0

I am a junior pentester currently working for a secure messaging app that includes a webclient. Only the subdomain is in scope and other subdomains are off-limits. Social engineering is also off limits as this is a staging server that mimics the live server and is only used for pentesting purposes.

I tried using nmap to scan for info gathering, but the returned results aren't much and even Nessus returns "invalid path".

I also tried to use burp suite to intercept but it seems that there is some sort of blocking (probably ssl pinning) that when using an intercepting proxy, the login field is hidden. I proceed to login without proxy and tried proxy to burp again, but the traffic seems to be halted and most of the stuff does not load.

I also tried using shodan and wappanalyzer but so far I can only acquire info on some older version web components that do not seem to have any vulnerabilities.

Nikto was used in an effort to identify common web vulnerabilities but not many results were returned.

Any advice futher reconnaissance would be much appreciated.

Improve this question
5
  • Why do you feel like you are not getting enough info?
    – schroeder ♦
    Commented Oct 2, 2023 at 15:36
  • What kind of web app is it? Use webalizer or similar tools to whether which JS framework or similar it is using and continue from there
    – Sir Muffington
    Commented Oct 2, 2023 at 15:52
  • I feel like it because I am not getting any dependable attack vector to proceed. I used wappalyzer on the site but the components such as React, Node.js and Lodash are a bit dated but those are on the latest non-vulnerable versions so I am kinda lost.
    – XyronZ
    Commented Oct 3, 2023 at 3:48
  • Are you sure there is an attack vector on which you can proceed? I'd try gobuster or dirbuster and look for specific file types e.g. html, txt, js, php.
    – kenlukas
    Commented Oct 3, 2023 at 17:47
  • Is this a blackbox (no docs on architecture/apps/infrastrucure), grey box (limited info available), or whitebox (all documentation available) pentest? Why do you absolutly need automated tools to find what you are looking for?
    – v-g
    Commented Nov 9, 2023 at 18:11

0

Reset to default

You must log in to answer this question.