active-web-testing

Start with passive reconnaissance, then run automated scanners like Nikto and OWASP ZAP, followed by manual tests for authentication, IDOR, and business logic flaws. Always confirm written permission and scope before any active testing.

This workflow uses Nikto and OWASP ZAP for automated scanning, SQLMap for database injection testing, Gobuster for directory discovery, and Python scripts built on the requests library for authentication, IDOR, and business logic testing.

Enumerate numeric or UUID identifiers in endpoints like /api/users/{id} with rate-limited authenticated requests and check which resources return data. The IDORTester class also covers HTTP parameter pollution variants.

Active testing is prohibited without explicit written permission, when the program restricts testing to read-only or source code analysis, or when targets fall outside the defined bounty scope. Never test live systems without authorization.

Apply rate limiting delays between requests, use low risk and level settings in SQLMap, limit brute force attempts, and stop immediately if issues occur. Document all activity and contact the program's emergency contact if something breaks.