Manually Walking a Web Target After Recon

Spider scripts don't feel checkout guilt or notice the 'Export all users' button half-hidden in settings. Manual walking is where business logic lives.

I treat first pass as ethnography: watch what the app wants users to do, then ask what it allows when you deviate.

Manual walking is where you earn intuition about an app—automation tells you what exists, your eyes tell you what the business cares about.

Invite a product manager demo when allowed—watching real users beats solo clicking.

A walkthrough rhythm

Create accounts per role. Click every nav item once. Note multi-step flows, file uploads, sharing features, and integrations.

Keep proxy history tagged by feature area.

What automation misses

Conditional UI, feature flags, email-linked actions, and race windows in wizards.

• Read client-side validation as hints, not security

• Compare desktop vs mobile layouts

• revisit after a day—deploys happen mid-test

When to go deep

Pause walking when a hypothesis forms—validate before collecting more surface area.

Manual mapping scales with curiosity, not caffeine alone.

Stay within authenticated test accounts and scope boundaries.

Schedule a second manual pass after reading dev release notes or changelogs mid-engagement—features appear quietly behind flags.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Pause walking when you hit payment flows—give them a full hour, not leftovers.

Accessibility and locales

Test alternate locales and currency toggles—logic bugs hide in region-specific flows.

Note feature flags in cookies or headers; they reveal half-built admin features.

Session continuity

Resume walking after major app releases mid-engagement—feature flags change surfaces overnight.

Record short screen captures of confusing UX; devs fix faster when they see user confusion.

Invite client SMEs to walk with you when allowed—they reveal 'yeah we never secured that' moments.

---

Worth reading next

From Recon Data to Testing Hypotheses

Business Logic Flaws and Broken Access Control

Penetration Testing: Web Application Checklist (WAPT)