Web Intrusion Tests

The purpose of this whole book was mainly to get to this topic: the Web Intrusion Test, also known as the Web Penetration Test. You probably bought the book because of this topic, but you need to know that web penetration testing is only one piece of the puzzle. In order to achieve a successful, full penetration test, you need to include Threat Modeling, Source Code Review, and network pentests, as well.

The Chapter 7, Application Threat Modeling, should have given you an architectural overview of web applications, and the Source Code Review should've given you a deep understanding too. Don't forget network pentests, which can reveal interesting vulnerabilities. I've created this sequence of chapters for a reason—to reflect real-life scenarios. I'm not writing this book for money; in fact, I want my readers to wonder, who is the author...

Web Intrusion Test workflow

This is the most important section of this chapter, because it will allow you to structure your tests. A challenge that a typical pen tester will face is everyone telling them to refer to the OWASP checklist for web intrusion tests. But, the big questions that all testers will ask themselves are, where do I start? How do I proceed with the checklist? Before I get into the steps, let's take a look at an image of this workflow, a picture worth a thousand words. My workflow is based on a proxy-based tool: Burp Pro. Please refer to Chapter 4, All About Using Burp Suite at the beginning of this book for more details:

1. The first step is not mentioned in the preceding diagram; it's the web server vulnerability assessment, which we discussed in the previous chapter.
2. The second step is to fire Burp and make sure that the intercept is on in the Proxy...

Identifying hidden contents

Practically speaking, the big question that you will ask yourself is, what do I need to find? You will need a solid checklist to refer to when it's time for your web intrusion test. That being said, here's a checklist that you can use for this step in the workflow:

1. Robots.txt file
2. Backup files (.bak, .old)
3. Other interesting files (.xls, .doc, .pdf, .txt)
4. Administration URL (for example, phpmyadmin, wp-admin)
5. Debugging leftover pages and URLs
6. Is CMS used? (WordPress)

If you find any item in the preceding list, check its contents for juicy information, including:

• Personal information
• Email addresses
• Credentials
• An entry point to another system (for example, WordPress)

Common web page checklist

This is at the heart of the checklist for web intrusion testing. As mentioned in the preceding workflow, you will need to apply this checklist to every page, regardless of its nature. Let's dive in:

1. Identify the entry points to the web page (which lead to the backend; remember that we will use the entry points in the next steps), including:
   • URLs
   • Headers (for example, cookie, URL referrer, and so on)
   • HTML controls (drop-down list, radio button, hidden input, textbox, and so on)
2. Check all of the backend or third-party web services and web APIs called using Burp Target.
3. Force the URL into HTTP mode, and see if it works, or if it stays in HTTPS.
4. Try to make the page generate an error; in another words, do error messages reveal clues to hackers?
5. Test for logic flaws (for example, purchasing an item with zero dollars, or applying a randomly generated...

Special pages checklist

You will encounter some specific pages during pen tests, and when you do, you'll have to use a checklist different from the one we used before. Take note that you will still need to use the common checklist too, after finishing this step:

1. Login page (this includes the admin page):
   1. Test for default credentials (for example, username= admin and password= admin).
   2. Brute-force credentials using a dictionary file.
   3. Test for a lockout after a number of failed attempts for accomplishing a DOS instead.
   4. Does it use CAPTCHA? It allows for defending against automated attacks.
   5. Use SQL injection to bypass authentication.
   6. Do they use remember me passwords?
2. Registration page:
   1. Do they allow weak passwords?
   2. If you register with an existing username, will you be able to enumerate users?
   3. Test for weak, pre-generated questions and answers (for example, favorite color...

Reporting

After finishing your penetration testing activities, you will need to create a report. People tend to copy and paste from the tools' (Burp, Nessus, and so on) auto generated reports. This is what differentiates an amateur from a professional: the latter will make sure to verify the false positives and re-evaluate the scoring of a vulnerability. In this section, I will show you how to evaluate the scoring of your findings, and after that, I will share a template that you can use to get ideas for your future reporting activities.

Common Vulnerability Scoring System – CVSS

The Common Vulnerability Scoring System (CVSS) v3 came out a while ago, as an enhancement for CVSS v2. The big question is: why do you...

Summary

I hope that you liked this chapter. Most importantly, I hope that it will help you get your pen test tasks done quickly and efficiently. The workflow that I shared with you in this chapter is the secret sauce for your success; I use it during my own pen tests. I did my best to give you a checklist without nitty-gritty details, because you should've learned those at the beginning of this book (especially in Chapter 5, Understanding Web Application Vulnerabilities). I structured the book this way for a reason.

At this point, you've seen all of the activities for penetration testing, from Threat Modeling to Web Intrusion Testing. What's next? Now that you've seen it all, the next step is to learn how to automate penetration testing tasks by using the amazing programming language that is Python.