OWASP Hunting

Methodology

Security testing methodology for using OWASP Hunting payloads effectively.

Methodology

OWASP Hunting payloads are reference material for structured security assessments. This page describes a recommended workflow for integrating them into authorized testing.

Overview

Effective security testing follows a defined process:

  1. Scope definition — Confirm authorization and enumerate in-scope targets
  2. Reconnaissance — Map the attack surface
  3. Vulnerability identification — Identify injection points and potential weaknesses
  4. Payload testing — Apply targeted payloads from the reference
  5. Validation — Confirm exploitability with a minimal proof of concept
  6. Reporting — Document findings with impact and remediation guidance

1. Scope Definition

Before any testing:

  • Obtain explicit written authorization
  • Review program rules or engagement scope documents
  • Confirm which domains, endpoints, and functionality are in scope
  • Understand out-of-scope assets and prohibited techniques

2. Reconnaissance

Map the application surface before testing payloads:

  • Enumerate endpoints and parameters (manually and with tools like ffuf, Burp Crawler)
  • Identify technology stack (web framework, database, language)
  • Note input fields, file upload features, and API endpoints
  • Check for JavaScript files exposing hidden endpoints

3. Vulnerability Identification

Match application features to vulnerability classes:

| Feature | Relevant Categories |
|---|---|
| Login forms | SQL Injection, Authentication Bypass, NoSQL Injection |
| Search / filters | SQL Injection, XSS, SSTI |
| File upload | File Upload, XXE, XSS |
| URL parameters | Path Traversal, Open Redirect, IDOR |
| Webhook / URL fetch | SSRF |
| JSON APIs | NoSQL Injection, Prototype Pollution, Deserialization |
| Auth tokens | JWT Vulnerabilities, Authentication Bypass |

4. Payload Testing

Select the appropriate payload category from this reference. Start with detection payloads — the simplest inputs that reveal whether the vulnerability class exists — before escalating.

Follow this order:

  1. Detection — Submit minimal probes (e.g., a single quote for SQLi, {{7*7}} for SSTI)
  2. Confirmation — Observe response differences, timing changes, or error messages
  3. Exploitation — Apply targeted payloads that demonstrate real impact
  4. Escalation — Determine the maximum impact in context

5. Validation

A finding is valid when you can demonstrate actual impact:

  • Show data extraction (not just an error message)
  • Demonstrate code execution with a safe, benign payload (e.g., id, whoami)
  • Capture the full request/response chain as evidence
  • Test reproducibility

6. Reporting

Document findings with:

  • Title — Concise, accurate description
  • Severity — Based on actual impact (CVSS or program severity rubric)
  • Steps to reproduce — Exact request/response
  • Impact — What an attacker could achieve
  • Remediation — Specific fix recommendations

References