wstg-web-pentest

Set the TARGET and OUTPUT_DIR variables, then execute the 12 phases sequentially from information gathering through API testing. Each phase provides concrete commands using tools like subfinder, httpx, katana, and ffuf, with expected outputs and verification criteria.

The methodology requires curl, subfinder, dnsx, httpx, katana, nuclei, nmap, ffuf, jq, python3, openssl, tlsx, and wappalyzer or whatweb. A browser with an intercepting proxy and two test accounts are needed for authenticated and authorization testing.

Use two distinct test identities and request User B's objects with User A's credentials. Confirmation requires comparing content, owner fields, or tenant identifiers, not just a 200 status code, to prove cross-account data access.

Yes, phase 12 covers API testing under WSTG-APIT, and earlier phases identify API candidates by filtering crawled URLs for patterns like /api/, /graphql, swagger, and openapi. OAuth weaknesses are covered under authorization testing.

Time-based tests are noisy; a 5-second delay in a normally fast response is a strong signal, but sub-second variance is not. Confirmation requires actual data extraction through error-based, union-based, or blind channels, not just a single error message.

Never test lockout mechanisms or default credentials against production accounts, as they generate authentication failures and can lock out real users. Use dedicated synthetic test accounts to confirm the mechanism exists, then stop.