Skip to content
ATARUS. OFFENSIVE SECURITY

LearnTrack

Web and API

A web and API test looks at one application the way its users and its attackers reach it: every route, every way into an account, and every object one user can ask for that belongs to someone else. It is not a scan of the server underneath or of the cloud account the app runs in, which belong to the network and cloud tracks.

4 pages

What am I looking at

Kill chain

  1. Recon

    • Web app recon: the first hour of a pentest The first hour on a web application is for mapping, not attacking. Everything we test later, from authentication to authorization to injection, depends on knowing which requests the app makes, which ones take input, and which ones the interface never shows. Reviewed

  2. Access

    • Authentication and session testing Authentication bugs rarely live in the password check itself. They live in the paths around it: the reset flow, the second login method nobody tested, the session that survives logout, the token the server never verifies. Reviewed

  3. Escalation

    • IDOR and broken access control testing Broken object level authorization is the first entry in the OWASP API Security Top 10, and scanners find almost none of it, because a scanner cannot know that invoice 10432 belongs to someone else. Testing it is methodical rather than clever: take every request one user can make and replay it as another user. Reviewed

  4. Persistence

    Not yet written.

  5. Impact

    • Prove a web finding's business impact A web finding's impact is proven with the smallest act that shows it: one record, one cross-tenant read between tenants we created, one transaction worth nothing. The impact paragraph then says what was shown and what was assumed, in that order, so nobody has to argue about it later. Reviewed

  6. Report

    Not yet written.

All tracks