wstg-info-06

Test ID

WSTG-INFO-06

Test Name

Identify Application Entry Points

High-Level Description

Entry points are the interfaces through which user-supplied data enters the application. Identifying all entry points is critical for mapping the application's attack surface before conducting targeted security tests. Entry points include URL parameters, POST body data, HTTP headers, cookies, file uploads, and any other mechanism that accepts user input. A comprehensive understanding of entry points allows penetration testers to systematically test each input vector for vulnerabilities such as injection, access control bypasses, and business logic flaws.

What to Check

Information to Document

Parameter names and locations
Data types (string, integer, boolean, etc.)
Accepted value ranges
Required vs optional parameters
Authentication requirements
Multi-step process flows
State-dependent parameters
Encoding schemes used

How to Test

Step 1: Configure Proxy and Browse Application

Burp Suite Setup

Configure browser to use Burp proxy (127.0.0.1:8080)
Enable interception or passive logging
Add target to scope
Browse all application functionality
Review Site Map for discovered endpoints

OWASP ZAP Setup

Launch ZAP and configure browser proxy
Enable HUD or traditional interface
Add target URL to context
Spider the application
Review Sites tree for entry points

Step 2: Analyze GET Requests

GET /app/search?query=test&category=all&page=1&sort=desc HTTP/1.1
Host: target.com
Cookie: session=abc123; preference=dark
User-Agent: Mozilla/5.0
Referer: https://target.com/home
X-Requested-With: XMLHttpRequest

Entry Points in GET Request

Location	Parameter	Value
Query String	query	test
Query String	category	all
Query String	page	1
Query String	sort	desc
Cookie	session	abc123
Cookie	preference	dark
Header	User-Agent	Mozilla/5.0
Header	Referer	https://...
Header	X-Requested-With	XMLHttpRequest

Step 3: Analyze POST Requests

POST /app/checkout HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123

product_id=100&quantity=2&price=50.00&discount_code=SAVE10&shipping=express

Entry Points in POST Request

Location	Parameter	Value	Notes
Body	product_id	100	Potential IDOR
Body	quantity	2	Integer manipulation
Body	price	50.00	Price tampering
Body	discount_code	SAVE10	Brute-force target
Body	shipping	express	Business logic

Step 4: Analyze JSON/API Requests

POST /api/v1/users HTTP/1.1
Host: target.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1...
X-API-Key: abcd1234

{
    "username": "newuser",
    "email": "user@example.com",
    "role": "user",
    "permissions": ["read", "write"],
    "metadata": {
        "source": "web",
        "version": "2.0"
    }
}

Entry Points in JSON Request

Location	Parameter	Path	Type
Header	Authorization	-	JWT Token
Header	X-API-Key	-	API Key
Body	username	$.username	String
Body	email	$.email	Email
Body	role	$.role	Enum
Body	permissions	$.permissions[]	Array
Body	source	$.metadata.source	Nested

Step 5: Analyze RESTful URL Patterns

GET /api/users/123/orders/456/items

URL Path Parameters

Segment	Type	Description
users	Resource	User collection
123	ID Parameter	User ID (IDOR test)
orders	Resource	Orders collection
456	ID Parameter	Order ID (IDOR test)
items	Resource	Items sub-resource

Step 6: Analyze Response Headers

HTTP/1.1 200 OK
Server: nginx/1.18.0
Set-Cookie: session=newvalue; HttpOnly; Secure
Set-Cookie: tracking=xyz; Path=/
X-Request-ID: req-12345
X-Debug-Mode: enabled
Cache-Control: no-cache
Content-Type: application/json

Notable Response Elements

Header	Value	Security Note
Server	nginx/1.18.0	Version disclosure
Set-Cookie	session=...	Session management
X-Debug-Mode	enabled	Debug info leak
X-Request-ID	req-12345	Tracking identifier

Step 7: Document Hidden Form Fields

<form action="/checkout" method="POST">
  <input type="hidden" name="csrf_token" value="abc123" />
  <input type="hidden" name="user_id" value="500" />
  <input type="hidden" name="base_price" value="100.00" />
  <input type="hidden" name="is_admin" value="false" />
  <input type="text" name="quantity" value="1" />
  <button type="submit">Purchase</button>
</form>

Hidden Field Analysis

Field	Value	Risk
csrf_token	abc123	Token strength
user_id	500	IDOR vulnerability
base_price	100.00	Price manipulation
is_admin	false	Privilege escalation

Step 8: Map Multi-Step Processes

Document workflows that require multiple requests:

1. GET /cart → View cart
2. POST /cart/apply-coupon → Apply discount
3. GET /checkout → Checkout page
4. POST /checkout/address → Submit address
5. POST /checkout/payment → Submit payment
6. POST /checkout/confirm → Confirm order

