> For the complete documentation index, see [llms.txt](https://intrusionz3r0.gitbook.io/intrusionz3r0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intrusionz3r0.gitbook.io/intrusionz3r0/hacking-web.md).

# Hacking Web

Burpsuite Tool set

* Turbo Intruder
* Collaborator Everywhere
* Request to pythin
* Hackvector

{% hint style="info" %}
It is a good idea to get in the habit of using non-standard file names and parameters for our web shells `system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);`
{% endhint %}

## Polyglot payload:

```python
${{<%[%'"}}%\\.
```

## Identifying Web Technologies by Tokens, Headers, and Cookies

<table data-header-hidden><thead><tr><th width="210"></th><th width="167"></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Language/Framework</strong></td><td><strong>Common Headers or Cookies</strong></td><td><strong>Token Patterns</strong></td><td><strong>Additional Indicators</strong></td></tr><tr><td><strong>PHP</strong></td><td><code>PHPSESSID</code>, <code>laravel_session</code>, <code>ci_session</code></td><td>- CSRF: <code>csrf_test_name</code>, <code>X-CSRF-TOKEN</code> (Laravel)&#x3C;br>- JWT: <code>Authorization: Bearer</code></td><td>Cookie length; Base64-encoded tokens</td></tr><tr><td><strong>Python (Django)</strong></td><td><code>csrftoken</code>, <code>sessionid</code></td><td>- CSRF: <code>X-CSRFToken</code>&#x3C;br>- JWT: <code>Authorization: Bearer</code></td><td>Use of headers like <code>X-CSRFToken</code></td></tr><tr><td><strong>Ruby on Rails</strong></td><td><code>_rails_session</code>, <code>_csrf_token</code></td><td>- CSRF: <code>authenticity_token</code> in forms</td><td>Clean URLs; RESTful route names</td></tr><tr><td><strong>Java (Spring)</strong></td><td><code>JSESSIONID</code></td><td>- CSRF: <code>X-CSRF-TOKEN</code>&#x3C;br>- JWT: <code>Authorization: Bearer</code></td><td>Common names like <code>JSESSIONID</code></td></tr><tr><td><strong>Node.js (Express)</strong></td><td><code>connect.sid</code></td><td>- JWT: <code>Authorization: Bearer</code></td><td>Routes like <code>/api</code> or <code>/auth</code>; custom headers</td></tr><tr><td><a href="http://asp.net/"><strong>ASP.NET</strong></a></td><td><code>.ASPXAUTH</code>, <code>.AspNet.Session</code></td><td>- CSRF: <code>__RequestVerificationToken</code> in forms&#x3C;br>- JWT: <code>Authorization: Bearer</code></td><td>Cookies with <code>.ASPX</code></td></tr><tr><td><a href="http://asp.net/">**ASP.NET</a> Core**</td><td><code>.AspNetCore.Session</code>, <code>.AspNetCore.Identity</code></td><td>- CSRF: <code>RequestVerificationToken</code></td><td>Middleware for JWT and OAuth2</td></tr><tr><td><strong>Laravel (PHP)</strong></td><td><code>laravel_session</code>, <code>XSRF-TOKEN</code></td><td>- CSRF: <code>X-CSRF-TOKEN</code></td><td>SHA-256 encoded tokens</td></tr><tr><td><strong>CodeIgniter (PHP)</strong></td><td><code>ci_session</code></td><td>- CSRF: <code>csrf_test_name</code> in forms</td><td>Lightweight cookies, basic values</td></tr><tr><td><strong>Angular (Frontend)</strong></td><td><code>X-XSRF-TOKEN</code>, <code>Authorization: Bearer</code></td><td>- JWT in headers or cookies</td><td>Common use of AngularJS in SPAs</td></tr><tr><td><strong>React (Frontend)</strong></td><td><code>Authorization: Bearer</code></td><td>- JWT and OAuth2</td><td>Tokens managed in local storage or cookies</td></tr><tr><td><strong>Vue.js (Frontend)</strong></td><td><code>Authorization: Bearer</code>, <code>X-XSRF-TOKEN</code></td><td>- Similar to Angular</td><td>Libraries for handling CSRF and OAuth2</td></tr><tr><td><strong>Flask (Python)</strong></td><td><code>session</code>, <code>csrf_token</code></td><td>- JWT: <code>Authorization: Bearer</code></td><td>RESTful APIs with clear routes</td></tr><tr><td><strong>FastAPI (Python)</strong></td><td><code>Authorization: Bearer</code></td><td>- JWT: <code>Authorization: Bearer</code></td><td>Similar to Flask, more OpenAPI oriented</td></tr><tr><td><strong>Symfony (PHP)</strong></td><td><code>PHPSESSID</code>, <code>symfony</code></td><td>- CSRF: tokens in forms</td><td>Custom cookie names</td></tr><tr><td><strong>Spring Boot (Java)</strong></td><td><code>JSESSIONID</code></td><td>- JWT: <code>Authorization: Bearer</code>&#x3C;br>- CSRF: <code>X-CSRF-TOKEN</code></td><td>RESTful routes like <code>/v1/api/</code></td></tr><tr><td><strong>Express.js (Node)</strong></td><td><code>connect.sid</code></td><td>- JWT in headers</td><td>Flexible cookie and middleware handling</td></tr><tr><td><strong>Django Rest Framework (Python)</strong></td><td><code>Authorization: Bearer</code></td><td>- JWT: <code>Authorization: Bearer</code></td><td>REST prefixes in routes, like <code>/api/v1/</code></td></tr><tr><td><strong>Next.js (React)</strong></td><td><code>Authorization: Bearer</code>, custom cookies</td><td>- CSRF or JWT tokens</td><td>Combined use of APIs and SSR</td></tr></tbody></table>

