Finding Vulnerabilities Process Pyramid Poster

The Finding Vulnerabilities Process Pyramid poster, published by SANS Institute in January 2025, lays out a six-layer methodology for structuring a web application penetration test, from initial content discovery through continuous retesting. Developed for SEC542: Web App Penetration Testing and Ethical Hacking, the poster organizes the testing process as a pyramid, with the amount of effort decreasing toward the top and continuity as the ultimate goal sitting above it.

The pyramid's six layers:

• Content discovery: Map every browsable attack surface using the Burp Suite Crawl feature, extract JavaScript file paths and references with tools like CyberChef, the GAP Burp plugin, or JSParser, and uncover unlinked content and parameters by fuzzing action verbs and mining OpenAPI/Swagger specs
• Fuzzing: Test every script and input using four core Burp Intruder attack types: sniper, cluster bomb, battering ram, and pitch fork, drawing on wordlists from sources like SecLists and AssetNote
• Hypotheses and test cases: Turn anomalous responses into testable hypotheses and work through them as a team rather than individually, since properly explaining a hypothesis often surfaces gaps a single tester would miss
• Business processes and logic flaws: Map privilege levels (super admin, customer admin, user, unauthenticated) and application flows such as purchasing, authentication, privilege escalation, and password reset to catch logic flaws that automated scanners cannot
• Frameworks: Apply a Minimum Viable Pentesting (MVP) methodology alongside standards like OWASP's Application Security Verification Standard (ASVS) and the Web Security Testing Guide (WSTG), testing each layer of the stack: middleware, web server, managed code, and backends
• Tools: Use vulnerability scanners and technology-specific tools to assist and automate testing, but the poster is explicit that the goal is to understand how a tool works, not just to run it and accept the output

Avoiding rabbit holes is treated as a discipline of its own: the poster recommends prioritizing width of coverage over depth, spending time on a single interesting exploit path only after the full scope has been covered.

The pyramid's structure argues that penetration testing value comes from process discipline and team collaboration, not individual tool skill, and that testing should not stop once a report is delivered. The poster frames continuity as the real objective: retesting should be triggered by specific application changes rather than run once a year, with examples including a status code shifting from 401 Unauthorized to 200 OK, a new Swagger/OpenAPI definition appearing, a crawl surfacing new dynamic scripts, or new CTI on emerging attack techniques.

This poster was created by Chris Dale for SANS SEC542: Web App Penetration Testing and Ethical Hacking.

This process can aid with tactics across several SANS Offensive Operations courses including SEC542: Web App Penetration Testing and Ethical Hacking.