Web applications expose more than the links visible in a browser. Unlinked directories, name-based virtual hosts, undocumented parameters, and API routes can all expand the attack surface. This course teaches you to discover those elements and then inspect the HTTP requests used to reach them.
Using ffuf, Gobuster, curl, and jq against local targets, you will move from content enumeration to precise request construction and REST API interaction. The final challenge brings these skills together as you discover a hidden virtual host, map its API path, and build the request required to retrieve a lab token.
What You Will Learn
- Use supplied wordlists with
ffufto enumerate hidden directories and filter results by HTTP status code. - Use Gobuster to search for files with selected extensions such as
.phpand.txt. - Discover name-based virtual hosts by fuzzing the
Hostheader and filtering default responses by size. - Fuzz undocumented GET and POST parameter names and verify the resulting application behavior.
- Inspect verbose HTTP exchanges with
curland construct query strings, headers, cookies, and form bodies. - Authenticate to a local REST API, send Bearer tokens, parse JSON with
jq, and exercise PUT and DELETE methods. - Combine virtual-host discovery, directory enumeration, and a custom API request in an independent mapping challenge.
Who This Course Is For
This intermediate course is for security learners who understand basic web requests and want hands-on practice mapping web attack surfaces. It is useful for aspiring web penetration testers, API security learners, and developers or defenders who want to see how hidden routes and client-controlled HTTP fields are tested.
Prerequisites: Comfort with a Linux terminal and basic redirection, plus an understanding of URLs, HTTP methods, headers, status codes, and JSON structure.
Learning environment: An Ubuntu 22.04 terminal with ffuf, Gobuster, curl, and jq, supplied wordlists, and isolated local web and API targets on port 8080. No public system is scanned.
Frequently Asked Questions
Does this course use Burp Suite or another graphical intercepting proxy?
No. The HTTP interception lab uses verbose curl requests as a manual foundation for reading and modifying request components. It prepares you for graphical proxies but does not teach a Burp Suite or OWASP ZAP workflow.
Is the fuzzing used to guess passwords?
No. The exercises use small supplied wordlists to test directory names, filenames, virtual-host names, and parameter names. They do not perform credential brute forcing.
Will I send requests to real websites?
No. All enumeration and API requests target services hosted inside the course environment at 127.0.0.1 or localhost on port 8080.
What API operations will I perform?
You will identify endpoints, authenticate with fixed lab credentials, pass a Bearer token, extract fields from JSON, and send PUT and DELETE requests that modify data in the isolated practice API. The final challenge also requires a POST request with custom headers to obtain a lab token.
