web-vuln-scan

Start with fingerprinting via httpx or response headers to identify the tech stack, then run Nuclei filtered by critical and high severity, check default logins, and brute-force directories with spray or ffuf. Follow up with manual tests for logic flaws automation misses.

Prioritize vulnerabilities that yield RCE directly: command injection, deserialization, SSTI, and file upload bypasses. Next test data-exposure issues like SQL injection, LFI, and IDOR, then credential attacks, leaving XSS and CSRF last since they need user interaction.

Each stack has distinct vulnerability distributions: PHP targets need CMS POCs and LFI checks, Java needs Log4j and deserialization tests, Python Flask needs SSTI and debug-mode checks, Node.js needs prototype pollution, and .NET needs ViewState deserialization.

Nuclei quickly covers known CVEs, default logins, and exposed files but cannot find logic flaws or context-dependent bugs. Use it as the starting point, then manually test each input point for SQLi, SSTI, SSRF, XXE, and JWT weaknesses.

Deep scanning assumes the target is already confirmed. If you still need asset discovery, subdomain enumeration, or attack surface mapping across an organization, use a breadth-first reconnaissance approach instead before drilling into individual hosts.