+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: Need Guidance on Web App Pentesting Beginner Friendly Tips? (/showthread.php?tid=6313399)
Need Guidance on Web App Pentesting Beginner Friendly Tips? - protones - Nov 10, 2025
Hey HF community,
I’m relatively new to offensive security and currently working on a personal project: testing a small web app I built (PHP + MySQL). I’ve gone through OWASP Top 10 basics and set up Burp Suite, but I’m stuck on a few things:
1. SQLi – I can trigger errors with ' or ", but can’t seem to extract data. Any go-to payloads or techniques for blind/extraction?
2. XSS – Reflected works, but stored gets sanitized. Ideas on bypassing HTML entity encoding or WAF?
3. File Upload – .php uploads are blocked, but .phtml/.php5 are allowed. Should I try double extensions or null byte?
I’m not looking for full exploits (yet), just pointers, tools, or write-ups that helped you when starting out.
Tools I have: Burp, sqlmap, Nikto, dirb.
Running on Kali in VM.