OWASP Hunting

Methodology

Security testing methodology for using OWASP Hunting payloads effectively.

Methodology

OWASP Hunting payloads are reference material for structured security assessments. This page describes a recommended workflow for integrating them into authorized testing.

Overview

Effective security testing follows a defined process:

  • Scope definition — Confirm authorization and enumerate in-scope targets

  • Reconnaissance — Map the attack surface

  • Vulnerability identification — Identify injection points and potential weaknesses

  • Payload testing — Apply targeted payloads from the reference

  • Validation — Confirm exploitability with a minimal proof of concept

  • Reporting — Document findings with impact and remediation guidance

    • 1. Scope Definition

    Before any testing:

    • Obtain explicit written authorization

    • Review program rules or engagement scope documents

    • Confirm which domains, endpoints, and functionality are in scope

    • Understand out-of-scope assets and prohibited techniques


    2. Reconnaissance

    Map the application surface before testing payloads:

    • Enumerate endpoints and parameters (manually and with tools like ffuf, Burp Crawler)

    • Identify technology stack (web framework, database, language)

    • Note input fields, file upload features, and API endpoints

    • Check for JavaScript files exposing hidden endpoints


    3. Vulnerability Identification

    Match application features to vulnerability classes:

    | Feature | Relevant Categories |
    |---|---|
    | Login forms | SQL Injection, Authentication Bypass, NoSQL Injection |
    | Search / filters | SQL Injection, XSS, SSTI |
    | File upload | File Upload, XXE, XSS |
    | URL parameters | Path Traversal, Open Redirect, IDOR |
    | Webhook / URL fetch | SSRF |
    | JSON APIs | NoSQL Injection, Prototype Pollution, Deserialization |
    | Auth tokens | JWT Vulnerabilities, Authentication Bypass |

    4. Payload Testing

    Select the appropriate payload category from this reference. Start with detection payloads — the simplest inputs that reveal whether the vulnerability class exists — before escalating.

    Follow this order:

  • Detection — Submit minimal probes (e.g., a single quote for SQLi, {{7*7}} for SSTI)

  • Confirmation — Observe response differences, timing changes, or error messages

  • Exploitation — Apply targeted payloads that demonstrate real impact

  • Escalation — Determine the maximum impact in context

    • 5. Validation

    A finding is valid when you can demonstrate actual impact:

    • Show data extraction (not just an error message)

    • Demonstrate code execution with a safe, benign payload (e.g., id, whoami)

    • Capture the full request/response chain as evidence

    • Test reproducibility


    6. Reporting

    Document findings with:

    • Title — Concise, accurate description

    • Severity — Based on actual impact (CVSS or program severity rubric)

    • Steps to reproduce — Exact request/response

    • Impact — What an attacker could achieve

    • Remediation — Specific fix recommendations


    References

  • OWASP Testing Checklist