7. Master the Basics, Break the Web: Backend Application Flow

You don’t need to be a developer, just understand the flow.

Backend Application Flow

1. Routing

Routing is the backend mechanism that decides which code should run when a specific URL or endpoint is requested. When the server receives a request, it matches the HTTP method + path (e.g., GET /users/10) to a predefined route, which then triggers the correct controller or handler function. Routing allows the backend to organize functionality cleanly—such as login routes, API endpoints, admin pages, and CRUD operations.

Pentest Relevance:

• Hidden or undocumented routes may expose sensitive functionality.
• Weak authorization inside routes can lead to IDOR, privilege escalation, or access control failures.
• Manipulating route parameters (IDs, slugs, paths) helps test how the backend validates and processes user input.

💡Example: A backend might define: GET /profile/:id → view profile A pentester tests /profile/2, /profile/3, etc., to see if unauthorized profiles are exposed.

2. Controllers

Controllers are the backend components responsible for handling the logic behind each route. Once routing decides which endpoint is being accessed, the controller processes the request — validating input, interacting with the database, executing business logic, and generating the response. Controllers serve as the bridge between user input and the core functionality of the application.

Pentest Relevance:

• Weak or missing validation inside controllers often leads to injection attacks, IDOR, and broken access control.
• Controllers may expose sensitive actions (like admin operations) if not properly restricted.
• Reviewing controller logic helps identify assumptions made about user input and trust boundaries.

💡Example: For the route/transferThe controller will:

• Validate the request body
• Check authorization
• Update account balance
• Return success/failure

3. Database Queries

Database queries are the commands the backend uses to read, create, update, or delete data stored in the database. When a controller receives a request, it builds a query — often using user-provided input — and sends it to the database engine (SQL, NoSQL, etc.). Since the database is the core data source, secure query handling is critical to prevent data leakage or manipulation.

Pentest Relevance:

• Unsafe query construction leads to SQL injection or NoSQL injection.
• Attackers may manipulate parameters to access unauthorized records (IDOR).
• Query behavior reveals how data is structured and stored, aiding deeper testing.

💡Example: A vulnerable SQL query:

SELECT * FROM users WHERE id = " + userInput;

If userInput = 1 OR 1=1The attacker retrieves all users.

4. ORMs vs Raw SQL

ORMs (Object-Relational Mappers)

ORMs allow developers to interact with the database using code objects instead of writing SQL manually. They automatically generate SQL queries based on functions like findUser() or updateProfile(). ORMs simplify development and reduce common mistakes by handling data mapping and input escaping.

Pentest Relevance:

• ORMs reduce SQL injection risk but do not eliminate it — unsafe query building (e.g., string concatenation) still leads to vulnerabilities.
• Logic flaws in ORM filters may expose data unintentionally.
• Pentesters look for custom queries or places where developers bypass ORM protections.

💡Example: User.find({ id: userInput }) If written safely, ORM escapes inputs automatically.

Raw SQL

Raw SQL involves directly writing SQL queries inside backend code. This gives developers full control over query logic, performance, and complex operations. However, it also increases the chance of unsafe string concatenation if inputs aren’t sanitized.

Pentest Relevance:

• Raw SQL is highly vulnerable to SQL injection when user input is not parameterized.
• Pentesters inspect endpoints that send dynamic or complex queries.
• Raw queries reveal the database structure and can lead to full data compromise when misused.

💡Example:

"SELECT * FROM users WHERE name = '" + userInput + "';"

Unsafe input here can lead to full SQL injection.

5. Template Engines (Jinja, EJS, PHP Templates)

Template engines generate dynamic HTML by combining backend data with HTML templates. They allow developers to embed variables, loops, and logic directly in HTML files, which are rendered on the server before being sent to the browser. Popular engines include Jinja (Python), EJS (Node.js), and PHP’s native templating system.

Pentest Relevance:

• Improper handling of user input in templates may lead to Server-Side Template Injection (SSTI).
• Template injection can lead to XSS or even full remote code execution (depending on the engine).
• Pentesters test whether user-controlled data is inserted into templates without validation or escaping.

💡Example:

In Jinja:

{{ userInput }}

If this receives unsanitized user input, a payload like {{7*7}} may execute on the server, confirming SSTI.

6. Error Handling & Logging

Proper error handling ensures that applications fail safely without exposing sensitive details. When something goes wrong — invalid input, database errors, permission issues — the server should return controlled, user-friendly messages while recording full technical details in logs. Logging helps developers debug issues, track suspicious activity, and maintain audit trails.

Pentest Relevance:

• Detailed error messages can leak stack traces, SQL queries, file paths, or internal logic.
• Poor error handling may reveal which inputs break validation, aiding attacks like SQLi or XSS.
• Logs may store sensitive data (passwords, tokens) if not properly filtered, increasing risk if breached.

💡Example:

A vulnerable app might return:

SQL Error: syntax error near "OR 1=1" in query: SELECT * FROM users...

This confirms the backend query and reveals the injection point.

7. Custom Middleware

Middleware is code that runs before or after request handling, sitting between the client request and the main application logic. Custom middleware can perform tasks such as authentication checks, logging, rate limiting, request parsing, or modifying request/response data. Because middleware executes globally, it influences how every request is interpreted by the backend.

Pentest Relevance:

• Weak or incorrect middleware logic can expose endpoints without proper authentication or validation.
• Misordered middleware (e.g., auth after routing) can allow bypasses or unauthorized access.
• Custom parsing or filtering in middleware may introduce vulnerabilities like request smuggling or input manipulation.

💡Example: A middleware that checks roles before accessing /admin must run before route handling. If placed incorrectly, attackers may access /admin routes without authorization.

Wrapping up here — next up: API Basics

Catch you soon 🙌,
Abinesh