You're reading from Practical Web Penetration Testing

Product typeBook

Published inJun 2018

PublisherPackt

ISBN-139781788624039

Edition1st Edition

Tools

Kali Linux

Concepts

Cybersecurity

Author (1)

Gus Khawaja

Understanding Web Application Vulnerabilities

This chapter is going to be your main pillar of application security. You will learn the logic behind the most popular vulnerabilities in this field. Most attacks that are executed remotely use the web application infrastructure to get in. Finding a vulnerability such as SQL Injection on a site can be very harmful, as the attacker can take complete control of the server.

Web applications are written in different programming languages, but the most popular ones are Java, .NET, and PHP. These days, we see a shift in web application programming, where the JavaScript language or the frontend takes an important part. Companies are using light-weight frontend technologies such as AngularJS to implement the idea of Single-Page Applications. As an application security pentester, you need to be aware of the vulnerabilities that exist for these...

File Inclusion

As the name suggests, this vulnerability can be exploited by including a file in the URL (by entering the path). The file that was included can be local to the server, and thus be called Local File Inclusion, or it (the path of the file) can point to a remote file, and thus be called a Remote File Inclusion.

Modern programming languages and web servers have built-in mechanisms to protect against this flaw. Unfortunately, in real life, you will encounter a lot of applications developed by legacy programming languages such as JSP (Java), ASP (Microsoft), and PHP, so the chance of finding a similar vulnerability is still there. One problem that can cause this issue is when the developer forgets to include a validation on the server side.

Local File Inclusion

...

Cross-Site Scripting

Cross-Site Scripting (XSS), is exploited when the attacker can successfully execute any type of script (for example, JavaScript) on the victim's browser. These types of flaws exist because the developer did not validate the request or correctly encoded the response of the application. JavaScript is not the only script language used for XSS but it is the most common (in fact it's my favorite); attackers sometimes use scripting languages such as VBScript, ActiveX, Flash, and many more.

XSS is very popular and I encounter it every day while testing web applications. Every time I see a message displayed on the page that reflects a user input or behavior, then most probably it is vulnerable to XSS. But don't worry, with experience and practice, things will become more obvious to you as well. There are three types of XSS attacks: Stored, Reflected...

Cross-Site Request Forgery

A Cross-Site Request Forgery (CSRF) (some people pronounce it as sea surf), can be exploited when an attacker takes advantage of the user session to perform state-changing requests such as posting to a social network platform, money transfers, and much more.

This attack will involve some social engineering efforts from the attacker to convince the victim to visit the infected site. Imagine that the victim is an admin of a system, then the attacker can manipulate that system if it doesn't have a CSRF protection. The most popular question in interviews for Application Security Engineer positions is the following: What is the difference between XSRF and XSS? The simpler the answer is, the better. In summary, XSS attacks rely on executing JavaScript in the victim's browser, while XSRF relies on taking advantage of the victim's session. Next...

SQL Injection

The SQL Injection is my favorite one, and it's the most dangerous one that you will encounter in your career. An SQL Injection vulnerability will allow a malicious user to execute SQL commands on the database through the web browser. The cause of this problem is like any other web vulnerability; the developer forgot to add any validation on the server side to protect against SQLi attacks.

Here's the most interesting part; an SQLi vulnerability will allow you to do the following:

Query the database using a select statement (for example, select the users table, thereby extracting the usernames and passwords)
Bypass the login page by executing successful query results (you'll see an example soon)
Execute system commands in the database in order to compromise the web server
Execute inserts/delete commands to manipulate the records in the database

It...

Command Injection

Command Injection is very simple, you just exploit it by executing commands on a web page because it allows you to do so. In other words, if you ever see a page that offers the functionality of executing a command in the backend, then it's probably vulnerable to this attack. Command Injection is very popular in Capture the Flag (CTF) because it allows you to completely own a remote machine (the machine that hosts the web application).

As usual, let's see a practical example using Mutillidae. Open the left menu OWASP 2017 | Injection | Command Injection | DNS Lookup:

This page executes the DNS Lookup command in the backend. In this example, I entered the IP address 10.0.0.1 and clicked on the Lookup DNS button.

Do you think we can override the normal behavior of this page and execute any command of our liking? (Or maybe execute a backdoor such as netcat...

OWASP Top 10

In the preceding section, you've seen the most important web application vulnerabilities in the OWASP Top 10. The OWASP list includes even more items than what you have witnessed up until now. Application Security Professionals always keep the OWASP Top 10 as a reference in their career. This list is always kept up to date by the OWASP community and the latest version is the one that you saw in the Mutillidae Menu OWASP Top 10 – 2017; if you're reading this book in the future then there will probably be a newer list.

If you have any doubts about the understanding of any of the top 10 items, then don't worry, because we will revisit those items one more time in the web intrusion tests later in this book with more practical examples; for the time being, try to see the big picture.

Let's take a look at the Top 10 items in a simplified way so...

Summary

I hope that you understood this chapter very well! I mean it; this chapter is key to your success in understanding application security vulnerabilities. If you're hesitant about any of the preceding topics, please stop and try to review them one more time. You should already have installed Mutillidae on your lab machine and started practicing all the preceding examples.

The topics that we discussed in this chapter do not incorporate all web application vulnerabilities, but I covered the most important ones that you will encounter in your career. SQLi is the most dangerous one and XSS is the most popular one that you will face during Web Intrusion Tests.

Later, we will re-visit these vulnerabilities over and over again, and that's why you must master this chapter; if you don't, you will find the upcoming chapters difficult to understand.

...

