SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsweb-vuln-scan

web-vuln-scan

General & other

View repository

Updated 10-16 08:01

About this skill

Single-target Web deep vulnerability scanning methodology

Unlike recon-full(breadth-first, asset discovery), this skill isdepth-first— performing comprehensive vulnerability testing on a single determined Web target.

Phase 1: Technology stack-driven scanning strategy

First perform fingerprinting, then choose a targeted scanning route based on the results:

# 指纹识别
curl -sI http://target | grep -i "Server\|X-Powered-By\|X-AspNet"
httpx -u http://target -tech-detect -silent
Technology stack Automated scanning focus Manual testing focus
PHP (WordPress/Laravel/ThinkPHP) CMS-specific POCs, PHP deserialization LFI/file upload/include() parameters
Java (Spring/Struts/Tomcat) Log4j/Spring4Shell/Struts2 Deserialization entry points, Actuator leakage
Python (Flask/Django) SSTI, Debug mode Pickle deserialization, Secret Key leakage
Node.js (Express/Koa) Prototype chain pollution Dependency vulnerabilities,eval() injection
.NET (ASP.NET/IIS) ViewState deserialization web.config leakage

The vulnerability distribution differs greatly across technology stacks — blindly scanning everything wastes time.

Phase 2: Automated scanning

2.1 Known vulnerability scanning

# Nuclei 扫描（按严重等级过滤，节省时间）
nuclei -u http://target -severity critical,high

If the fingerprint is clear, the scope can be narrowed:

  • WordPress → nuclei -u http://target -tags wordpress
  • Known CVE → nuclei -u http://target -t cves/

2.2 Default credential detection

nuclei -u http://target -t default-logins/ -silent

Many applications forget to change passwords after installation — this is the "cheapest" attack path.

2.3 Directories and sensitive files

# spray 目录爆破（推荐，智能过滤 + 高性能）
spray -u http://target -d /pentest/AboutSecurity/Dic/web/directory/common.txt
# 或用 ffuf
ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/web/directory/common.txt -mc 200,301,302,403

The focus is not running a large wordlist, but checking whether the results contain:

  • Admin backend (/admin, /manager, /console) → directly attempt login
  • Configuration leakage (.env, config.php, web.config) → may contain database passwords
  • Source code leakage (/.git, .svn, backup.zip)
  • Debug endpoints (/actuator, /debug, /phpinfo.php) → large amount of internal information

Phase 3: Manual testing (what automated scanning cannot find)

Automated tools cannot cover logic vulnerabilities and vulnerabilities that require contextual understanding. Perform targeted testing on each functionality point:

3.1 Input point testing matrix

Functionality point Priority testing Reference skill
Search/query SQL injection sql-injection-methodology
Login form Weak passwords, SQL injection, brute force hydra-brute, cred-spray
File upload Type bypass, path traversal file-upload-methodology
User input reflection XSS、SSTI xss-methodology, ssti-methodology
Comments/messages Stored XSS xss-methodology
URL/file path parameters LFI/SSRF lfi-rfi-methodology, ssrf-methodology
XML input/SOAP/file upload XXE xxe-injection-methodology
API endpoints IDOR, authentication bypass api-fuzz, idor-methodology
JWT Token Algorithm bypass, key brute force jwt-attack-methodology

3.2 Testing priorities

  1. Directly RCE-capable → command injection, deserialization, SSTI, file upload
  2. Can read sensitive data → SQL injection, LFI, IDOR
  3. Can obtain credentials → default credentials, information leakage, weak encryption
  4. Requires user interaction → XSS, CSRF (usually not tested in CTF)

Phase 4: Result Analysis and Attack Path Planning

After scanning is complete, it's not over just by listing a bunch of vulnerabilities—you need to evaluatewhich vulnerabilities can be combined into an attack path：

Direct path(one step to the goal):

  • RCE vulnerability → directly get shell
  • Admin panel weak password → exploit admin panel functionality

Combination path(multi-step chain):

  • Information disclosure → obtain credentials → log in to admin panel → admin panel file upload → webshell
  • SQL injection → read configuration file → obtain key → forge JWT → administrator privileges
  • SSRF → read cloud metadata → cloud credentials

Notes

  • Automated scanning is the starting point, not the end—truly high-risk vulnerabilities often need to be discovered manually
  • Fingerprint identification accuracy directly affects subsequent efficiency; spending 1 round doing fingerprinting well is worth it
  • When you find a low-risk vulnerability, think about whether it can be combined with other findings into a high-risk attack chain

Testing Priority

  • RCE first: command execution vulnerabilities can directly get the flag
  • Default credentials second: admin panel privileges can quickly obtain more information

In-Depth Reference