Web Exploitation

Web exploitation is attacking web applications. It is one of the most in-demand skills in security, because nearly every company has a web presence and most of them have vulnerabilities.

The learning curve is accessible. Start here if you are not sure which specialization to pick.

The Core Vulnerability Classes

You do not need to memorize every CVE. You need to understand these recurring patterns:

Vulnerability What it is
SQL Injection (SQLi) Attacker-controlled input reaches a database query unescaped
Cross-Site Scripting (XSS) Attacker-controlled input is rendered as HTML/JS in another user’s browser
IDOR Insecure Direct Object Reference — changing a user ID in a URL accesses someone else’s data
SSRF Server-Side Request Forgery — making the server fetch a URL you control
LFI / RFI Local/Remote File Inclusion — reading or executing files outside intended scope
CSRF Cross-Site Request Forgery — tricking a user’s browser into making requests they didn’t intend
Broken Auth Weak session management, default credentials, password reset flaws
Insecure Deserialization Deserializing untrusted data leads to arbitrary code execution

The OWASP Top 10 covers the most critical categories. Read it.

How to Learn

PortSwigger Web Security Academy is the best free resource. It has labs for every vulnerability class, explained clearly, with guided walkthroughs. Work through it systematically.

Start here → portswigger.net/web-security

OWASP Juice Shop is a vulnerable web app you can run locally and attack without permission concerns.

owasp.org/www-project-juice-shop

Tools

Tool What it does
Burp Suite Intercept, inspect, and modify HTTP traffic. The central tool for web testing.
ffuf Fuzz web paths, parameters, headers at high speed
Gobuster Directory and subdomain enumeration
sqlmap Automates SQL injection detection and exploitation
nikto Web server scanner for known vulnerabilities
Browser DevTools Already in your browser. F12.

Learn Burp Suite first. Everything else is supplementary.

In CTF Environments

Web CTF challenges almost always involve chaining multiple vulnerabilities or exploiting one well-known class with a twist.

Typical recon workflow for a web challenge:

# What is the server running?
curl -I http://target.htb

# Discover hidden directories
ffuf -u http://target.htb/FUZZ -w /usr/share/wordlists/dirb/common.txt -fc 404

# Check robots.txt, sitemap.xml, .git/, .env
curl http://target.htb/robots.txt
curl http://target.htb/.git/HEAD        # source code leak?
curl http://target.htb/.env             # credentials?

# Fuzz parameters
ffuf -u "http://target.htb/page?FUZZ=test" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

Quick SQLi test (manual, before reaching for sqlmap):

# In a form field or URL parameter, try:
'
' OR '1'='1
' OR 1=1--
" OR "1"="1

If the page errors differently or behaves oddly, you likely have SQL injection. Then use sqlmap or build the injection manually.

XSS probe:

<script>alert(1)</script>
"><script>alert(1)</script>
<img src=x onerror=alert(1)>

If you see a popup, it is reflected XSS. If others see it, it is stored XSS.

Using AI for Web Exploitation

Where it helps:

  • Understanding vulnerability classes: “Explain SSRF and what an attacker can do with it.” AI gives a clear, concise explanation with examples.
  • Generating payloads: “Give me SQLi payloads for bypassing a login that uses MySQL.” AI knows the standard ones. Use them as a starting list and iterate.
  • Reading source code: Paste a PHP or Node.js snippet and ask “is there a vulnerability here?” AI catches obvious injection points, unsafe deserialization, and hardcoded credentials reliably.
  • Burp Suite workflow: “How do I use Burp’s Intruder to brute force a login form?” Step-by-step is where AI saves time.
  • Decoding tokens: Paste a JWT. AI will decode it and tell you what algorithm it uses and what attacks might apply (e.g., alg: none, weak secret brute force).

Where it fails:

  • Application-specific logic bugs: AI cannot know the business logic of a custom app.
  • Blind injection: it can explain the technique but you have to run the requests yourself.
  • WAF bypass: AI knows common bypasses but not what your specific WAF blocks.

Real-World Context

Web application security testing (penetration testing) is a full job category. Security engineers, bug bounty hunters, and red team operators all need these skills.

Bug bounty programs let you legally test real applications for money. HackerOne and Bugcrowd are the major platforms.

How the Club Uses This

TODO: Add how the club approaches web exploitation in CTFs and competitions — tools used, techniques practiced, notable findings or challenges.

References

Next Binary ExploitationWhat binary exploitation is and why it is the deepest technical track in security.