Scribd Logo
Upload

Welcome to Scribd!

  • 67 views

    WebAppSec Checklist v1

    Uploaded by

    Ankush Bhaal
    This checklist provides tasks to comprehensively test the security of a web application through a blackbox assessment. It includes steps for information gathering, assessing configuration management, secure transmission, authentication, session management, authorization, data validation, denial of service risks, business logic, cryptography, file uploads, payment processing, HTML5 features, and other important security issues. The checklist aims to identify vulnerabilities across all major aspects of the web application's security.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd

    WebAppSec Checklist v1

    Uploaded by

    Ankush Bhaal
    67 views6 pages
    This checklist provides tasks to comprehensively test the security of a web application through a blackbox assessment. It includes steps for information gathering, assessing configuration management, secure transmission, authentication, session management, authorization, data validation, denial of service risks, business logic, cryptography, file uploads, payment processing, HTML5 features, and other important security issues. The checklist aims to identify vulnerabilities across all major aspects of the web application's security.

    Original Description:

    lkl

    Original Title

    WebAppSec_Checklist_v1

    Copyright

    © © All Rights Reserved

    Available Formats

    XLSX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This checklist provides tasks to comprehensively test the security of a web application through a blackbox assessment. It includes steps for information gathering, assessing configuration management, secure transmission, authentication, session management, authorization, data validation, denial of service risks, business logic, cryptography, file uploads, payment processing, HTML5 features, and other important security issues. The checklist aims to identify vulnerabilities across all major aspects of the web application's security.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    67 views6 pages

    WebAppSec Checklist v1

    Uploaded by

    Ankush Bhaal
    This checklist provides tasks to comprehensively test the security of a web application through a blackbox assessment. It includes steps for information gathering, assessing configuration management, secure transmission, authentication, session management, authorization, data validation, denial of service risks, business logic, cryptography, file uploads, payment processing, HTML5 features, and other important security issues. The checklist aims to identify vulnerabilities across all major aspects of the web application's security.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    of 6

    The Checklist

    This cheat sheet provides a checklist of tasks to be performed when performing a blackbox security test of a web application.

    Information Gathering
    Manually explore the site
    Spider/crawl for missed or hidden content
    Check for files that expose content, such as robots.txt, sitemap.xml, .DS_Store
    Check the caches of major search engines for publicly accessible sites
    Check for differences in content based on User Agent (eg, Mobile sites, access as a Search engine Crawler)
    Perform Web Application Fingerprinting
    Identify technologies used
    Identify user roles
    Identify application entry points
    Identify client-side code
    Identify multiple versions/channels (e.g. web, mobile web, mobile app, web services)
    Identify co-hosted and related applications
    Identify all hostnames and ports
    Identify third-party hosted content

    Configuration Management
    Check for commonly used application and administrative URLs
    Check for old, backup and unreferenced files
    Check HTTP methods supported and Cross Site Tracing (XST)
    Test file extensions handling
    Test for security HTTP headers (e.g. CSP, X-Frame-Options, HSTS)
    Test for policies (e.g. Flash, Silverlight, robots)
    Test for non-production data in live environment, and vice-versa
    Check for sensitive data in client-side code (e.g. API keys, credentials)
    Secure Transmission
    Check SSL Version, Algorithms, Key length
    Check for Digital Certificate Validity (Duration, Signature and CN)
    Check credentials only delivered over HTTPS
    Check that the login form is delivered over HTTPS
    Check session tokens only delivered over HTTPS
    Check if HTTP Strict Transport Security (HSTS) in use

    Authentication
    Test for user enumeration
    Test for authentication bypass
    Test for bruteforce protection
    Test password quality rules
    Test remember me functionality
    Test for autocomplete on password forms/input
    Test password reset and/or recovery
    Test password change process
    Test CAPTCHA
    Test multi factor authentication
    Test for logout functionality presence
    Test for cache management on HTTP (eg Pragma, Expires, Max-age)
    Test for default logins
    Test for user-accessible authentication history
    Test for out-of channel notification of account lockouts and successful password changes
    Test for consistent authentication across applications with shared authentication schema / SSO

    Session Management
    Establish how session management is handled in the application (eg, tokens in cookies, token in URL)
    Check session tokens for cookie flags (httpOnly and secure)
    Check session cookie scope (path and domain)
    Check session cookie duration (expires and max-age)
    Check session termination after a maximum lifetime
    Check session termination after relative timeout
    Check session termination after logout
    Test to see if users can have multiple simultaneous sessions
    Test session cookies for randomness
    Confirm that new session tokens are issued on login, role change and logout
    Test for consistent session management across applications with shared session management
    Test for session puzzling
    Test for CSRF and clickjacking

    Authorization
    Test for path traversal
    Test for bypassing authorization schema
    Test for vertical Access control problems (a.k.a. Privilege Escalation)
    Test for horizontal Access control problems (between two users at the same privilege level)
    Test for missing authorization

    Data Validation
    Test for Reflected Cross Site Scripting
    Test for Stored Cross Site Scripting
    Test for DOM based Cross Site Scripting
    Test for Cross Site Flashing
    Test for HTML Injection
    Test for SQL Injection
    Test for LDAP Injection
    Test for ORM Injection
    Test for XML Injection
    Test for XXE Injection
    Test for SSI Injection
    Test for XPath Injection
    Test for XQuery Injection
    Test for IMAP/SMTP Injection
    Test for Code Injection
    Test for Expression Language Injection
    Test for Command Injection
    Test for Overflow (Stack, Heap and Integer)
    Test for Format String
    Test for incubated vulnerabilities
    Test for HTTP Splitting/Smuggling
    Test for HTTP Verb Tampering
    Test for Open Redirection
    Test for Local File Inclusion
    Test for Remote File Inclusion
    Compare client-side and server-side validation rules
    Test for NoSQL injection
    Test for HTTP parameter pollution
    Test for auto-binding
    Test for Mass Assignment
    Test for NULL/Invalid Session Cookie

    Denial of Service
    Test for anti-automation
    Test for account lockout
    Test for HTTP protocol DoS
    Test for SQL wildcard DoS

    Business Logic
    Test for feature misuse
    Test for lack of non-repudiation
    Test for trust relationships
    Test for integrity of data
    Test segregation of duties

    Cryptography
    Check if data which should be encrypted is not
    Check for wrong algorithms usage depending on context
    Check for weak algorithms usage
    Check for proper use of salting
    Check for randomness functions

    Risky Functionality - File Uploads


    Test that acceptable file types are whitelisted
    Test that file size limits, upload frequency and total file counts are defined and are enforced
    Test that file contents match the defined file type
    Test that all file uploads have Anti-Virus scanning in-place.
    Test that unsafe filenames are sanitised
    Test that uploaded files are not directly accessible within the web root
    Test that uploaded files are not served on the same hostname/port
    Test that files and other media are integrated with the authentication and authorisation schemas

    Risky Functionality - Card Payment


    Test for known vulnerabilities and configuration issues on Web Server and Web Application
    Test for default or guessable password
    Test for non-production data in live environment, and vice-versa
    Test for Injection vulnerabilities
    Test for Buffer Overflows
    Test for Insecure Cryptographic Storage
    Test for Insufficient Transport Layer Protection
    Test for Improper Error Handling
    Test for all vulnerabilities with a CVSS v2 score > 4.0
    Test for Authentication and Authorization issues
    Test for CSRF

    HTML 5
    Test Web Messaging
    Test for Web Storage SQL injection
    Check CORS implementation
    Check Offline Web Application

    You might also like