Support Files (Session-Specific Knowledge)

Web Application Penetration Testing

Complete web app pentesting based on OWASP Top 10:2025. Covers recon → mapping → exploitation → reporting.

Pentesting Methodology

1. RECON          → 2. MAPPING       → 3. EXPLOITATION  → 4. POST-EXPLOIT → 5. REPORTING
   - Subdomains       - Tech stack       - OWASP Top 10       - Persistence      - Findings
   - Endpoints        - Parameters       - Auth bypass        - Lateral move     - CVSS scores
   - Technologies     - Entry points     - Data extraction    - Data exfil       - Remediation
   - WAF detection    - Attack surface   - RCE                - Cleanup          - PoC scripts

Phase 0: Multi-Port / Parallel Instance Discovery

Before deep recon, check if the target host runs multiple HTTP-accessible instances of the same app on different ports. Older/test/staging versions often have weaker security or unchanged defaults.

import socket, concurrent.futures, requests

def discover_parallel_instances(host, ports=[80, 99, 443, 8080, 8081, 8443, 8000, 8001, 3000, 5000]):
    """Find all HTTP-responding ports and fingerprint for the same app."""
    def check(port):
        try:
            s = socket.socket()
            s.settimeout(2)
            s.connect((host, port))
            s.close()
            r = requests.get(f'http://{host}:{port}/', timeout=5)
            title = re.search(r'<title>(.*?)</title>', r.text)
            return port, r.status_code, len(r.text), title.group(1) if title else 'N/A'
        except: return None
    
    with concurrent.futures.ThreadPoolExecutor(max_workers=10) as ex:
        results = [r for r in ex.map(check, ports) if r]
    
    # Group by similar page sizes (same app on different ports)
    by_size = {}
    for port, code, size, title in results:
        by_size.setdefault(size//100, []).append((port, code, title))
    
    for group, instances in by_size.items():
        if len(instances) > 1:
            print(f"⚠️  Multiple instances with similar pages: {instances}")
    return results

Triage each instance independently — try the same default credentials, check if login pages differ, compare session handling.

Real-world example: A production app on port 80 had teacher:teacher locked out. The same host's port 99 ran an older version (title: "台南-宏泰物理-舊") where teacher:teacher still worked with full admin access. The old version shared the codebase but had a separate, unmodified database.

See references/flask-cross-port-session-validation.md for how to confirm shared SECRET_KEY across instances.

See Also

• references/phase-1-reconnaissance.md — Phase 1 Reconnaissance
• references/phase-2-attack-surface-mapping.md — Phase 2 Attack Surface Mapping
• references/a01-broken-access-control.md — A01 Broken Access Control
• references/a05-injection.md — A05 Injection
• references/a07-authentication-failures.md — A07 Authentication Failures
• references/a08-insecure-deserialization.md — A08 Insecure Deserialization
• references/exploitation-automation-script.md — Exploitation Automation Script
• references/common-ports--services.md — Common Ports Services
• references/pentest-report-template.md — Pentest Report Template
• references/executive-summary.md — Executive Summary
• references/findings-summary.md — Findings Summary
• references/detailed-findings.md — Detailed Findings
• references/appendix.md — Appendix
• references/flask-session-decoding--forgery.md — Flask Session Decoding Forgery
• references/catch-all-routes--404-obfuscation.md — Catch All Routes 404 Obfuscation
• references/flask-session-cookie-analysis.md — Flask Session Cookie Analysis
• references/2025-2026-web-pentesting-updates.md — 2025 2026 Web Pentesting Updates
• references/aspnet-viewstate-webforms-sql-injection.md — Aspnet Viewstate Webforms Sql Injection
• references/client-side-js-obfuscation-platforms-taiwan-cram-schools.md — Client Side Js Obfuscation Platforms Taiwan Cram Schools
• references/deep-knowledge-references.md — Deep Knowledge References
• references/pitfalls.md — Pitfalls
• references/waf-bypass-complete-reference.md — Waf Bypass Complete Reference
• references/exploit-chaining--common-attack-paths.md — Exploit Chaining Common Attack Paths
• references/bug-bounty-methodology.md — Bug Bounty Methodology
• references/http-request-smuggling-cwe-444.md — Http Request Smuggling Cwe 444
• references/web-cache-poisoning.md — Web Cache Poisoning
• references/race-condition--toctou.md — Race Condition Toctou
• references/oauth-20-complete-attack-chain.md — Oauth 20 Complete Attack Chain
• references/prototype-pollution-deep-dive.md — Prototype Pollution Deep Dive
• references/csp-bypass-techniques.md — Csp Bypass Techniques
• references/dns-rebinding.md — Dns Rebinding
• references/subdomain-takeover.md — Subdomain Takeover
• references/graphql-advanced-attacks.md — Graphql Advanced Attacks
• references/flask--python-web-app-specific-techniques.md — Flask Python Web App Specific Techniques
• references/combined-exploit-chain-example.md — Combined Exploit Chain Example
• references/technology-specific-attack-surfaces-fused-from-strix-skills.md — Technology Specific Attack Surfaces Fused From Strix Skills
• references/trivy-dependency-cve-scanning-workflow-from-strix-customdependency_cve_scanningmd.md — Trivy Dependency Cve Scanning Workflow From Strix Customdependency_Cve_Scanningmd
• references/source-aware-sast-orchestration-from-strix-customsource_aware_sastmd.md — Source Aware Sast Orchestration From Strix Customsource_Aware_Sastmd