Process Flow Entry Points

Step	Method	Key Parameters	State
1	GET	-	Unauthenticated
2	POST	coupon_code	Cart active
3	GET	-	Authenticated
4	POST	address_id, new_address	Cart active
5	POST	card_token, save_card	Address set
6	POST	confirm_token	Payment ready

Step 9: Identify WebSocket Endpoints

// Browser DevTools > Network > WS
ws://target.com/socket
wss://target.com/secure-socket

// WebSocket message format
{"action": "subscribe", "channel": "orders", "user_id": 123}

Step 10: Document GraphQL Entry Points

# GraphQL query entry points
query {
  user(id: 123) {
    name
    email
    orders {
      id
      total
    }
  }
}

mutation {
  updateUser(id: 123, role: "admin") {
    success
  }
}

Tools

Proxy Tools

Tool	Description	Key Feature
Burp Suite	Web proxy	Site map, parameter extraction
OWASP ZAP	Open-source proxy	Automated spider, HUD
Fiddler	Traffic inspector	.NET integration
mitmproxy	CLI proxy	Scriptable interception
Charles Proxy	macOS proxy	SSL proxying

Automated Discovery

Tool	Description	Usage
Attack Surface Detector	Source code analysis	`java -jar asd.jar <source>`
Param Miner	Burp extension	Hidden parameter discovery
Arjun	Parameter finder	`arjun -u https://target.com`
x8	Hidden parameter discovery	`x8 -u https://target.com`
ParamSpider	Parameter extraction	`paramspider -d target.com`

API Analysis

Tool	Description
Postman	API testing
Insomnia	REST/GraphQL client
GraphQL Voyager	Schema visualization
Swagger UI	OpenAPI testing

Example Commands/Payloads

Burp Suite Entry Point Extraction

Navigate to Target > Site map
Right-click target > Engagement tools > Analyze target
Review "Entry points" section
Export parameters: Target > Site map > Right-click > Copy URLs

Arjun - Hidden Parameter Discovery

# Install
pip3 install arjun

# Basic scan
arjun -u https://target.com/page

# With wordlist
arjun -u https://target.com/page -w params.txt

# JSON body parameters
arjun -u https://target.com/api -m POST -c 'Content-Type: application/json'

# Multiple URLs
arjun -i urls.txt -o results.json

ParamSpider - URL Parameter Extraction

# Install
git clone https://github.com/devanshbatham/paramspider
cd paramspider
pip3 install -r requirements.txt

# Basic usage
python3 paramspider.py -d target.com

# Exclude specific parameters
python3 paramspider.py -d target.com -e js,css,png

# Output to file
python3 paramspider.py -d target.com -o params.txt

x8 - Hidden Parameter Discovery

# Install (Rust required)
cargo install x8

# Basic scan
x8 -u https://target.com/page -w params.txt

# With method and body
x8 -u https://target.com/api -X POST -b '{"test":"value"}'

Custom Entry Point Documentation Script

#!/bin/bash
# Extract entry points from Burp Suite export

INPUT_FILE=$1
OUTPUT_FILE="entry_points.csv"

echo "URL,Method,Parameter,Location,Type" > $OUTPUT_FILE

# Parse URLs for GET parameters
grep -oP 'https?://[^\s]+' $INPUT_FILE | while read url; do
    # Extract query parameters
    echo "$url" | grep -oP '\?[^#]+' | tr '&' '\n' | while read param; do
        name=$(echo $param | cut -d= -f1 | tr -d '?')
        echo "$url,GET,$name,Query String,Unknown" >> $OUTPUT_FILE
    done
done

echo "Entry points saved to $OUTPUT_FILE"

Entry Point Documentation Template

## Endpoint: /api/users/{id}

### Request

- **Method**: PUT
- **Authentication**: Required (Bearer token)
- **Content-Type**: application/json

### Parameters

| Name          | Location | Type    | Required | Description   |
| ------------- | -------- | ------- | -------- | ------------- |
| id            | URL Path | Integer | Yes      | User ID       |
| Authorization | Header   | String  | Yes      | JWT Token     |
| name          | Body     | String  | No       | Display name  |
| email         | Body     | String  | No       | Email address |
| role          | Body     | Enum    | No       | user/admin    |

### Example Request

```json
PUT /api/users/123
Authorization: Bearer eyJ...
Content-Type: application/json

{
    "name": "John Doe",
    "email": "john@example.com",
    "role": "user"
}
```

Test Cases

IDOR: Try accessing other user IDs
Privilege escalation: Change role to admin
SQL injection in path parameter
Mass assignment via role field


