A key area of penetration testing web servers is to focus in deep on the server's ability to handle requests and serve responses. If you're penetration testing a standard web server deployment, for example Apache or Nginx, then you will want to concentrate on breaking the configuration that's been deployed and enumerating/manipulating the content of the site. If it's a custom web server that you're penetration testing, then it's a good idea to have a copy of the HTTP RFC handy (available at http://tools.ietf.org/html/rfc7231) and to additionally test how the web server handles corrupted packets or unexpected requests.

This chapter will focus on creating recipes that manipulate requests in a way that should uncover the underlying web technologies and parse responses to highlight common issues or key areas for further testing.