Web Application hacking Methodology
Footprint Web Infrastructure
Attack Web Servers
Analyze Web Applications
Attack Authorization
Attack Session Management
Perform Injection Attacks
Attack Data Connectivity
Attack Web Application Client
Attack Web Services
Server Discovery
Service Discovery
Server Identification
Hidden Content Discovery
Identify Entry Point for User Input
Identify Server Side Functionality
Identify Server Side Technology
Map the Attack Surface
HTTP Request Tampering
Cookie Parameter Tampering
Session Token Prediction
Session Token Tampering
Man-in-the-Middle Attack
Session Hijacking
Web Script Injection
OS Command Injection
SMTP Injection
SQL Injection
LDAP Injection
XPath Injection
Buffer Overflow
Connection String Injection
Connection Pool DoS
Connection String Parameters Pollution (CSPP)
ActiveX Attack
Privacy Attack
Session Fixation
Request Forgery Attack
Frame Injection
HTTP Header Injection
Redirection Attacks
Cross-Site Scripting
Probing Attack
SOAP Injection
XML Injection
Parsing Attack
Attack Authentication Mechanism
Password Attacks
Session Attacks
Cookie Exploitation
Username Enumeration