Web surface review with ffuf and proxies
Seeing your own application’s external surface and closing leaks and exposures.
Level 201 · 21 lessons · 18 practice labs
Lessons
Scope and tools
- Scope and permission for web testing: You will understand why the scope and written permission must be settled before testing a web application.
- Speaking HTTP by hand with curl: raw responses: You will send requests to your own application with curl, read raw HTTP responses and understand what the headers contain.
- Burp Suite and ZAP: your own app's traffic through an intercepting proxy: You will use an intercepting proxy to see and inspect the traffic between the browser and your own application's server.
- Short task: define the lab app’s scope in the proxy and filter out the noise
Technology fingerprinting
- Recognising technology from response headers and cookie names
- Error pages, default files and version leaks
- Detecting the software stack with whatweb and Wappalyzer
- Extracting endpoints from JavaScript files and source maps
- Short task: identify the lab app’s stack with versions and close the leaks
Content discovery
- Hidden content left exposed (ffuf) and how to close it: You will spot and close backups, configuration files and hidden pages that were left exposed by mistake.
- Auditing forgotten virtual hosts and parameters with ffuf: You will use ffuf to find forgotten test sites and undocumented parameters on your own server and list what should be closed.
- Backup, .git and .env files left exposed
- Forgotten API docs: OpenAPI and Swagger pages
- API authentication and tokens with curl: You will understand how APIs recognise users with keys and tokens, and what to watch for to use them safely.
- Secrets leaking in responses, with curl and jq: You will find and close keys, versions and internal details that leak by accident in responses and error messages.
- Short task: find three exposed files, remove them and block them with a server rule
Closing and monitoring the surface
- Security headers and cookie flags with curl: You will check security headers and cookie flags on your own application and add the missing ones.
- How an ffuf scan looks in the logs: You will recognise how automated scans look in web server logs and tell them apart from normal visits.
- Rate limits and a web application firewall (WAF): You will learn how rate limits and a web application firewall (WAF) slow down and block suspicious requests, and how to tune them.
- The attack surface map: endpoints, roles and inputs
- Capstone: an external-surface review of an application (ffuf, curl): In the capstone you will review the external surface of a fictional company's web application and report leaks and exposed items.
Practice labs
- Which stack do the response headers give away: Work out the server and framework from the lab app's response headers and cookie names, then switch off the headers that leak versions.
- The version on the default error page: Find the version leaking on the default error page for a missing path and replace it with a custom error page.
- Internal endpoints from a source map: Pull internal API endpoints out of a source map left in production, remove the map and confirm the endpoints are protected.
- Verify the whatweb result and close the leaks: Verify each technology claim in the whatweb output by hand, discard the wrong ones and close every place the right ones leak.
- An exposed .env file: Find the .env file still reachable on the lab server, block it with a server rule and report that the secrets inside must be rotated.
- A forgotten admin folder found with ffuf: Scan a short wordlist with ffuf to find a forgotten admin folder and put it behind authentication.
- Source code from an exposed .git folder: Prove the .git folder left in the web root leaks source code, remove it and add a rule that blocks every hidden folder.
- A hidden virtual host: staging: Find the staging virtual host reachable through the Host header and left open to the outside, then restrict it to the internal network.
- A hidden parameter: debug=1: Fuzz parameter names with ffuf to find the hidden parameter that turns on debug output, fix the code and disable it in the production config.
- A public Swagger page: Find the Swagger page open to unauthenticated users and move the docs behind authentication.
- Internal fields leaking in a response, found with jq: Filter the profile API response with jq to find needless fields such as password hashes and internal notes and narrow the response schema.
- An endpoint that works without a token, shown with curl: Compare requests with and without a token in curl to find an API endpoint that needs no authentication and protect it.
- An undocumented endpoint missing from the OpenAPI file: Compare the OpenAPI file with real traffic, find an endpoint not in the spec and either remove it or add it to the spec with an authorisation rule.
- An ffuf scan in the access log: Recognise a content scan in the access log by rate, 404 ratio and User-Agent and report when it started and ended.
- A rate limit for the login page: Measure that the login page accepts unlimited requests, add a server-side rate limit and show with ffuf that the limit kicks in.
- An alert rule for scan traces: Write a log query that catches clients producing many 404s in a short time and exclude health checks from false alarms.
- An attack surface map: roles and inputs: Map the lab app's endpoints, roles and inputs in one table and rank the three riskiest points with reasons.
- External surface review: the Ardic Insurance portal: Review the external surface of the fictional Ardic Insurance portal with ffuf and curl, close three exposures and prove the closure with a rescan.
About this course
Seeing your own application’s external surface and closing leaks and exposures.
What you will learn
- Scope and tools
- Technology fingerprinting
- Content discovery
- Closing and monitoring the surface
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.