Pentest Notes
  • 🏠/home/x3m1Sec/.pt-notes
  • 📝Pentest Notes
    • 🔍Information Gathering
    • 📜Protocols and Services
      • DNS
      • FTP
      • IMAP
      • IPMI
      • MSSQL
      • MySQL
      • NFS
      • Oracle TNS
      • POP3
      • RDP
      • SMB
      • SMTP
      • SNMP
    • 🕸️Web Applications
      • Web Attacks
        • Cross Site Scripting (XSS)
        • SQL Injection (SQLi)
        • File Upload Vulnerabilities
        • Insecure Direct Object References (IDOR)
        • OS Command Injection
        • Local File Inclusion (LFI)
        • Remote File Inclusion (RFI)
        • XML External Entities (XXE)
        • HTTP Verb Tampering
      • Web Technologies
        • Tomcat
        • CGI Applications
        • WordPress
        • SAP Netweaver
        • Joomla
        • Drupal
        • Gitlab
        • Jenkins
        • Microsoft IIS
        • osTicket
        • PRTG Network Monitor
        • Splunk
      • Fuzzing
    • 📂Active Directory
      • Initial Access
      • Internal Enumeration & Lateral Movement
      • Privilege Escalation to Domain Admin using Known Exploits
      • Domain Trusts
    • 🐧Linux Privilege Escalation
      • Enumerating Attack Vectors
      • Privileged Groups
      • Environment Variables Abuse
      • Capabilities Abuse
      • Programs, Jobs and Services
      • Miscellaneous Techniques
      • Recent CVEs
    • 🪟Windows Privilege Escalation
      • Enumerating Attack Vectors
      • Excessive User Rights Abuse
      • Built-in Groups Abuse
      • File System ACLs
      • Services Hijacking
      • User Account Control (UAC) Bypass
      • Living off the Land
    • 🐛Bug Bounty Hunting
      • Bug Bounty Tools
    • 👾Utilities, Scripts and Payloads
      • Shells and Payloads
      • Metasploit Framework
      • File Transfers
      • Pivoting, Tunneling, Port Forwarding
      • Password Attacks
  • 🎓My Certifications
    • eJPTv2
      • My review
    • CPTS
      • CheatSheet
Powered by GitBook
On this page
  • Web Penetration Testing Methodologies
  • Learning Resources
  1. Pentest Notes

Web Applications

PreviousSNMPNextWeb Attacks

Last updated 13 days ago

Web Penetration Testing Methodologies

Learning Resources

📝
🕸️
OWASP WSTG
OWASP WSTG Checklists
WSTG Checklist.MD
WSTG Checklist.xlsx
OWASP Top 10
OWASP CheatSheets
CWE List
CVSS v3 Calculator
Mitre ATT&CK matrix
https://portswigger.net/web-security
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/web-api-pentesting
https://book.hacktricks.xyz/pentesting-web/web-vulnerabilities-methodology