web-vuln-scan

Start with fingerprinting using httpx or response headers to identify the tech stack, then run nuclei filtered by critical and high severity, check default logins, and fuzz directories with spray or ffuf. Follow up with manual testing of each input point for flaws automation misses.

Prioritize vulnerabilities that yield direct RCE such as command injection, deserialization, SSTI, and file upload bypass. Next target data-reading flaws like SQL injection and IDOR, then credential exposure, and finally user-interaction bugs like XSS and CSRF.

Fingerprinting determines which vulnerabilities are likely present, since each stack has distinct flaw patterns. For example Flask suggests SSTI and Werkzeug debug RCE, Java suggests Log4j and deserialization, and PHP suggests LFI and file upload issues.

Nuclei detects known vulnerabilities and misconfigurations using template-based checks, while ffuf fuzzes directories, parameters, and files to discover hidden endpoints. They complement each other: nuclei finds known CVEs, ffuf finds attack surface.

Automated tools cannot understand business logic or multi-step context, so they miss logic flaws, chained exploits, and authorization issues like IDOR. Manual testing of each functional input point is required to find these high-impact vulnerabilities.

Use depth-first scanning when the target is already confirmed and you need exhaustive vulnerability testing of one application. Breadth-first reconnaissance is for asset discovery across an organization, which is a separate earlier phase.