Overview
Mapping organizes what reconnaissance found into a structured model of the application's attack surface — the endpoints, parameters, and functionality to test. This lesson covers the mapping phase.
Learning objectives
- Explain the purpose of mapping the application.
- Describe what an application map includes.
- Connect mapping to systematic test coverage.
Core concept
Mapping (application/content mapping) builds a structured inventory of the application's attack surface: its pages and endpoints, the parameters each accepts, the HTTP methods supported, authentication and role boundaries, data entry points, and key functionality (login, upload, search, admin areas). It turns raw recon into an organized model that ensures systematic coverage — every input and function is accounted for as a potential test target.
How it works
Using recon output, the tester catalogs each endpoint and its inputs (query/body/path parameters, headers), noting where trust boundaries and privilege levels lie (e.g. which endpoints are admin-only). This map identifies where the vulnerability classes from earlier modules could occur — inputs that flow into queries (SQLi), output points (XSS), object references (BOLA/IDOR), file operations (traversal/upload), URL fetchers (SSRF), and so on. The map then drives the testing phase, ensuring the tester methodically examines each relevant point rather than testing ad hoc.
Practical example
For an in-scope application, the tester produces a map: a list of endpoints (e.g. /login, /search, /api/orders/{id}, /upload, /admin/...), each annotated with its parameters, methods, required privilege, and the vulnerability classes worth testing there (e.g. /search → XSS/SQLi via the query parameter; /api/orders/{id} → object authorization; /upload → upload safety). This structured map becomes the checklist that guides thorough, systematic testing across the whole surface.
Cybersecurity relevance
Mapping is what transforms testing from ad hoc probing into systematic, comprehensive coverage — a hallmark of professional methodology (as in the OWASP approach). A good map ensures no significant input or function is overlooked and lets the tester prioritize high-risk areas. It ties directly to the vulnerability modules: each mapped input/function suggests specific tests. Defenders benefit too, since an accurate map of the attack surface informs where controls must be verified.
Common mistakes
- Testing without a map, leading to missed endpoints/parameters and inconsistent coverage.
- Overlooking hidden or non-obvious inputs (headers, less-visible parameters, admin functions).
- Not linking mapped inputs to relevant vulnerability classes, weakening test focus.
Key takeaways
- Mapping builds a structured inventory of the attack surface: endpoints, parameters, methods, privilege boundaries, and key functionality.
- It ensures systematic coverage and links each input/function to the vulnerability classes worth testing there.
- Mapping turns recon into an organized checklist that drives thorough, prioritized testing — a hallmark of professional methodology.
Check your understanding
- What does an application map include, and why does it improve test coverage?
- How does mapping connect the attack surface to specific vulnerability classes to test?