# Web Attacks

## Tools

<table><thead><tr><th width="177">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://portswigger.net/burp">BurpSuite</a><br><br><a href="https://github.com/xiv3r/Burpsuite-Professional">Burpsuite-Professional</a></td><td>Web Proxy<br><em>(Active Scan++, Param Miner, Reflected Parameters, HTTP Request Smuggler, Content Type Converter, JS Miner, JS Link Finder, Software Vulnerability Scanner, Retire.js, Autorize, JSON Web Tokens, Upload Scanner, Backslash Powered Scanner, Hackvertor, Turbo Intruder, Scan manual insertion point, Server-Side Prototype Pollution Scanner, JWT Editor, Web Cache Deception Scanner, Agartha)</em><br><em>(Burp Clickbandit, Generate CSRF PoC, DOM Invader)</em></td></tr><tr><td><a href="https://www.zaproxy.org/">ZAP</a></td><td>Web Proxy Open Source</td></tr><tr><td><a href="https://caido.io/">Caido</a></td><td>Other Web Proxy</td></tr><tr><td><a href="https://www.postman.com/">Postman</a></td><td>Used to test APIs.<br><code>CTRL + SHIFT + I</code><br><code>pm.settings.setSetting("offlineAPIClientEnabled",0)</code> <code>pm.mediator.trigger("hideUserSwitchingExperienceModal")</code></td></tr></tbody></table>

## Checks

* Set Target
* WAF
* nikto, wpscan, etc.
* Generic Active Scan
* Test:
  * Login / Authentication Method
    * JWT
    * OAuth 2.0
    * Request without Auth
  * Headers
    * Security Headers
    * Host Headers
    * CORS
  * Unencrypted Comunications
  * Authorization Mechanisms
    * BAC
    * IDOR
  * Different Method
    * Verb Tampering
  * Information Disclosure
  * Request Smuggling
  * API
  * Web Cache Poisoning/Deception
  * Parameter
    * Specific Active Scan
    * IDOR
    * SQLi
      * sqlmap
    * NoSQLi
    * XSS
    * XXE
    * CSRF
    * SSTI
    * Command Injection
    * Insecure Deserializaion
    * File Inclusion/Path Traversal
    * Unrestricted File Upload