---

## Remediation Guide

### 1. Input Validation

```python
# Server-side validation example
def validate_user_input(data):
    schema = {
        'username': {'type': 'string', 'minlength': 3, 'maxlength': 50},
        'email': {'type': 'string', 'regex': r'^[^@]+@[^@]+\.[^@]+$'},
        'age': {'type': 'integer', 'min': 0, 'max': 150},
        'role': {'type': 'string', 'allowed': ['user', 'moderator']}
    }
    # Validate against schema
    return validate(data, schema)

2. Minimize Exposed Parameters

<!-- BAD: Exposing sensitive data -->
<input type="hidden" name="price" value="100.00" />
<input type="hidden" name="is_admin" value="false" />

<!-- GOOD: Server-side price lookup -->
<input type="hidden" name="product_id" value="SKU123" />
<!-- Price calculated server-side based on product_id -->

3. Implement Proper Access Controls

# Check ownership before processing
def update_order(request, order_id):
    order = Order.objects.get(id=order_id)
    if order.user_id != request.user.id:
        return HttpResponseForbidden()
    # Process update

4. Use Security Headers

Set-Cookie: session=value; HttpOnly; Secure; SameSite=Strict
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'

5. Rate Limiting

# nginx rate limiting
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    location /api/ {
        limit_req zone=api burst=20 nodelay;
    }
}

6. Monitor Reconnaissance Activity

Log all 404 errors and unusual parameter patterns
Alert on parameter fuzzing signatures
Implement honeypot parameters

Risk Assessment

CVSS Score

This is a reconnaissance/enumeration activity, not a direct vulnerability. The CVSS score depends on what is discovered:

Entry Point Mapping (Info)

Base Score: 0.0 (Informational)
This is a testing methodology, not a finding

Excessive Entry Points (Observation)

Wide attack surface may indicate architectural concerns
Recommend minimizing unnecessary parameters

Attack Surface Indicators

Observation	Risk Level	Implication
< 20 parameters	Low	Minimal attack surface
20-50 parameters	Medium	Moderate attack surface
50-100 parameters	High	Large attack surface
> 100 parameters	Critical	Extensive testing required

CWE Categories

CWE ID	Title	Relevance
CWE-20	Improper Input Validation	Entry points require validation
CWE-284	Improper Access Control	Entry point authorization
CWE-639	Authorization Bypass Through User-Controlled Key	ID parameters in paths
CWE-352	Cross-Site Request Forgery	Form entry points

References

OWASP References

Tools

Additional Resources

Checklist

[ ] Proxy configured and traffic captured
[ ] All GET parameters documented
[ ] All POST parameters documented
[ ] Hidden form fields identified
[ ] Cookie parameters noted
[ ] Custom headers recorded
[ ] RESTful path parameters mapped
[ ] JSON/XML body parameters extracted
[ ] File upload fields identified
[ ] WebSocket endpoints documented
[ ] GraphQL queries analyzed
[ ] Multi-step processes mapped
[ ] Authentication requirements noted
[ ] Parameter data types identified
[ ] Required vs optional parameters distinguished
[ ] Response headers analyzed
[ ] Entry point spreadsheet/document created
[ ] Attack surface summary prepared

wstg-info-06

Files1

SKILL.md.bountyreaper/skill/WEB/OWASP_WSTG_4.2/wstg-info-06/SKILL.md

wstg-info-06

Test ID

Test Name

High-Level Description

What to Check

Entry Point Categories

Information to Document

How to Test

Step 1: Configure Proxy and Browse Application

Burp Suite Setup

OWASP ZAP Setup

Step 2: Analyze GET Requests

Entry Points in GET Request

Step 3: Analyze POST Requests

Entry Points in POST Request

Step 4: Analyze JSON/API Requests

Entry Points in JSON Request

Step 5: Analyze RESTful URL Patterns

URL Path Parameters

Step 6: Analyze Response Headers

Notable Response Elements

Step 7: Document Hidden Form Fields

Hidden Field Analysis

Step 8: Map Multi-Step Processes

Process Flow Entry Points

Step 9: Identify WebSocket Endpoints

Step 10: Document GraphQL Entry Points

Tools

Proxy Tools

Automated Discovery

API Analysis

Example Commands/Payloads

Burp Suite Entry Point Extraction

Arjun - Hidden Parameter Discovery

ParamSpider - URL Parameter Extraction

x8 - Hidden Parameter Discovery

Custom Entry Point Documentation Script

Entry Point Documentation Template

Test Cases

2. Minimize Exposed Parameters

3. Implement Proper Access Controls

4. Use Security Headers

5. Rate Limiting

6. Monitor Reconnaissance Activity

Risk Assessment

CVSS Score

Attack Surface Indicators

CWE Categories

References

OWASP References

Tools

Additional Resources

Checklist

Related in security

git-workflow

clerk-observability

juicebox-migration-deep-dive