Passive and active recon, web crawling, HTTP security headers, SSL/TLS testing, CORS, and configuration flaws — everything for the GIAC Web Application Penetration Tester exam.
This page covers Objectives 2 & 3 of 8 GWAPT exam objectives: Reconnaissance & Mapping, and Web Application Configuration Testing. Know before you attack — reconnaissance defines your target surface; configuration testing reveals the low-hanging fruit that poor setup leaves behind.
GWAPT uses GIAC's CyberLive format — a live lab environment with real tools alongside traditional multiple-choice questions. You will use real web application penetration testing tools during the exam. Practice with actual tools, not just theory.
| # | Objective | This Page |
|---|---|---|
| 1 | Web Application Overview | — |
| ★ 2 | Reconnaissance and Mapping | ✓ Covered |
| ★ 3 | Web Application Configuration Testing | ✓ Covered |
| 4 | Web Application Authentication Attacks | — |
| 5 | Web Application Session Management | — |
| 6 | Web Application SQL Injection Attacks | — |
| 7 | Cross-Site Request Forgery, XSS & Client Injection Attacks | — |
| 8 | Web Application Testing Tools | — |
WHOIS, DNS enumeration, Google dorking, Shodan, Certificate Transparency logs, Wayback Machine, and OSINT techniques — all without touching the target.
Port scanning with nmap, service fingerprinting, web crawling with Burp Suite, directory brute-forcing with Gobuster/FFuF, and application flow mapping.
X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS, Referrer-Policy — testing for presence, correctness, and common misconfigurations.
Weak protocol versions (POODLE, BEAST), weak cipher suites, testssl.sh, default credentials, directory listing, CORS misconfiguration, and sensitive file exposure.
These objectives are foundational to every subsequent attack phase. Memorize the Google dork operators, know the DNS record types cold, and practice the curl commands for testing headers. The CyberLive component means you must be comfortable running testssl.sh, gobuster, and dig commands hands-on.
Passive recon gathers information about the target without making any direct contact. All techniques below are legal even without written authorization — you are only observing publicly available data.
Queries domain registration databases for registrant name, organization, email, registrar, name servers, and creation/expiry dates.
whois target.comwww → app.target.com)dig axfr @ns1.target.com target.com — if the server is misconfigured, returns ALL DNS records at once. A critical finding.dnsenum, sublist3r, amass, dnsreconAdvanced search operators to find sensitive information indexed by Google without touching the target server.
site:target.com filetype:pdf — find exposed documentssite:target.com inurl:admin — find admin pagessite:target.com intitle:"index of" — find directory listingssite:target.com ext:sql OR ext:bak — find backup/database files"target.com" "password" — find leaked credentialsSearch engine for internet-connected devices. Indexes banners, service versions, open ports, and TLS certificates. Use hostname:target.com to find exposed services without probing directly.
Every SSL/TLS certificate issued by a public CA must be logged in Certificate Transparency logs. crt.sh lets you search these logs by domain, revealing all issued certificates and — critically — all subdomains the organization has certificates for.
https://crt.sh/?q=%.target.comHistorical snapshots of web pages. Find removed functionality, old endpoints, credentials committed to old config files, former staff directories, and legacy API versions.
Job postings reveal technology stack ("experience with AWS RDS PostgreSQL"). LinkedIn reveals employee names, roles, and potential usernames. GitHub searches may expose API keys, credentials in code, or internal architecture details.
Active reconnaissance makes direct contact with the target. Always obtain written authorization (Rules of Engagement) before proceeding. Unauthorized port scanning can violate laws including the CFAA.
nmap -sV -p- target.com — all 65535 ports, version detectionnmap -sC -sV -p 80,443,8080,8443,8888 target.com — common web ports with default scriptsnmap --script http-enum target.com — web enumeration NSE scriptnmap -O — OS detection via TCP/IP stack fingerprintingnmap -sV sends version probes to identify server software and versions. Banner grabbing (reading the server's initial response) also works: curl -I https://target.com. Look for headers like Server: Apache/2.4.41 and X-Powered-By: PHP/7.4.3.
Automated discovery of links, forms, API endpoints, and hidden parameters. Enable the Burp proxy first so all manual browsing is captured. Burp's Spider follows links within scope settings.
gobuster dir -u http://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt/admin, /login, /api, /backup, /.git, /config, /phpinfo.php, /wp-adminServer: header — web serverX-Powered-By: — frameworkPHPSESSID (PHP), JSESSIONID (Java), ASP.NET_SessionId (.NET), connect.sid (Node.js)HttpOnly, Secure, SameSite, domain/path scopeTest with: curl -I https://target.com — check for presence and correct values of each header.
Prevents clickjacking by controlling whether the page can be embedded in an iframe.
DENY — no embedding anywhereSAMEORIGIN — only same-origin embeddingframe-ancestors but still widely tested on the examPrevents the browser from MIME-type sniffing — the browser must use the declared Content-Type. Prevents certain XSS attacks via file upload (e.g., uploading a JS file declared as image/png).
