# Default Web Strategy

Use this when no specific vulnerability class is identified, or when challenge tags don't match a specialized strategy.

## Phase 1: Reconnaissance (budget: 25%)
1. **Initial request:** `curl -v TARGET` — check response headers, status, body
2. **Technology fingerprint:** Server header, X-Powered-By, cookies (PHPSESSID=PHP, connect.sid=Express, csrftoken=Django)
3. **Directory discovery:**
   ```
   /robots.txt, /sitemap.xml, /.git/, /.env, /.DS_Store
   /admin, /login, /api, /docs, /swagger.json, /openapi.json
   /wp-admin, /wp-login.php (WordPress)
   /phpinfo.php, /info.php
   /backup, /old, /test, /debug
   ```
4. **Source inspection:** View page source for comments, hidden fields, JS files, API endpoints
5. **Form/API discovery:** Map all forms, buttons, AJAX calls, API endpoints

## Phase 2: Authentication Testing (budget: 15%)
1. **Default credentials:** admin:admin, admin:password, admin:123456, root:root, test:test
2. **Registration:** Create account if possible, check for privilege escalation after login
3. **Password reset:** Check for token prediction, user enumeration, email parameter injection
4. **JWT:** If token found, decode it (base64 header.payload), check algorithm (none attack), weak secret (try common secrets), kid injection
5. **Session:** Check cookie flags (HttpOnly, Secure, SameSite), session fixation

## Phase 3: Vulnerability Testing (budget: 35%)
Test each input point for multiple vuln classes in order:

1. **IDOR:** Change sequential IDs (`/user/1` → `/user/2`), UUID enumeration, API endpoint access control
2. **SQLi:** `' OR 1=1--`, `1 UNION SELECT NULL--`, time-based `' AND SLEEP(3)--`
3. **SSTI:** `{{7*7}}`, `${7*7}`, `<%= 7*7 %>`
4. **XSS:** `<script>alert(1)</script>`, `"><img onerror=alert(1) src=x>`
5. **Command Injection:** `; id`, `| id`, `$(id)`
6. **LFI:** `../../etc/passwd`, `php://filter/convert.base64-encode/resource=index`
7. **SSRF:** `http://127.0.0.1`, `http://169.254.169.254`, `file:///etc/passwd`
8. **File Upload:** If upload exists, try `.php`, `.php5`, `.phtml`, double extension `.php.jpg`

**Decision point:** First vulnerability confirmed → switch to the specialized strategy for that class.

## Phase 4: Exploitation & Flag (budget: 25%)
1. Exploit the found vulnerability using the appropriate technique
2. Look for flag in: response body, admin dashboard, database, filesystem
3. Common flag locations: `/flag`, `/flag.txt`, environment variable `FLAG`, database table `flags`
4. If credentials found: login and check admin-only pages
5. If file access gained: read `/flag`, check `/etc/shadow`, dump database

## Pivot Triggers
- After 30% of budget with no findings → re-examine the application flow end-to-end, check for business logic flaws
- Technology identified → load framework-specific checks (e.g., Django debug mode, Rails secret_key_base, PHP deserialization)
- Multiple services detected → check inter-service communication, internal APIs, service-to-service trust