#### External reconnaissance

{% hint style="info" %}
Understanding where that infrastructure resides is extremely important for our testing. We have to ensure we are not interacting with infrastructure out of our scope.
{% endhint %}

**IP Space**

* Identify the valid ASN for the target.
* Find netblocks used for the organization’s public-facing infrastructure.
* Check for cloud presence and hosting providers.
* Review DNS record entries.

  **Tools:**

  * <https://bgp.he.net/>
* **Domain Information**
  * Based on IP data, DNS, and site registrations.
  * Who administers the domain?
  * Are there any subdomains tied to the target?
  * Publicly accessible domain services (Mail servers, DNS, Websites, VPN portals, etc.).
  * Can we determine what kind of defenses are in place? (SIEM, AV, IPS/IDS in use).
  * Manual DNS record requests against the domain in question or against well known DNS servers, such as `8.8.8.8`.

    **Tools:**

    * <https://viewdns.info/>
    * <https://whois.domaintools.com/>
* **Schema Format**
  * Can we discover email accounts, AD usernames, and password policies?
  * Use this information to build a valid username list for testing external-facing services (password spraying, credential stuffing, brute force, etc.).
  * Often, the public website for a corporation will have relevant info embedded. News articles, embedded documents, and the "About Us" and "Contact Us" pages can also be gold mines.
  * Searching Linkedin, Twitter, Facebook, your region's major social media sites, news articles, and any relevant info you can find about the organization.
    * Tools:
      * <https://github.com/initstring/linkedin2username>
* **Data Disclosures**
  * Look for publicly accessible files (.pdf, .ppt, .docx, .xlsx) that provide insights into the target.
  * Example: files with intranet site listings, user metadata, or critical software/hardware in the environment (e.g., credentials pushed to a public GitHub repo, internal AD username format in PDF metadata).
  * [GitHub](https://github.com/), [AWS S3 buckets & Azure Blog storage containers](https://grayhatwarfare.com/), [Google searches using "Dorks"](https://www.exploit-db.com/google-hacking-database)

    **Tools:**

    * <https://github.com/trufflesecurity/truffleHog>
    * <https://buckets.grayhatwarfare.com/>
* **Breach Data**
  * Check for publicly released usernames, passwords, or other critical information.
  * Use this data to help attackers gain a foothold.
    * Tool:
      * <https://haveibeenpwned.com/>
      * <https://www.dehashed.com/>

##


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intrusionz3r0.gitbook.io/intrusionz3r0/hacking-web.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.