Defines allowed sources for scripts, styles, images, fonts, frames, etc. — the most powerful XSS mitigation header.
script-src 'self' — only same-origin scriptsdefault-src 'none' — deny everything not explicitly allowed'unsafe-inline', 'unsafe-eval', wildcard sources (*)Forces browsers to connect only via HTTPS for the specified duration. Prevents SSL stripping attacks.
max-age=31536000; includeSubDomains; preloadpreload: only protects after the user visits once via HTTPS1; mode=block. Don't rely on it.testssl.sh target.com. Tests protocols, ciphers, certificates, and known vulnerabilities./admin, /administrator/wp-admin (WordPress)/phpmyadmin (MySQL admin)/manager/html (Apache Tomcat)/console (JBoss/WildFly)/actuator (Spring Boot)/Passwords/Default-Credentials/Options +Indexes in .htaccess — enables browsing the file systemautoindex on directive/var/www/html/app.php:42), database type'), invalid data types, extra-long inputs — observe responsesAPP_DEBUG=false)curl -X OPTIONS https://target.com -i — check Allow: response headercurl -X TRACE https://target.com -i — TRACE should be disabled (Cross-Site Tracing / XST attack)PROPFIND, MKCOL — if WebDAV is enabled, often exploitable for file upload.bak, .old, .orig, ~ (Unix backup), .swp (vim swap) — e.g., index.php.bak/.git/HEAD, /.git/config — if .git directory is publicly accessible, full source code can be reconstructedconfig.php, web.config, .env, database.yml, settings.py, application.propertieserror.log, access.log, debug.logAccess-Control-Allow-Origin: * — browsers block cookies with wildcard, but API-key authenticated APIs can still be abusedOrigin: header it receives — allows any site to make credentialed requests (most severe)Access-Control-Allow-Origin: null — an iframe in sandbox mode can send a null origin and gain accessOrigin: https://attacker.com header and check if response contains Access-Control-Allow-Origin: https://attacker.com and Access-Control-Allow-Credentials: trueSix high-yield hooks that collapse complex topics into memorable patterns. Each maps to testable exam content.
site:target.com ext:sql finds exposed database dumps.curl -I and check for absence of each.testssl.sh checks all of these automatically.Access-Control-Allow-Origin: https://attacker.com + Access-Control-Allow-Credentials: true), any attacker site can read the response. The mirror metaphor: if the server just reflects your origin back, it trusts anyone.index.php.bak exposing source code is a classic finding.Memorize: PHPSESSID = PHP, JSESSIONID = Java, ASP.NET_SessionId = .NET, connect.sid = Node.js/Express. These appear in scenario questions asking you to identify the technology stack from an HTTP response.
GWAPT-style scenario questions covering Objectives 2 & 3. Each question mirrors real exam phrasing. Read the scenario carefully before selecting.
Click any card to flip it and reveal the answer.
dig axfr @ns1.target.com target.com reveals all DNS records at once — subdomains, internal IPs, mail servers, staging hosts. A successful unauthenticated AXFR is a critical finding.robots.txt lists paths that crawlers are instructed to skip. The irony: disallowed paths are exactly what pentesters want to find — they often contain admin panels, staging environments, old APIs, or sensitive functionality the developer didn't want indexed. Always check /robots.txt early in recon.'unsafe-inline' (allows inline scripts, negating XSS protection), 'unsafe-eval' (allows eval()), and wildcard * sources (allows any origin). A CSP with these is essentially no protection.max-age=31536000), it will refuse to connect via plain HTTP for that domain for the specified duration. Without HSTS, an attacker can MITM the first HTTP request and strip the HTTPS redirect. includeSubDomains extends protection to all subdomains; preload bakes it into the browser binary.Origin: https://attacker.com. If the response includes Access-Control-Allow-Origin: https://attacker.com AND Access-Control-Allow-Credentials: true, the server reflects origins without validation. Impact: a malicious site can make credentialed cross-origin requests and read responses — effectively bypassing the Same-Origin Policy for authenticated API calls.DENY (no iframe embedding at all) or SAMEORIGIN (only same-origin pages can embed it). Superseded by CSP frame-ancestors but still widely deployed and tested.testssl.sh target.com — comprehensive TLS/SSL scanner that tests: supported protocol versions (SSLv2/3, TLS 1.0–1.3), cipher suite strength, certificate validity and chain, known vulnerabilities (POODLE, BEAST, HEARTBLEED, FREAK, LOGJAM, ROBOT, SWEET32), HSTS presence, and more. Output is color-coded: green = OK, yellow = warn, red = critical.crt.sh for %.target.com reveals every subdomain with a certificate — including internal, staging, dev, and test servers the organization may have forgotten about. This is passive recon (no direct contact) that often reveals more attack surface than any active scan.Select a topic category to see key points, exam traps, and a self-reported readiness tracker.
dig axfr @ns1.target.com target.com — if it works, critical findingamass, dnsenum, sublist3r, dnsreconhostname:target.com)-sV = version detection, -sC = default scripts, -p- = all ports, -O = OS detectionnmap --script http-enum: NSE script for web enumeration — finds common pathsrobots.txt disallowed paths = interesting targets for pentestersgobuster dir -u http://target.com -w wordlist.txtcurl -I https://target.com — check for absence of security headersunsafe-inline, unsafe-eval, * as bypassesincludeSubDomains and preloadtestssl.sh target.com — comprehensive TLS scanner, color-coded output/admin, /wp-admin, /phpmyadmin, /manager/html, /actuatorOptions +Indexes or Nginx autoindex on — browse without index file to testcurl -X TRACE should return 405 Method Not Allowed, not a 200Curated references for GWAPT Objectives 2 & 3. Verify all links directly — URLs can change.
For the live lab component, practice these exact commands until they are second nature: dig axfr, nmap -sV -sC, gobuster dir, curl -I, curl -X OPTIONS, curl -X TRACE, and testssl.sh. The exam environment will have these tools available.