Hey [name], you're jumping on a web app pentest, exciting stuff. Before we kick off, here's some context and a few things to get your head in the game.
The vibe
No pressure on this one. The goal is to learn, have fun, and get a feel for how a web app test runs. Find something cool? Great. Don't? Also great. You're here to get a feel for it, not to prove anything.
Worth looking at beforehand
- Brush up on the OWASP Top 10 if it's not fresh, good baseline for what we're hunting
- Skim common web vulns and pick one that interests you, something you're curious about or already know a bit about. Doesn't need to be exotic, even something like IDOR or stored XSS is a solid one to get comfortable spotting
- Have a think about the different areas a web app test usually touches, auth and session handling, access control, input handling, business logic. You don't need to be an expert in all of them, just have a rough map in your head of what we'll be poking at
- If you've done any CTFs or HTB boxes with a web component, think back to what tripped you up, that's usually a good sign of what's worth brushing up on now
- Got a favourite vuln or technique? Bring it, we'll find a spot to try it
- PortSwigger Web Security Academy is great if you want hands on warm up labs
- If you're not that familiar with the tech stack we're likely to see (e.g WordPress and WooCommerce), a quick look at what that stack usually looks like from a security angle doesn't hurt
Tips for getting started
- Don't try to do everything at once, pick a surface and work it properly before moving on
- Burp Suite is your best friend. Haven't used it much? Let me know and we'll do a quick walk through before diving in
- Take notes as you go, even if something seems small or irrelevant
- Ask questions as they come up, no such thing as a stupid one here
Before we start
We'll have a quick chat before kick-off to walk through the scope, where we're at in the engagement, and figure out together how you want to run it. Bring some ideas if you've got them, but don't stress if you don't, that's what the chat is for.