The rest of the chapter is locked

You have been reading a chapter from

Practical Web Penetration Testing

Published in: Jun 2018Publisher: PacktISBN-13: 9781788624039

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Author (1)

Gus Khawaja

Gus Khawaja holds a bachelor's degree in computer science. He specializes in IT security and ethical hacking. He is an author and shares his passion with millions of viewers around the world using his online courses. He also works as a cybersecurity consultant in Montreal, Canada. After many years of experience in programming, he turned his attention to cybersecurity and the importance that security brings to this minefield. His passion for the ethical hacking mixed with his background in programming and IT makes him a wise swiss-knife professional in the computer science domain.
Read more about Gus Khawaja

Other recommended products

Related to this chapter

Burp Suite Cookbook

The purpose of the Burp Suite Cookbook is to provide web application penetration testers with hands-on examples of how to use Burp Suite to perform web assessments. The book gives detailed screenshots demonstrating how to perform various attacks in Burp including Cross-site Scripting (XSS), SQL Injection, Cross-site Request Forgery, XML External Entity (XXE), and many more.

BookSep 2018358 pages

Network Scanning Cookbook

Network Scanning Cookbook enables a reader to understand how to perform a Network Scan, which includes Discovery, Scanning, Enumeration, Vulnerability detection etc using scanning tools like Nessus and Nmap. If the reader is an auditor, they will be able to determine the security state of the client's network and recommend remediations accordingly.

BookSep 2018304 pages

Hands-On Application Penetration Testing with Burp Suite

Using Burp Suite, you can quickly build proof of concepts, extract data via an exploit, attack multiple end points in an application and even begin to script complex multi stage attacks. This book will provide a hands-on coverage on how you can get started with executing an application penetration test and be sure of the results.

BookFeb 2019366 pages

Kali Linux Cookbook

Kali Linux is a Linux distribution designed for penetration testing and security auditing. It is the successor to BackTrack, the world’s most popular penetration testing distribution. Kali Linux is the most widely used platform and toolkit for penetration testing. Security is currently the hottest field in technology with a projected need for millions of security professionals. This book focuses on enhancing your knowledge in Kali Linux for security by expanding your skills with toolkits and frameworks that can increase your value as a security professional.

BookSep 2017438 pages

Learning Python Web Penetration Testing

This book will walk you through the web application penetration testing methodology, showing you how to write your own tools with Python for every main activity in the process. It will show you how to test for security vulnerabilities in web applications just like security professionals and hackers do.

BookJun 2018138 pages

Metasploit for Beginners

Metasploit for Beginners will provide a good starting point to perform penetration testing and identify threats and vulnerabilities to secure your IT environment. This book would help the reader absorb the essential concepts on using Metasploit framework for comprehensive penetration testing. By the end of the book, the reader would feel confident on having gained sufficient hands-on knowledge on effectively utilizing the framework in real world scenarios.

BookJul 2017190 pages

Metasploit 5.0 for Beginners

Metasploit 5.x for Beginners will provide a good starting point to perform penetration testing and identify threats and vulnerabilities to secure your IT environment. You will be able to analyze, identify, and exploit threats and vulnerabilities to secure your IT environment.

BookApr 2020246 pages

ASP.NET Core 5 Secure Coding Cookbook

There are various ways to fix an ASP.NET Core web application security flaw. However, very few books share expert advice relating to which approaches work best for ASP.NET Core apps – unlike this book. The ASP.NET Core Secure Coding Cookbook is your guide to tackling the most common ASP.NET Core web application vulnerabilities.

BookJul 2021324 pages

Learn Penetration Testing

A penetration test, also known as a pen test, is a simulated cyberattack against your computer system to check for exploitable vulnerabilities. In the context of web application security, penetration testing is commonly used to augment a web application firewall (WAF). This book teaches you various penetration testing techniques in order to become a proficient Penetration tester.

BookMay 2019424 pages

Kali Linux Web Penetration Testing Cookbook

Kali Linux is the most popular open-source penetration toolkit used for effective web penetration testing. This book will teach you, in the form of step-by-step recipes, how to detect a wide array of vulnerabilities, exploit them to analyze their consequences, and ultimately buffer attackable surfaces so applications are more secure.

BookAug 2018404 pages

Learn Kali Linux 2019

The current trend of various hacking and security breaches displays how important it has become to pentest your environment, to ensure end point protection. This book will take you through the latest version of Kali Linux to efficiently deal with various crucial security aspects such as confidentiality, integrity, access control and authentication.

BookNov 2019550 pages

Mastering Kali Linux for Advanced Penetration Testing

Mastering Kali Linux for Advanced Penetration Testing, Third Edition will guide you through proven techniques to test your infrastructure security using Kali Linux. From selecting the most effective tools to carrying out advanced pentesting in highly secure environments, this book will help you gain the expertise you need to advance in your career.

BookJan 2019548 pages

Personalised recommendations for you

Based on your interests and search pattern

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.

BookAug 2023338 pages

Automotive Cybersecurity Engineering Handbook

This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.

BookOct 2023392 pages

Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.

BookAug 2023496 pages

Cloud Penetration Testing for Red Teamers

The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.

BookNov 2023298 pages

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.

BookSep 2023316 pages5

Burp Suite Cookbook

Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.

BookOct 2023450 pages

Building and Automating Penetration Testing Labs in the Cloud

This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.

BookOct 2023562 pages

Ethical Hacking Workshop

As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.

BookOct 2023220 pages

Windows Forensics Analyst Field Guide

This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.

BookOct 2023318 pages

Implementing DevSecOps Practices

This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.

BookDec 2023258 pages