Lesson 3
· 20 min
Mapping the attack surface
Content discovery, parameter analysis, and spotting the interesting endpoints.
You cannot test what you have not found. Before exploiting anything, build a complete picture of the application.
Passive mapping
- Crawl the site normally and let the proxy record every URL, parameter, and cookie.
- Read client-side JavaScript — it references API paths, feature flags, and old endpoints that are not linked anywhere.
- Check
/robots.txt,/sitemap.xml, source maps, and HTML comments.
Active content discovery
Brute-force paths and files with a wordlist (raft, SecLists). Look for admin
panels, /api, /actuator, /.git, and backup files (.bak, ~, .old).
A 403 still tells you the path exists.
Parameter analysis
For every parameter, guess its purpose and the bug class it invites:
| Parameter looks like | Test for |
|---|---|
an identifier (id=42) |
broken access control / IDOR |
a redirect target (next=) |
open redirect, SSRF |
a filename (file=) |
path traversal, LFI |
| a template value | server-side template injection |
| free text rendered back | XSS |
| anything reaching a query | SQL injection |
Key takeaway
A thorough map turns "test the website" into a finite checklist of concrete inputs and the specific attacks each one deserves.