enumerate the site...

• try /robots.txt
• are there cookies?
  • try to set your own cookies
• try default common passwords
• Open Dev Tools to inspect Elements, Network requests, front-end source code
  • Firefox: ( cmd-opt-I, or right-click > Inspect, or Tools > Web Developer Tools )
    • source code is in "Debugger" Tab
  • Chrome: ( cmd-opt-I, or right-click > Inspect, or View > Developer > Developer Tools )
    • source code is in "Sources" Tab

fuzz the login or endpoints to find hidden urls

• ffuf
• Burpsuite Repeater / Intruder
• ZAP repeater

inspect requests

GET

• are there query parameters?
  • try SQL injections in the parameter
• try to manipulate any data that is sent in the body

POST

• what kind of data will it accept
• try to manipulate data that is being sent