Web Application Hacking · Topic 2 of 8
Web App Concepts, Threats and Hacking Methodology
Web application architecture, HTTP basics, the OWASP Top 10 categories and the stages of the CEH web application hacking methodology for the exam.
- 4 min
- Three tiers: presentation, logic, data.
- GET shows parameters in the URL. POST sends them in the body.
- OWASP Top 10 2021 starts with Broken Access Control and ends with SSRF.
What it is
A web application is software delivered over HTTP or HTTPS that runs partly in the browser and partly on a server. Its flaws are usually in how it handles input, identity and data, not in the underlying server.
The page explains how a web application is built, the main threat categories (using the OWASP Top 10), and the staged methodology CEH uses to test one.
How it works
Concepts
Most applications use a three tier design: a presentation tier (the browser and web server), a logic tier (the application server) and a data tier (the database). Requests use HTTP methods.
| Method | Use |
|---|---|
| GET | Read a resource, parameters visible in the URL |
| POST | Send data in the body |
| PUT and PATCH | Replace or modify a resource |
| DELETE | Remove a resource |
| HEAD | Headers only |
| OPTIONS | Ask which methods are allowed |
| TRACE | Echo the request, usually disabled |
Status code families are 2xx success, 3xx redirection, 4xx client error and 5xx server error. For example 200 means OK, 301 moved, 401 unauthorized, 403 forbidden, 404 not found and 500 server error. Cookies carry session state, and the browser enforces the same origin policy, which stops a page from one origin reading data from another.
Technologies include HTML, JavaScript, server side languages, frameworks, content management systems, REST and SOAP services, and databases. Stateless HTTP is the reason sessions are carried by tokens.
Threats: the OWASP Top 10
OWASP (Open Worldwide Application Security Project) publishes the Top 10 list of the most critical web risks. The 2021 list is:
| No. | Category |
|---|---|
| A01 | Broken Access Control |
| A02 | Cryptographic Failures |
| A03 | Injection |
| A04 | Insecure Design |
| A05 | Security Misconfiguration |
| A06 | Vulnerable and Outdated Components |
| A07 | Identification and Authentication Failures |
| A08 | Software and Data Integrity Failures |
| A09 | Security Logging and Monitoring Failures |
| A10 | Server-Side Request Forgery |
These pages use the 2021 list, because the CEH v13 courseware is based on it. OWASP has since published a 2025 edition, which adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, folds SSRF into Broken Access Control, and renames two categories. Check which list a question names.
Injection covers SQL, command, LDAP and similar attacks, and cross site scripting is grouped there in the 2021 list. Other threats the exam names are cross site request forgery, insecure direct object references, clickjacking, file inclusion, XML external entity (XXE) attacks, parameter tampering, hidden field manipulation, unvalidated redirects and denial of service.
The hacking methodology
The CEH approach is a sequence of steps that moves from knowing nothing about the app to attacking each layer of it.
| Step | Goal |
|---|---|
| Footprint the web infrastructure | Find servers, services, hidden content and technologies |
| Analyze web applications | Map entry points and server side technologies |
| Bypass client side controls | Defeat checks that run only in the browser |
| Attack authentication | Break login, recovery and registration |
| Attack authorization | Reach data or functions outside your role |
| Attack access controls | Abuse direct object references and privilege checks |
| Attack session management | Predict, steal or fix session tokens |
| Perform injection and input validation attacks | Send crafted input to interpreters |
| Attack application logic | Abuse flawed business rules |
| Attack shared environments, database connectivity, clients, web services and APIs | Reach the surrounding platform |
Each step feeds the next. For example mapping the entry points tells the tester which parameters may reach a database.
Tools
Intercepting proxies such as Burp Suite and OWASP ZAP sit between browser and server so requests can be viewed and changed. Scanners such as Acunetix and Nikto look for known flaws. Browser developer tools show client side code and cookies.
A worked example
A tester finds that a page uses a numeric id parameter to fetch an order, then checks whether changing it shows another user's order. The finding is broken access control (A01), found while attacking access controls in the methodology. The fix is a server side check that the order belongs to the logged in user.
How the exam asks about this
- "Which OWASP 2021 category is at the top of the list?" -> Broken Access Control.
- "Which tier of a three tier application holds the business rules?" -> The logic (application) tier.
- "Which tool sits between the browser and the server to view and modify requests?" -> An intercepting proxy such as Burp Suite.
What to remember for the exam
- Three tiers: presentation, logic, data.
- GET shows parameters in the URL. POST sends them in the body.
- OWASP Top 10 2021 starts with Broken Access Control and ends with SSRF.
- The methodology begins with footprinting and ends with attacking the surrounding services.
- The same origin policy limits cross origin reads in the browser.
The OWASP list has changed over time. If a question quotes a category name, match it to the 2021 wording above.
Common mistakes
Treating the web server and the application as the same thing. They have different flaws and different fixes.
Believing HTTPS makes the application secure. It protects traffic, not application logic.
Ignoring design flaws. Insecure design cannot be fixed by input filtering alone.
Check yourself
Name the three tiers of a typical web application.
Presentation, logic and data.
Which HTTP method echoes the request back and is normally disabled?
TRACE.
What is the first step of the CEH web application methodology?
Footprinting the web infrastructure.
Topic 2 of 8 in Web Application Hacking
Test yourself on Web Application Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.