggestion exploitation: Information disclosure
REST API Testing
Mass assignment vulnerabilities
Broken object level authorization
Excessive data exposure
Lack of resources and rate limiting
Injection in JSON parameters
Client-Side Vulnerabilities
Advanced XSS
DOM-based XSS:
Sink and source analysis for client-side vulnerabilities.
Mutation XSS (mXSS):
Browser parsing differences leading to script execution.
Blind XSS:
Payloads triggering in admin panels or logs.
CSP Bypass Techniques:
JSONP endpoints
Angular sandbox escapes
Base tag injection
Script gadgets
Prototype Pollution
Manipulating JavaScript prototype chain:
Object pollution via __proto__
Gadget chains leading to XSS or RCE
Common library vulnerabilities
Testing Tools and Methodology
Manual Testing Tools
Burp Suite Professional: Intercepting proxy, scanner, extensions
OWASP ZAP: Free alternative with active community
Postman/Insomnia: API testing and automation
Browser DevTools: Network analysis, DOM inspection
Automation Scripts
Custom Burp extensions for specific checks
Nuclei templates for known vulnerabilities
Custom Python scripts for logic testing
Browser automation for complex workflows
Methodology Framework
1Reconnaissance: Technology fingerprinting, endpoint discovery
2Mapping: Crawl, API documentation, JavaScript analysis
3Discovery: Automated scanning, manual probing
4Exploitation: Validate vulnerabilities, chain attacks
5Post-Exploitation: Assess impact, pivot opportunities
Reporting Best Practices
Vulnerability Documentation
Each finding should include:
Clear title and severity rating
Affected URL/endpoint
Step-by-step reproduction
Request/response evidence
Business impact description
Remediation recommendations
Risk Rating
Consider:
Technical severity (CVSS)
Business impact
Exploitability
Affected user population
Conclusion
Effective web application security testing requires a combination of automated tools and manual expertise. Focus on understanding application logic, testing trust boundaries, and thinking like an attacker. The most critical vulnerabilities often lie in business logic, not just technical implementation.
