Web Penetration Testing

Web Penetration Testing

1. OWASP 10

   • injection
   • broken auth and session mgt
   • cross-site scripting
   • insecure direct object references
   • security misconfiguration
   • sensitive data exposure
   • missing function level access control
   • cross site forgery
   • using components with known vulnerabilities
   • unvalidated redirects and forwards

2. method

   • web application mapping
     • identify application attack surfaces
       • look for
         • core functionality, logging errors, links
         • technologies and security mechanisms
           • auth
           • session state
           • forms
           • scripts
           • java
           • cookies
           • file extensions
           • dir names
           • session tokens
         • locations where data is processed by app
         • identify entry points for user input
           • URL
           • forms
           • cookies
           • HTTP headers
       • tools
         • hidden content
           • brute force
           • inference
           • public info
         • functional paths
         • hidden parameters
         • web spidering
           • manual
           • automated
         • hidden content
   • vulneraiblity identification
     • potential targets
       • client side validation
       • database interaction
       • file uploading and downloading
       • handling user supplied data
       • dynamic redirects
       • login process
       • session state
       • defeat access control
       • session hijacking, capture of credentials
       • error messages (info leakage)
       • software vulnerabilities
       • web server misconfiguration
     • scanners
       • Nikto
       • Nessus
       • BURP
   • exploit verification of vulnerabilities