EH-27: Web Application Assessment - Full Pentest Web

Tools: curl, sqlmap, nikto

Challenge

Lakukan assessment penuh pada web target menggunakan teknik dari Level 1: 5:

echo "=== PHASE 1: Enumeration ==*"
echo "  [1] Directory busting: /admin, /backup, /config, /.git, /wp-admin"
echo "  [2] Parameter fuzzing: ?id=, ?file=, ?page=, ?debug="
echo "  [3] Form detection: login, search, contact, upload"
echo ""

echo "=== PHASE 2: Vulnerability Scan ==*"
echo "  [1] SQL Injection pada parameter ?id="
echo "  [2] XSS pada search form"
echo "  [3] Path Traversal pada ?file="
echo "  [4] IDOR pada ?user_id="
echo "  [5] Weak password pada login form"
echo ""

echo "=== PHASE 3: Validation ==*"
for vuln in "SQL Injection" "XSS" "Path Traversal" "IDOR" "Weak Auth"; do
  echo "  Testing: $vuln"
  echo "  → Payload: $(echo $RANDOM | md5sum | head -c 8)"
  echo "  → Status: Need manual verification"
done

Checklist

Item	Status
✅ Directory enumeration
✅ SQL Injection test
✅ XSS test
✅ Path Traversal
✅ Weak auth test
✅ IDOR test
✅ Information disclosure
✅ Server version check

Refleksi: Web assessment sistematis adalah kunci menemukan celah. Jangan acak - ikuti checklist untuk coverage maksimal.

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy