OFWEB Security Framework
Real-World Offensive Web Security Assessment
A project by 0Trust0Day
0%
Completed
Low
Risk Level
0
Assessed
Assessment Progress
0%
0 items assessed
17 total items
| Phase / Item | Description | Tools | Risk Assessment | Comments & Notes |
|---|---|---|---|---|
| Core Philosophy | ||||
|
Real Attacker Focus
Focus on real attacker behavior rather than compliance checklists
|
Focus on real attacker behavior rather than compliance checklists | — |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Attack Chain Orientation
Orientation on attack chains rather than isolated vulnerabilities
|
Orientation on attack chains rather than isolated vulnerabilities | — |
Score:
0=Low risk, 10=Critical
|
0/500
|
| Phase 1: Basic Reconnaissance & Minimum Resilience | ||||
|
Client-side Analysis
Client-side analysis: console leaks, source maps, storage, cookies
|
Client-side analysis: console leaks, source maps, storage, cookies | Browser DevTools, Burp Suite |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
OWASP Trust Boundaries
OWASP trust boundaries: access control, sessions, CORS, error handling
|
OWASP trust boundaries: access control, sessions, CORS, error handling | OWASP ZAP, Nikto |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Transport Layer Security
Transport layer: TLS/HSTS configuration, CSRF protection
|
Transport layer: TLS/HSTS configuration, CSRF protection | SSL Labs, testssl.sh |
Score:
0=Low risk, 10=Critical
|
0/500
|
| Phase 2: Application Snapshots & Behavioral Analysis | ||||
|
Functional Snapshot
Creating functional snapshot: routes, roles, states
|
Creating functional snapshot: routes, roles, states | Postman, manual mapping |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Anomaly Detection
Anomaly and pattern detection (manual)
|
Anomaly and pattern detection (manual) | Burp Suite Repeater |
Score:
0=Low risk, 10=Critical
|
0/500
|
| Phase 3: Shift to Offensive Mindset | ||||
|
Offensive Thinking
Change focus to real exploitation scenarios
|
Change focus to real exploitation scenarios | — |
Score:
0=Low risk, 10=Critical
|
0/500
|
| Phase 4: Offensive Web Resource Testing | ||||
|
Attack Surface Mapping
Full attack surface mapping & business logic abuse
|
Full attack surface mapping & business logic abuse | Burp Suite, manual testing |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Authorization Issues
Authorization bypass, IDOR, race conditions
|
Authorization bypass, IDOR, race conditions | Burp Intruder |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Session & File Handling
Session/token issues, file handling, SSRF
|
Session/token issues, file handling, SSRF | Commix, SQLmap (light) |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Integration & Header Abuse
Header/webhook abuse, 3rd-party integrations
|
Header/webhook abuse, 3rd-party integrations | Postman |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Advanced Exploitation
Error-driven exploitation, automation bypass, data exfiltration
|
Error-driven exploitation, automation bypass, data exfiltration | Nuclei templates |
Score:
0=Low risk, 10=Critical
|
0/500
|
| Phase 5: Offensive Testing of Admins & Technical Teams | ||||
|
Repository & Commit Analysis
Analysis of repositories, commit history, job postings, presentations, publications
|
Analysis of repositories, commit history, job postings, presentations, publications | Private tools, AI-generated reconnaissance scripts |
Score:
0=Low risk, 10=Critical
|
0/500
|
|
Process Infiltration Modeling
Modeling infiltration into processes (deployment, key management, manual operations — no SOC/SIEM)
|
Modeling infiltration into processes (deployment, key management, manual operations — no SOC/SIEM) | Private and AI-generated tools |
Score:
0=Low risk, 10=Critical
|
0/500
|
| Phase 6: Full Attack Chain Assembly | ||||
|
Kill-Chain Assembly
Assembly of realistic kill-chain from entry point to objective
|
Assembly of realistic kill-chain from entry point to objective | Draw.io, MITRE ATT&CK mapping |
Score:
0=Low risk, 10=Critical
|
0/500
|
| Conclusion | ||||
|
Overall Assessment
Overall resilience to real-world attacks
|
Overall resilience to real-world attacks | — |
Score:
0=Low risk, 10=Critical
|
0/500
|
C-Level Security Assessment Report
Executive summary of security findings and risk assessment
Executive Summary
No assessment data available. Please complete the checklist and generate a report.