0

I'm pretty new to pentesting and everything about it. This question is primarily for web servers. I'd like to know for you pentesters out there, what information are you looking for when you are analyzing a website for pentesting?

Should I be looking for forms, links, buttons, that do some type of request that passes along some type of data that I can manipulate? How do you find the part of the website to test if it's able to be exploited? When I google something like my question there are all these automated tools that do information gathering process for you, is this the way to go?

closed as too broad by Xander, Anders, Tobi Nary, Royce Williams, vidarlo Jul 8 at 4:07

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

3

This is a very opinion-based question, but I will try my best to answer in a manner that applies as generally as possible.


Anything you may think is valuable

Information Gathering is the first step in pentesting, but it doesn't mean that you only gather information once and then this is all you can work with. You always gather information about the system as you test it.

Sometimes, this is "formal" information, such as the technologies used (ASP.NET, PHP, Node.JS, etc.) or the versions thereof. Sometimes this is much more informal information, such as "These developers really didn't care about security at all".

This informal information is just as valuable, because it can clue you in as to what kinds of vulnerabilities the application may be vulnerable to.

Why do I collect information at all?

Because you need to know what kind of vulnerabilities are possible. If you test a web-application and you see that you can input some data, and it will be printed somewhere later, then you can immediately tell that you should test for Cross-Site Scripting.

If you know that some site you test uses the Wordpress Plugin "Live Chat Unlimited" in version 2.8.3, then it might give you some clues about what vulnerabilities it might have.

How do I collect information efficiently?

I won't make a list of tools you can use, because the tools of the trade change as new technologies emerge, and old technologies become obsolete. In general, it's a good idea to ask other more experienced pentesters questions like which tools they use for information gathering, and you will hear some tools over and over.

In general, I wouldn't get too hung up with tools at all. If you are just starting out, look at some vulnerabilities you have discovered in your tests, and what tipped you off that they might be there. Experience is the best teacher, after all.

1

While all of those components may be interesting, I would pay specific attention to anywhere where the website accepts user inputs, usually form fields or URL parameters. Consider watching the network tab in your browser's developer tools to see what the requests look like and what values are passed, or use an interception proxy for the same. Understanding HTTP and how servers work is very important for this. Looking at the cookies sent/received may give you an idea of how the site performs session management, and if any issues exist there.

There also may be files or directories of interest, which will sometimes be linked to from the page. Other paths the developer doesn't want you to find may be stated in robots.txt. If the site is JavaScript-heavy, you can read the code to understand the logic of the application and identify request endpoints. Maybe the code references some endpoints that you are not able to view as an unauthenticated or non-admin user, but would be worth probing in a pentest.

Lastly, some automated tools may help you find more information. Nikto and dirb are good for performing more active discovery of a website's files.

0

I will try to collect the details about a website suing a web scraping tool like "httrack". From that you can identify some of the smallest information which will very important for the latter part of the pen test process. Soon after that you can decide according to the findings of the collection, whether you have to go for an automated tool or for a manual tool.

Not the answer you're looking for? Browse other questions tagged or ask your own question.