Web Application Attacks
Map the application before choosing a payload
curl -i http://TARGET:PORT/
curl -i http://TARGET:PORT/robots.txt
Inspect links, forms, cookies, redirects and browser requests. Record the hostname, paths, methods, parameters and required role. Follow discovered hostnames only after confirming scope and resolving them to the intended host.
- A path parameter suggests traversal testing; reading a file does not prove server-side inclusion or execution.
- An upload suggests checking permitted extensions, content validation and the retrieval path; an uploaded script executes only if that location has a compatible handler.
- A command-like parameter suggests a harmless execution check and output/timing validation before a callback.
- An object ID suggests comparing access with another authorized test identity; changing the ID alone is not proof of an authorization flaw.
- Database errors or a repeatable response change suggest manual SQL-injection checks. Compare against a clean request and account for session/CSRF state.
Use the matching technique page only after identifying the input and a reproducible clue.
| Observed input or artifact | Focused next check |
|---|---|
| Upload form and a returned file URL | Establish the upload primitive, then verify the retrieval handler; a stored file is not code execution. |
| A URL-fetch or document-preview feature | Test the server-side request; distinguish a server request from a browser redirect. |
| Input reflected into a rendered template | Prove evaluation and identify the engine. |
| An XML request or import parser | Validate entity handling. |
Identify a discovered WordPress site's users and components
Use only after identifying WordPress and its actual hostname/base path:
wpscan --url http://HOST:PORT/ --enumerate u,p,t --plugins-detection passive
Review users, detected plugins/themes and version confidence. Passive plugin detection does not inventory every installed plugin. The separate vulnerability-database API requires a token and has access limits; component enumeration does not need it. An absent API result is not a clean result, and this command is not an approval of an external service for exam use. Verify a relevant component/version against its advisory before using a specific exploit. WPScan options. Use existing login-testing guidance only after establishing the actual endpoint and failure signal; do not begin a password attack by default.